Information on the processing of personal data pursuant to Articles 13-14 of EU Regulation 2016/679

Data Subjects: distributors

Purpose and legal basis of processing: your data will be specifically processed for the following purposes relating to compliance with legislative or contractual obligations:

• Guarantee to fulfil the obligations as distributor, to verify compliance with regulatory obligations and traceability of OsteoBiol® medical devices (with the legal basis being the execution of a contract)
• Contractual obligations for the purposes of entering into an exclusive contract for the sale of OsteoBiol® products (with the legal basis being the execution of a contract)
• Forwarding communications in follow up to the contractual relationship (with the legal basis being the execution of a contract)
• Scientific soft marketing activities regarding commercial communications on products, courses or international conferences sent through newsletters (with the legal basis being the legitimate interest of the Data Controller)
• Organisation and management of training courses for issuing a certificate of participation (with the legal basis being the execution of a contract)
• Obligations required by law in taxation and accounting matters, regarding the invoice accompanying the order and participation in training courses (based on a legal obligation)

The processing of functional data for the performance of these obligations is necessary for the proper management of the relationship, and sending these data is mandatory so as to implement the purposes indicated above. The Data Controller also informs you that any failure to communicate, or any incorrect communication in one of the mandatory information fields, may make it impossible for the Data Controller to ensure the adequacy of the processing itself.

Legitimate Interest of the Data Controller: scientific soft marketing activities (“soft spam”) are performed without obtaining prior consent. The processing of your data for such purposes is the legitimate interest referred to in Article 6.1(f) of the Regulation. In each case, pursuant to Article 21 of the GDPR, you have the option to object to such processing at any time, be it from the outset or upon subsequent communications, in an easy and cost-free manner by writing to the Data Controller at the address indicated above, receiving an immediate reply confirming the interruption of such processing (Article 15 of the GDPR).

Method of processing: your personal data may be processed in the following ways:

• processing by means of computer
• manual processing by means of paper files

All processing is carried out in compliance with the procedures set out in Articles 6, 32 of the GDPR and by adopting the appropriate security measures as required.

Communication: your data may only be communicated to public entities and offices to which taxation details must be communicated and, where necessary in fulfilment of the services requested, to competent and duly-appointed persons for the performance of the services required to correctly handle the rapport, with a guarantee of protection of the Data Subject’s rights. Your data will be processed only by personnel expressly authorised by the Data Controller.

Dissemination: Your personal data will not be disclosed in any way.

Retention Period: Please note that, in compliance with the principles of lawfulness, limitation of purposes and data minimisation, pursuant to Article 5 of the GDPR, the retention period of your Personal Data is:

• 15 years for invoices regarding purchases and sales of medical devices, as required by EEC Directive 93/42
• 15 years following the conclusion of the relationship for contact details used to exchange communications, together with purchase and sale invoices, in order to maintain a communication channel for any legal and/or administrative and regulatory requests
• 10 years from the termination of the relationship, for judicial protection purposes

Data Controller: the Data Controller, pursuant to the Law, is TECNOSS DENTAL S.r.l. based in Torino, Via Livorno 60

You have the right to obtain from the Data Controller the cancellation (right to be forgotten), limitation, updating, rectification, portability, opposition to the processing of personal data concerning you, and in general to exercise all the rights provided for in Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR. You can exercise your rights by sending an email to [email protected] or write to the address indicated above.

In addition, if you believe that the processing of your data is contrary to current legislation, you may lodge a complaint with the Personal Data Protection Authority pursuant to Article 77 of Regulation 2016/679.

Rights of the Data Subject

• 1. 1. The Data Subject is entitled to receive confirmation as to whether or not personal data concerning him/her exists, even if the data has not yet been recorded, and to have the data communicated in intelligible form.

• 2. The Data Subject has the right to be informed about:
• a. the origin of the personal data;
• b. the purposes and methods of data processing;
• c. the logic applied if the data are processed electronically;
• d. of the identity of the Data Controller, Data Processors and designated representative pursuant to Article 5, paragraph 2;
• e. the subjects or categories of subjects to whom the personal data may be communicated, or who can learn about them in their capacity as appointed representatives of the State, managers or data processors.

• 3. The Data subject has the right to obtain:
• a.a. the updating, rectification or, where relevant, integration of the data;
• a.b. the deletion, transformation into anonymous form or blocking of data which have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
• a.c. the confirmation that those to whom the data are communicated or disclosed are notified of the actions referred to under points a) and b), including their content, unless the fulfilment thereof proves impossible or involves using methods which are clearly disproportionate to the right being protected;
• a.d. the portability of the data.

• 4. The Data subject is entitled to object to the following, either in whole or in part:
• a.a. to the processing of their personal data for legitimate reasons, even if pertinent to the purpose of collection;
• a.b. to the processing of personal details for the purpose of sending advertising materials, for direct sales or for carrying out market research or commercial communications.