PRIVACY POLICY

1. OWNER OF THE TREATMENT
1.1. The Data Controller of personal data is Banci Firenze S.r.l. with registered office in Via di Bellosguardo 2R - 50124 Florence - Italy, VAT IT07056000487 (hereinafter "Banci Firenze S.r.l. " or "Data Controller"), telephone no. +39055 751 941, online@banci.it.

2. NATURE OF THE DATA PROCESSED AND PURPOSE OF THE TREATMENT
2.1. The personal data processed are exclusively of users who have reached the age of majority, where personal data means any information on an identified natural person or who can be identified, directly or indirectly by reference to any other information. The data processed are those provided by the user to the Data Controller when registering for the newsletter Service and/or when requesting the supply/activation of a Banci Firenze S.r.l. Service. and/or when sending communications to Banci Firenze S.r.l. by e-mail or through a special form to be filled in, such as name and surname, date of birth, e-mail address, postal address, telephone number, as well as the data collected by Artemest while browsing the Site, such as IP address, information obtained through cookies. 2.2 The Data Will Be Used For The Following Purposes: A) for the execution of the requested Services, for the fulfillment of obligations established by law and by community regulations or standards, as well as for the exercise of rights in court; B) for the promotion, by e-mail, telephone calls with an operator, sms, mms, of commercial proposals relating and/or connected to the Services of Banci Firenze S.r.l. , as well as for sending advertising material concerning exclusively products or services of Banci Firenze S.r.l. , as well as for carrying out market surveys and sending free samples or promotional gifts of modest value; C) for the analysis of consumer habits and consumption choices, for the creation of a user profile based on the information and preferences expressed while browsing the Site or while using the requested Services, for the purposes of 'sending of personalized advertising communications by e-mail, sms, mms, paper mail and telephone calls with an operator. The profiling activity as identified in point 2.2C will not produce legal effects on the user nor will it concern him personally, except for the communication and promotion of personalized offers.

3. MANDATORY/OPTIONAL NATURE OF THE PROVISION OF DATA
3.1 The provision of the data requested at the time of activation of the Services for the purposes identified in point 2.2A above is mandatory, as it is strictly functional to the provision of the requested Services and to the fulfillment of legal obligations. Any refusal to provide data will make it impossible for Banci Firenze S.r.l. to complete the process of providing the requested Services and/or to fulfill legal obligations. 3.2 The provision of the data required for the purposes identified in sections 2.2B, 2.2C above is optional. Any refusal to consent to the purposes referred to in sections 2.2B, 2.2C will have no consequence on the provision of the Services. Users will still be able to use the services of Banci Firenze S.r.l. . Users can oppose the processing for the purposes referred to in sections 2.2B, 2.2C both immediately, by not giving consent during the activation of the newsletter Service or other Services, and at a later time, by sending an e-mail to online@banci.it. When activating the Services, users tick the checkboxes to consent to the use of the data identified above for the purposes specified therein; in the event that users do not select a specific checkbox, it will be deemed that they have not consented to the processing for this purpose.

4. METHOD OF TREATMENT
4.1 User data will be collected online during the activation of the requested Services, through the comparison of elements or parts of information, or through the use of the e-mail service. 4.1 User data will be collected online during the activation of the newsletter Service or other Services.2 The processing of user data will take place through registration, consultation, communication, storage and cancellation operations carried out mainly with electronic tools and manually, ensuring the adoption of suitable measures to protect the security and guarantee the confidentiality of the data processed. 4.3 User data, stored in electronic/magnetic/digital form, is stored and archived on a server located in the United States; personal data kept in paper form will be filed in special registers and/or files whose conservation will be guaranteed by placing them in special containers, kept in suitable premises. Banci Firenze S.r.l. declares that the data recorded on its server and/or in suitable premises are protected against the risk of intrusion and unauthorized access, and that it has adopted suitable security measures to guarantee the integrity and availability of the data and to protect the areas and places of conservation and accessibility of the data themselves. In particular, the company hosting our server has been duly certified according to the Privacy Shield. 4.4 Personal data will be processed by employees and/or collaborators of Banci Firenze S.r.l. who act as managers or persons in charge of processing, within the scope of their respective functions and according to the instructions given by Banci Firenze S.r.l.

5. DISCLOSURE OF DATA
5.1 Users' personal data may be communicated to certain subjects appointed by Banci Firenze S.r.l. to provide the requested Services and to fulfill legal obligations. The data may be communicated to: a) persons, companies or professionals who supply Banci Firenze S.r.l. accounting, administrative, legal, tax and financial assistance, consultancy and collaboration services; b) persons delegated and/or appointed by Banci Firenze S.r.l. for the performance of activities or parts of activities connected to the provision of the requested Services and all other external subjects who collaborate with Banci Firenze S.r.l. and that they must be made aware of the data in order to correctly fulfill the obligations of Banci Firenze S.r.l. deriving from the contract for the supply of the Services; c) Public Authorities in carrying out their institutional functions, within the limits established by laws and regulations. User data will not be disclosed. The Data Controller has appointed Managers for the processing of personal data. The updated list of all Data Processors can be requested at the following e-mail address online@banci.com. Banci Firenze S.r.l. may periodically update the list.

6. YOUR RIGHTS
6.1 Users (hereinafter "interested") have the right to obtain confirmation of the existence of their personal data and the purposes of the processing at any time. Users also have the right to request the updating, rectification, cancellation or blocking of data and to refuse its use, in whole or in part. 6.2 User rights are listed below. In particular: 6.2.1 The interested party has the right to obtain confirmation as to whether or not personal data concerning him is being processed and, in this case, to obtain access to personal data and the following information. 6.2.1 The data subject has the right to obtain access to personal data and the following information.2 The data subject has the right to be informed of: a) the identity and contact details of the data controller and, where appropriate, of the data controller's representative' b) the contact details of the data protection officer, if applicable; c) the categories of personal data, their origin, the purposes of the processing for which the personal data are intended, as well as the legal basis of the processing; d) any legitimate interests pursued by the data controller or by third parties; e) any recipients or categories of recipients of the personal data; f) where appropriate, the fact that the data controller intends to transfer personal data to a third country or to an international organization and the existence or absence of an adequacy decision by the Commission, or reference to appropriate protections or suitable and the means of obtaining a copy or if they have been made available. 6.2.3 In addition to the above information, the controller shall provide the data subject with the following additional information:
a) the period for which the personal data will be stored or, if this is not possible, the criteria used to determine this period; b) the existence of the right to ask the data controller for access to personal data, the rectification or cancellation of the same or the limitation of the treatment that concerns him or to oppose their treatment, as well as the right to data portability; c) in the event that the treatment is based on the users' consent, the existence of the right to withdraw the consent at any time, without prejudice to the lawfulness of the treatment based on the consent before its revocation; d) the right to lodge a complaint with a supervisory authority (Data Protection Authority); e) the existence of an automated decision-making process, including profiling, and, in cases where this latter automated decision-making process produces legal effects concerning him or her or similarly significantly affects him, relevant information on the logic involved, as well as the meaning and consequences of such processing for the data subject. 6.2.4 The interested party has the right to object, at any time, to the processing of personal data concerning him: a) for reasons related to your particular situation, including profiling; b) if the personal data are processed for direct marketing purposes, including profiling to the extent that it is connected to such direct marketing. 6.2.5 The data subject has the right to:
a) obtain from the data controller, without unjustified delay, the rectification of inaccurate personal data concerning him. Taking into account the purposes of the processing, the interested party has the right to have incomplete personal data completed, also by providing a supplementary declaration; b) receive the personal data concerning him, which he has provided to Artemest, in a commonly used and easily readable electronic format, and has the right to transmit such data to another data controller without interference; c) obtain from the data controller the deletion of personal data concerning him and the data controller is obliged to delete personal data without unjustified delay if one of the following reasons applies: - personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed; - the interested party revokes the consent on which the treatment is based and if there are no other legal reasons for the treatment; - the interested party opposes the processing and there are no overriding legitimate reasons for the processing; - the personal data have been processed unlawfully; - personal data must be erased to fulfill a legal obligation under European Union or Member State law to which the data controller is subject; d) obtain from the data controller the limitation of the treatment. 6.3 To exercise the above rights and receive information on the subjects to whom the data are communicated, or on the subjects who may become aware of the data while acting as managers or persons in charge of processing, users can contact Banci Firenze S.r.l. , by sending a request using the contact details provided above. The data controller will provide information relating to the action taken at the request of the interested party without unjustified delay and no later than one month from receipt of the request. This period may be extended by another two months if necessary, taking into account the complexity and number of requests. The controller informs the data subject of any extension within one month of receiving the request, indicating the reasons for the delay. If the interested party submits the request by electronic means, the information will be provided electronically, where possible, unless otherwise requested by the interested party.

7. DURATION OF THE TREATMENT
7.1 Personal data will be processed in relation to the purpose referred to in section 2.2.A for a period not exceeding that necessary.A for a period not exceeding that necessary for the execution of the requested Services, as well as for the time necessary to fulfillment of the civil, fiscal and tax obligations in force and in any case for a period not exceeding 10 years from the termination of the obligation highlighted (according to the applicable provisions on the subject of limitation). 7.2 Personal data will be processed in relation to the purposes referred to in point 2.2.B (marketing/promotional activities).B (marketing/promotional activities) for a period not exceeding 24 months starting from the date on which it was provided consent to the processing of personal data. 7.3 Personal data will be processed for the purposes referred to in point 2.2.C (profiling activities) for a period not exceeding 12 months starting from the date on which consent was given to the processing of personal data. 7.4 At the end of the processing period, the data will be permanently deleted or made anonymous.

8. LEGAL BASIS OF THE TREATMENT
8.1 The legal basis of the processing will be the user's consent, the fulfillment of a contractual requirement and the provisions of the law.

9. UPDATE OF THE PRIVACY POLICY
9.1 This Privacy Policy is subject to revisions from time to time. Banci Firenze S.r.l. will notify users of the changes made to the data processing conditions by posting the changes on the Website. If required by current legislation, users will have the opportunity to consent to any new data processing. If the user refuses, his data will not be processed according to the changes in the new privacy policy.

10. TRANSFER TO NON-EU COUNTRIES
10.1 Personal data is transferred to the United States, as some of the data controllers have their server infrastructure there. 10.2 The European Commission has made an "adequacy decision" with respect to US data protection laws. Transfers to the United States will be protected by adequate safeguards, in particular the Privacy Shield.