INFORMATION PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

This information is provided pursuant to Article 13 of the EU Regulation 2016/679 (hereinafter also just "Regulation" or "GDPR"):

1. Data Controller
The Data Controller is Società Italiana Prodotti Alimentari S.p.A. S.I.P.A. (hereinafter also referred to as "S.I.P.A." or the "Company"), Via della Liberazione No. 1, San Giuliano Milanese 20098 (MI), P. IVA 06488870152.
The Company has appointed a Data Protection Officer (DPO) who can always be contacted by writing to the following e-mail address dpo@bindidessert.it

2. Personal data processed
S.I.P.A. S.p.A., by means of the form we ask you to fill out, collects and processes personal data related to the Data Subject and, specifically, first name, last name, telephone number, e-mail address (hereinafter jointly referred to as "Personal Data" or just "Data").

3. Purposes and methods of data processing
Personal Data are collected and processed for the following purposes:

1. to be contacted by the Owner and/or to receive a response to the message sent to S.I.P.A. ("Contact Us" section)
2. to invite you to visit us at S.I.P.A's booth at the "Sigep - The World Expo for Foodservice Excellence" exhibition event to be held at the Rimini Expo Centre from January 18 to 22, 2025, and share with you a complimentary admission;
3. For direct marketing purposes by the Owner and in particular:
   1. to send informational and promotional material about goods and services and future promotional-advertising activities of the Owner itself, all by mail, text messages and other instant messaging systems;
   2. to send commercial communications and information, promotional and advertising materials (e.g., brochures, catalogs, samples, newsletters, e-mails, etc.), materials related to marketing campaigns and events, conduct market surveys by means of questionnaires, including by means of e-mail messages, text messages, and other instant messaging systems containing information related to products, events, or promotions;
   3. in an anonymous and/or pseudonymized form, to carry out market research and statistical analysis of responsiveness to prize-givings events, as initiatives by manufacturers and retailers to stimulate purchases, increase sales, promote corporate image, promoted by the Holder and on consumer patterns and/or propensities with possible creation of profiles referring to anonymous groups of data subjects delineated by common characteristics (age groups, geographical area, etc.);
   4. To contact you and keep you updated about new initiatives of S.I.P.A. S.p.A. by sending communications, special offers and promotional material by email, text messages and other instant messaging systems.

The processing of Personal Data will be carried out by the Data Controller, External Data Processors and Authorized Persons ("External Data Processors" and "Authorized Persons"), with the observance of all appropriate measures to ensure the security and confidentiality thereof, by means of paper, media, and with the aid of computer tools, in accordance with the principles of law, protecting the confidentiality of the data subject and his rights by adopting appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

4. Legal basis for processing
The legal basis for processing for the purposes set out in point 3 is Your freely given consent in accordance with Art. 6(1)(A) of the Regulations.

5. Recipients/Categories of recipients of personal data.
Your Personal Data may be disclosed, solely for the above purposes, to the following categories of parties:

• persons, companies, associations or professional firms that provide services and activities of assistance and advice to our Company, with particular but not exclusive reference to issues in legal matters, internet service providers, cloud or IT service providers, who need access to the Data to the extent strictly necessary for the performance of their tasks;
• Subjects to whom the right to access your Personal Data is recognized by legal provisions and secondary regulations;
• other parties, such as in the case of our employees, who need access to the Data to the extent strictly necessary for the performance of their activities.

These subjects act as Authorized Persons, autonomous Data Controllers or Data Processors pursuant to Article 28 of the Regulations, subjects that offer suitable guarantees of compliance with the rules on the processing of personal data the Company anche that tha Company uses to carry out its activities.
Your Personal Data will not be transferred to countries outside the EU.
Your Personal Data will not be disseminated in any case.

6. Data collection and consequences of failure to provide data
Conferring your Personal Data is optional but necessary for the achievement of the purposes set out in point 3. Failure to confer them will have no other consequence than the impossibility to contact you back and/or to receive a reply to the message sent to the Data Controller, to invite you to visit us at our booth at the exhibition event "Sigep - The World Expo for Foodservice Excellence", giving you an entrance and/or to send you future and further marketing communications.

7. Withdrawal of consent
It is Your right to revoke at any time the consent previously given for the purposes referred to in point 3, without, however, affecting the lawfulness of the processing carried out on the basis of the consent given before revocation. In order to revoke your consent to the processing, it will be sufficient to send your request for revocation of consent to the Controller by e-mail to privacy@bindidessert.it.

8. Period of data retention
The Data in question will be kept for the period strictly necessary for the achievement of the purposes indicated in point 3 and, in any case: (i) until the completion of the activity related to your contact request for the purpose indicated in point 3, lett. A), without prejudice to the previous revocation of your consent in which case the Company will proceed without delay to the deletion of your Personal Data; (ii) until the completion of the activities related to the processing of the invitation to the exhibition event for the purpose indicated in point 3, lett. B), without prejudice to the previous revocation of consent in which case the Company will proceed without delay to the deletion of Your Personal Data; (iii) for the period of 60 months for the purpose set forth in item 3, letter C), without prejudice to the previous of consent for which case the Company will proceed without delay to the deletion of Your Personal Data.

9. Rights of the data subject
At any time you may exercise your rights towards the Data Controller in accordance with Articles 15 et seq. of the Regulations, and specifically:

• Right of access and rectification (Articles 15 and 16 of the Regulations): You have the right to obtain confirmation as to whether or not your Personal Data is being processed and, if so, to obtain access to it. You also have the right to request rectification of inaccurate data and supplementation of incomplete data. If you wish, we will provide you with a copy of your Data in our possession.
• Right to Data Deletion (Art. 17 of the Regulations): in the cases provided for by the current legislation (e.g., personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, revocation of consent, unlawful processing, etc.), you may request the deletion of your Personal Data to which the Company will provide for without delay.
• Right to limitation of processing (art. 18 of the Regulations): in the cases provided for by the current legislation (inaccuracy of personal data, unlawful processing of data, etc.) You have the right to obtain the limitation of the processing of your Personal Data.
• Right to data portability (Art. 20 of the Regulations): You have the right to receive your Data in a structured, commonly used and machine-readable format in order to transmit it to another data controller, or, if requested, we will directly transmit your Data to another Data Controller.
• Right to object (Art. 21 of the Regulations): You have the right to object at any time, on grounds relating to your particular situation, to the processing of Your Personal Data.

To exercise these rights, it will be sufficient to contact the Controller by sending an email to privacy@bindidessert.it, possibly using the forms made available on the website of the Italian Data Protection Authority (www.garanteprivacy.it).
From the receipt of your request, the Company has one month to put in place all necessary actions. Within this time, despite the exercise of your rights, you may receive additional automated communications whose sending was planned prior to your request.
The one-month deadline may be extended by two months in the case of complex requests or numerous requests.

10. Complaint to the Italian Data Protection Authority
If you believe that a violation of your right to the protection of personal data has occurred, it is your right to lodge a complaint with the Italian Data Protection Authority in the manner and in accordance with the terms given on its the website (http://www.garanteprivacy.it).