Information on the processing of personal data pursuant to Articles 13-14 of EU Regulation 2016/679

Data Subjects: suppliers

TECNOSS DENTAL S.r.l. as Data Controller of your personal data, pursuant to and for the effects of EU Reg. 2016/679 hereinafter 'GDPR', hereby informs you that the aforementioned regulation provides for the protection of data subjects regarding the processing of personal data and that this processing will be based on principles of correctness, lawfulness, accountability and protection of your privacy and your rights.

Your personal data will be processed in accordance with the law laid out in the aforementioned regulations and in accordance with the privacy obligations prescribed therein.

Purpose and legal basis of processing: your data will be specifically processed for the following purposes relating to compliance with legislative or contractual obligations:

• Management of existing orders and contracts (with the legal basis being the execution of a contract)
• Forwarding communications in follow up to the contractual relationship (with the legal basis being the execution of a contract)
• Obligatory legal compliance in matters of taxation and accounting (based on a legal obligation)

The processing of functional data for the performance of these obligations is necessary for the proper management of the relationship, and sending these data is mandatory so as to implement the purposes indicated above. The Data Controller also informs you that any failure to communicate, or any incorrect communication in one of the mandatory information fields, may make it impossible for the Data Controller to ensure the adequacy of the processing itself.

Method of processing: your personal data may be processed in the following ways:

• processing by means of computer
• manual processing by means of paper files

All processing is carried out in compliance with the procedures set out in Articles 6, 32 of the GDPR and by adopting the appropriate security measures as required.

Communication: your data may only be communicated to public entities and offices to which taxation details must be communicated and, where necessary in fulfilment of the services requested, to competent and duly-appointed persons for the performance of the services required to correctly handle the rapport, with a guarantee of protection of the Data Subject’s rights.

Your data will be processed only by personnel expressly authorised by the Data Controller.

Dissemination: Your personal data will not be disclosed in any way.

Retention Period: Please note that, in accordance with the principles of lawfulness, purpose limitation and data minimisation, according to Article 5 of the GDPR, the retention period of your personal data is:

• 10 years in compliance with the obligations relating to the conservation of accounting records (Art. 2220 of the Civil Code providing for the conservation of accounting records for 10 years; Art. 22 of Presidential Decree no. 600 of 29 September 1973)
• 10 years from the termination of the relationship, for judicial protection

Data Controller: the Data Controller, pursuant to the Law, is TECNOSS DENTAL S.r.l. based in Torino, Via Livorno 60

You have the right to obtain from the Data Controller the cancellation (right to be forgotten), limitation, updating, rectification, portability, opposition to the processing of personal data concerning you, and in general to exercise all the rights provided for in Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR. You can exercise your rights by sending an email to [email protected] or writing to the address indicated above.

In addition, if you believe that the processing of your data is contrary to current legislation, you may lodge a complaint with the Personal Data Protection Authority pursuant to Article 77 of Regulation 2016/679.

Rights of the Data Subject

• 1. The Data Subject is entitled to receive confirmation as to whether or not personal data concerning him/her exists, even if the data has not yet been recorded, and to have the data communicated in intelligible form.

• 2. The Data Subject has the right to be informed about::
• a. the origin of the personal data;
• b. the purposes and methods of data processing;
• c. the logic applied if the data are processed electronically;
• d. of the identity of the Data Controller, Data Processors and designated representative pursuant to Article 5, paragraph 2;
• e. the subjects or categories of subjects to whom the personal data may be communicated, or who can learn about them in their capacity as appointed representatives of the State, managers or data processors.

• 3. The Data subject has the right to obtain::
• a. the updating, rectification or, where relevant, integration of the data;
• b. the deletion, transformation into anonymous form or blocking of data which have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
• c. the confirmation that those to whom the data are communicated or disclosed are notified of the actions referred to under points a) and b), including their content, unless the fulfilment thereof proves impossible or involves using methods which are clearly disproportionate to the right being protected;
• d. the portability of the data.

• 4. The Data subject is entitled to object to the following, either in whole or in part:
• a. to the processing of their personal data for legitimate reasons, even if pertinent to the purpose of collection