1. Controller's Identity and Contact Information

The Data Controller is ADC HOLDING S.R.L. with registered office at Via Viganò, 8 - 20128 Milan (MI), VAT number 12675470962. The updated list of data processors and those responsible for processing is kept at the Data Controller's registered office. For data processed on behalf of another data controller or another data processing manager (e.g., when processing personal data of Third Parties in managing the activities of orders assigned by a contract between the parties), ADC HOLDING S.r.l. is the Data Processing Manager upon delegation of the Data Controller or Sub-Processor. ADC HOLDING S.r.l., with registered office at Via Viganò, 8 - 20128 Milan (MI), VAT number 12675470962, in its capacity as controller or Processor and/or Sub-Processor (when appointed by an external Controller and/or Processor), informs you pursuant to art. 13 EU Regulation no. 2016/679 (hereinafter, "GDPR") that the personal data we come into possession of will be processed using the following methods and for the following purposes:

2. Purpose of Processing

ADC HOLDING processes personal data, identifying (e.g., name, surname, company name, address, telephone, email, banking and payment references) - hereinafter, "personal data” or “dati" communicated by you on the occasion of the conclusion of contracts for services provided by ADC HOLDING (which in this case operates as Data Controller) or communicated and transmitted to ADC HOLDING (Data Processor or Sub-Processor appointed by the Controller or another Processor) in order to carry out all the activities related to the service provided, under a contract signed with the Client (Data Controller or Data Processor).

3. Purpose of Processing and Legitimate Interests

The personal data to which ADC HOLDING has access is processed:

1. without the express consent of the data subject (Art. 6 letters b), and e) GDPR), for the following Service Purposes:

- data is processed by ADC HOLDING as the data controller because the processing is necessary for the performance of a contract of which the data subject is a party or for the performance of pre-contractual measures defined at the request of the data subject (personal data relating to contracts or pre-contractual activities with customers, suppliers; data of employees in the hiring or pre-hiring phase) - to fulfill contractual obligations with its customers who transfer, as Data Controllers or Processors, the personal data of their employees, customers, or users to ADC HOLDING S.r.l., which processes them in accordance with and for the purposes defined by the contract with the Client in force and within the limits of what is defined by the GDPR - to fulfill obligations provided for by law, regulations, community legislation, or an order of the Authority (such as anti-money laundering regulations); - to exercise the rights of the Controller, such as the right to defense in court;

1. Only with your specific and separate consent (Art. 7 GDPR) provided to the Data Controller, for Marketing Purposes as specified in the related Information on data processing for marketing purposes:

4. Recipients of Personal Data and Data Communication

Your data may be made accessible for the purposes set out in art. 2.A) and 2.B) to employees and collaborators of ADC HOLDING S.r.l., also external, in their capacity as data processors and/or data controllers and/or system administrators;

• Other external data processing managers for the provision of the requested service
• Internal representative who processes the data for the provision of the service (insertion into databases, development and maintenance of software, etc.)

Personal data is stored on servers located within the European Union. However, it is understood that the Data Controller, if necessary, may have the authority to move servers outside the EU. In this case, the Data Controller hereby assures that the transfer of data outside the EU will take place in accordance with applicable law, following the conclusion of the standard contractual clauses provided by the European Commission.

5. Processing Methods, Security Measures, and Retention Period

The processing of the data subject's personal data is carried out through the operations indicated in art. 4 no. 2) GDPR, namely: collection, recording, organization, storage, consultation, processing, use, interconnection, blocking, communication, deletion, and destruction of data. Personal data is processed both on paper and electronically and in part automated. The personal data of the data subject are processed applying the following minimum-security measures to the assets assigned to the data processing officers:

• centralized antivirus,
• identifiable user referring to the person (whether administrator of assets or not),
• mandatory password change at first access,
• serial identification of PC, work environment, software, hardware,
• formalization of the obligation of the officer not to export acquired customer data,
• the asset assigned to the officer managing the personal data of the data subject is returned at the end of the task, and the IT Manager physically destroys the hard disk.

ADC HOLDING will process personal data for the time necessary to fulfill the above purposes and in any case for no more than 2 years from the termination of the relationship for Service Purposes.

6. Rights of the Data Subject

As the data subject, you have the rights set out in Art. 15 GDPR, namely the rights to:

1. obtain confirmation of the existence or not of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;
2. obtain: a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in case of processing carried out with the aid of electronic instruments; d) the identifying details of the Controller, processors, and designated representatives pursuant to Art. 3, paragraph 1, GDPR; e) the subjects or categories of subjects to whom personal data may be communicated or who may become aware of it as designated representatives in the territory of the State, data processors, or persons in charge;
3. obtain: a) updating, rectification, or, when interested, integration of data; b) the deletion, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data was collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, including with regard to their content, of those to whom the data has been communicated or disseminated, except in the case where such fulfillment proves impossible or involves the use of means manifestly disproportionate to the protected right;
4. object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, using automated calling systems without the intervention of an operator, by email and/or through traditional marketing methods by telephone and/or paper mail. It should be noted that the data subject's right to object, as stated in the preceding point b), to direct marketing purposes through automated means extends to traditional methods and that, in any case, the data subject retains the possibility of exercising the right to object only in part. Therefore, the data subject may decide to receive only communications through traditional methods or only automated communications or none of the two types of communication.
5. Right to rectification of your personal data in case of modifications and non-compliance with those previously acquired or communicated (Art. 16)
6. Right to erasure of data ("right to be forgotten" Art. 17). ADC HOLDING, if one of the following cases exists, proceeds to delete the data from all databases and archives where it is contained:

1. a) personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
2. b) the data subject withdraws consent, and if there is no other legal basis for processing;
3. c) the data subject opposes the processing pursuant to Article 21, paragraph 1, and there is no legitimate overriding reason for processing, or the data subject opposes the processing pursuant to Article 21, paragraph 2;
4. d) personal data has been unlawfully processed;
5. e) personal data must be erased to comply with a legal obligation under Union or Member State law to which the Controller is subject;
6. f) personal data has been collected in relation to the offer of information society services referred to in Article 8, paragraph 1.

1. Right to restriction of processing (Art. 18). The data subject has the right to obtain from the Controller the restriction of processing where one of the following applies:

1. a) the accuracy of personal data is contested by the data subject, for the period necessary for the Controller to verify the accuracy of such personal data;
2. b) the processing is unlawful, and the data subject opposes the erasure of personal data and requests instead the restriction of their use;
3. c) although the Controller no longer needs the personal data for the purposes of processing, the personal data are required by the data subject for the establishment, exercise, or defense of legal claims;
4. d) the data subject has objected to processing pursuant to Article 21, paragraph 1, pending the verification of whether the legitimate grounds of the Controller override those of the data subject.
5. Right to object (Art. 21-22): The data subject has the right to object at any time, for reasons related to his or her particular situation, to the processing of personal data concerning him or her under Article 6, paragraph 1, letters e) or f), including profiling based on those provisions. ADC HOLDING does not subject the data to decisions based solely on automated processing.

ADC HOLDING notifies each data subject of any rectifications, limitations, or deletions of data. ADC HOLDING refrains from further processing personal data unless there are compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. For data processed by ADC HOLDING for marketing purposes, the data subject's rights are outlined in the specific Information on data processing for marketing purposes.

7. Exercise of Rights

You may exercise your rights at any time by sending: - an email addressed to privacy@axcent.it.

7. Nature of Data Provision and Consequences of Refusal to Respond

The provision of data for the purposes set out in Art. 2.A) is mandatory. Without them, we cannot guarantee you the Services of Art. 2.A). The provision of data for the purposes set out in Art. 2.B) is instead optional and managed according to what is defined in the Information on data processing for marketing purposes.