INFORMATION ON THE PROCESSING OF PERSONAL DATA – CONTACT FORM

WHO IS THE DATA CONTROLLER?

Gi Group Holding B.V.

based in Amsterdam, Hogehilweg 4, 1101CC, The Netherlands

telephone n.: 085-800-0810, e-mail: nl.privacy@gigroup.com (‘Gi Group’)

HOW CAN YOU CONTACT THE DATA PROTECTION OFFICER (‘DPO’)?

Piazza IV Novembre 5, 20124 Milan, to the attention of the ‘Data Protection Officer’

e-mail: dpo@gigroup.com

WHY ARE YOUR PERSONAL DATA PROCESSED AND WHAT IS THE CONDITION THAT MAKES THE PROCESSING LAWFUL?

1. Response to request for information

The processing of personal data is carried out to process requests for information on the services offered by Group companies. Gi Group may provide the contact details or forward them directly to the related Group company for the purpose of a suitable and timely reply by the same.

Pursuant to art. 6(1)(B) of the GDPR, the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

1. Response to request for information

The data will be stored for the time necessary to process requests for information.

Once the retention terms indicated above have elapsed, the personal data will be erased or rendered anonymous, compatibly with the technical cancellation and backup procedures.

ARE YOU OBLIGED TO PROVIDE THE PERSONAL DATA?

The provision of personal data highlighted with an asterisk in the form is mandatory: the refusal to provide such personal data does not allow Gi Group to process requests for information.

WHO ARE THE RECIPIENTS OF THE PERSONAL DATA?

Personal data will be processed exclusively by employees of the company functions authorized to process data for the aforementioned purposes, who have been expressly authorized to the processing and who have received adequate operating instructions.

Personal data may be disclosed to the following categories of subjects that act as controllers:

• Group companies in The Netherlands or abroad, even outside the European Economic Area, if the request for information concerns services offered by other Group companies.

Personal data may also be processed, on behalf of the Company, by persons designated as Data Processors. These subjects are included in the following categories:

• Site management and maintenance services;
• Client database management and maintenance services;
• Archiving services;
• Communications mailing services;

The list of data recipients can be obtained by sending a written communication to the Data Controller or an e-mail to nl.privacy@gigroup.com

DO WE TRANSFER DATA OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)?

Your data may be transferred to recipients referred to in section 7 outside the “EEA”, in particular to countries whose data protection levels are considered satisfactory under the provisions of 45 of the GDPR; alternatively, on condition that Gi Group and the data importer sign standard contractual clauses adopted or approved by the European Commission in accordance with Article 46(2)(c) and (d) of the GDPR. Transfers to non-EEA countries are permitted, in the absence of the appropriate guarantees mentioned above, on the basis of the exceptions provided under Article 49, paragraph 1, points b) and c). Data subjects will be specifically notified of such transfers. Adequacy decisions can be consulted at the following link: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

WHAT ARE THE DATA SUBJECTS RIGHTS?

Data subjects can ask the Data Controller for access to their personal data, their correction or cancellation, the integration of incomplete data, the limitation of processing in the cases provided for by art. 18 GDPR, as well as the opposition to processing in case of data processed for direct marketing purposes or legitimate interests.

Furthermore, for cases in which the processing is based on consent or the contract and is carried out with automated tools, data subjects have the right to exercise the right to data portability by receiving their personal data in a structured, commonly used and device-readable format, as well as, if technically feasible, to transmit them to another controller without impediments.

These rights can be exercised by sending an e-mail to nl.privacy@gigroup.com.

Data subjects have the right to lodge a complaint with the competent Supervisory Authority (in particular in the Member State in which they usually reside or work or in the State in which the alleged violation has occurred).

HOW CAN YOU WITHDRAW YOUR CONSENT?

At any time, you can withdraw your consent to the processing of personal data carried out for direct marketing purposes by writing to the e-mail address: nl.privacy@gigroup.com and / or by clicking on the appropriate links contained in the communications that will be sent to you.

The withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal.