Information on the Processing of Personal Data

The company Label S.r.l. (hereinafter referred to as ‘Label’) informs you that

the personal data acquired following the creation of an Account and the use of

this App shall be treated in compliance with the law on the protection of personal

data.

With reference to the methods of management and processing of Users'

personal data, pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter

‘GDPR’), Label provides the following information:

1. TYPES OF DATA COLLECTED

Personal data provided willingly by the data subject.

When creating an Account and using the App, the following personal data are

collected and processed:

• Personal data;

• Company you work for;

• Geolocation data;

• Contact details;

• Password.

The special categories of data indicated in Article 9 of the GDPR to be

understood as: personal data revealing racial or ethnic origin, political opinions,

religious or philosophical beliefs, trade union membership, as well as genetic

data, biometric data intended to uniquely identify a natural person, data relating

to a person's health or sex life or sexual orientation shall not be collected and

processed.

2. PURPOSE AND LEGAL BASIS OF PROCESSING

Personal data provided by the data subject and collected by Label shall be

processed for the following purposes:

a) Allow you to create an Account to use the Label Air Display App.

The legal basis for the processing of personal data by Label for this

purpose is to be found in the case provided for in Article 6, para. 1(b) of

the GDPR, i.e. processing is carried out insofar as necessary to provide

the User with the requested service;

b) Fulfil any obligations under laws, regulations or requests by judicial

authorities.

The legal basis for the processing of personal data for this purpose is to

be found in the case provided for in Article 6, para. 1(c) of the GDPR, i.e.

c) insofar as the processing is necessary to fulfil a legal obligation which the

Data Controller is subject to;

d) Sending promotional material to the data subject through e-mail messages

relating to services or products of the Data Controller similar to those

already purchased by the data subject.

The legal basis for the processing of personal data for this purpose is to

be found in the case provided for in Article 130(4) of Italian Legislative

Decree no.196 of 30 June 2003 (Privacy Code), i.e. insofar as the

processing is necessary for the pursuit of the legitimate interest of the

Data Controller in maintaining a commercial relationship with its customers

through promotional tools;

e) To assert or defend a right in court.

The legal basis for the processing of personal data for this purpose is to

be found in the case provided for in Article 6, para. 1(f) of the GDPR, i.e.

the processing is carried out because it is necessary for establishing,

exercising or defending a right in a court of law.

3. DATA RETENTION PERIOD

Personal data collected and processed for the purposes set out in points 2a),

2b) and 2d) shall be retained for the entire period of provision of the service and

for a maximum period of 10 years, with the exception of those required to

comply with tax, accounting and administrative regulations or to fulfil other legal

obligations and to document the activities carried out. Personal data collected

and processed for the purpose indicated in point 2c) shall be retained for a

maximum period of 24 months after the last contact with the data subject.

4. PROCESSING METHODS

The personal data collected shall be processed and stored by electronic means

and shall be stored on computer media as well as on paper media, organised in

databases, and on any other suitable media.

Specific security measures are complied with to prevent loss of data, unlawful or

incorrect use and unauthorised access.

Label‘s processing of personal data does not involve any automated decision-

making processes.

5. COMMUNICATION OF PERSONAL DATA

The communication of data for the purposes of point 2a), 2b) and 2d) is a

contractual obligation and is a necessary requirement for the performance of the

contractual relationship and for the fulfilment of legal obligations, therefore,

mandatory for these purposes. Failure to provide personal data on the part of

the data subject shall make it impossible for Label to provide the requested

service. The provision of data for the purpose referred to in point 2c) is optional;

failure to provide data for said purpose does not entail any consequences for the

User.

6. SUBJECTS TO WHOM PERSONAL DATA MAY BE DISCLOSED

The personal data collected shall not be disseminated and may be disclosed, in

addition to persons who have been acknowledged the right and interest in

accessing your personal data by law or by secondary and/or EU regulations, to

the Data Controller's internal personnel, as well as to companies, associations

or professional firms that provide services and activities on behalf of the Data

Controller in their capacity as Data Processors (including digital service

providers) in order to fulfil legal obligations, as well as for any organisational and

administrative requirements to provide the services requested.

The names of additional persons who may come into contact with the data of

data subjects in their capacity as Data Processors are listed in an up-to-date list

available from Label (to be requested using the contact information provided in

point 9).

7. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA OR

TO INTERNATIONAL ORGANISATIONS

Label does not transfer data of data subjects outside the European Economic

Area or to international organisations.

8. RIGHTS OF THE DATA SUBJECT

In relation to the above-mentioned data processing, the data subject is entitled

to exercise at any time the rights set forth by the GDPR, including, for example,

to obtain information:

• On the origin of personal data;

• On the purposes and methods of the processing;

• On the logic applied in the case of processing carried out with the aid of

electronic instruments;

• On the identification details of the Data Controller, the Data Processors

and the Designated Representative.

The data subject has the right to obtain:

• Access, updating, rectification or, when interested, amendment of data;

• The erasure, transformation into anonymous form or blocking of data

processed in breach of the law;

• The restriction of processing of data concerning him/her, i.e. the right to

ask the Data Controller or the Data Processor to reduce the purposes or

the manner in which his/her data are processed.

The data subject may also ask for a copy of his or her data in a standardised

format (known as ‘Right to data portability’).

Finally, the data subject has the right to object at any time and without cost,

wholly or in part:

• For legitimate reasons, to the processing of personal data concerning

him/her, even if pertinent to the purpose of collection;

• To the processing of personal data relating to him/her carried out pursuant

to Article 6, para. 1(e) of the GDPR (‘processing is necessary for the

performance of a task carried out in the public interest or in the exercise of

official authority vested in the controller’) or Article 6, para. 1(f) of the

GDPR (‘processing is necessary for the purposes of the legitimate

interests pursued by the controller or by a third party’), including profiling

on the basis of these provisions;

• The processing of personal data concerning him/her for the purpose of

sending advertising material or direct sales or for carrying out market

research or direct marketing, including profiling insofar as it is related

thereto.

The data subject has the right to withdraw his or her consent to the processing

when this is based on the case provided for in Article 6, para. 1(a) of the GDPR

(‘the data subject has given consent to the processing of his or her personal

data for one or more specific purposes’) or Article 9, para. 2(a) of the GDPR

(‘the data subject has given explicit consent to the processing of those personal

data for one or more specified purposes’) at any time without affecting the

lawfulness of the processing based on the consent given before withdrawal.

Specifically, the data subject, in order to no longer receive promotional e-mails,

may at any time request to be removed from the service free of charge by

sending a message to the contact details provided in point 9.

If the data subject considers that processing concerning him or her is in breach

of the legislation in force, he or she has the right to lodge a complaint with a

supervisory authority, namely in the Member State in which he or she normally

resides or works or in the place where the alleged breach occurred. The contact

details of the Italian supervisory authority are provided on its website.

9. DATA CONTROLLER AND CONTACT DETAILS

The Data Controller is Label S.r.l., with registered office in via Don Antonio

Mazzucotelli no.6/A, 24020 Gorle, Bergamo, Italy, Tax ID/VAT 01666710163.

The Data Controller can also be contacted by e-mail at

adm.dep@labelgroup.com.

To exercise the rights listed above, the data subject may submit a request by

sending an e-mail to adm.dep@labelgroup.com.

Label S.r.l.

Version 1.0/2023-05/EN