Montenegro S.r.l., with its registered office in Via Enrico Fermi 4, Zola Predosa (BO), Italy (“Montenegro”), manages the site www.vecchiaromagna.it (the “Site”) as data owner and wishes to inform the users of the Site (the “Users”) about the personal data processing methods provided to the same, pursuant to Italian Legislative Decree No. 196/2003 (the “Privacy Code”) and European Regulation No. 679/2016 relating to the processing of personal data (the “Privacy Regulation”).

The data owner is Montenegro S.r.l., a Gruppo Montenegro company, with its registered office in Via Enrico Fermi 4, Zola Predosa (BO), Italy. The same can be contacted via the following email address: privacy.montenegrocorporate@montenegro.it. Montenegro has appointed Armando Testa S.p.A., among others, as the personal data processor.

 The complete list of data processors can be provided upon written request by sending an email to the email address indicated above.

Montenegro processes the data provided by Users, including:

•the fact that the User is over the age of 18;

• personal and contact information for receiving information, submitting a report or obtaining a discount code via the Site’s “Contact us” section;

•personal and contact information, including those contained in the CV provided when submitting an application via the “Careers” section;

• data provided and collected for the purposes and in the context of any participation in competitions and/or rewards programmes carried out online by Montenegro, on the understanding that in this case, the current policy will be considered supplemented by the policy that governs the processing of personal data of the relative competitions and/or reward programmes;

•navigation data relating to the use of services offered through the Site collected via cookies in accordance with the cookie policy available at the following link: http://www.vecchiaromagna.it/ (cookie policy section).

Data concerning health and generally special categories of personal data are not processed pursuant to Article 9 of the Privacy Regulation.

We therefore recommend that you do not disclose these types of personal data.

The data indicated above are only processed insofar as they are necessary to achieve the purposes described in paragraph 4 of this policy.

The User’s personal data are processed using computerised and/or paper-based means and are protected by adequate safety measures to guarantee the confidentiality and security of the personal data. In particular, Montenegro shall take appropriate organisational and technical measures to protect the personal data in its possession against loss and theft, in addition to the unauthorised use, disclosure or modification of personal data.

The purposes for which the User is requested to provide Montenegro with their personal data are as follows:

•To allow the User to log on and register on the Site and use the services made available through the Site, including the customer support and/or reporting services made available through the Site, the option to participate in competitions and promotions and request discount codes, submit applications via the same and uphold and defend the rights of the User and third parties (hereinafter referred to as “Contractual Purposes”);

•To comply with any legal and regulatory obligations (hereinafter referred to as “Legal Purposes”);

•Subject to the User’s consent, send newsletters and marketing communications via traditional and remote media, in order to promote and/or sell the products and/or services marketed by Montenegro (“Montenegro Marketing Purposes”);

•Subject to the User’s consent, send marketing communications from other Montenegro Group companies regarding their products and services, in the manner referred to in point c) above (“Third-Party Marketing Purposes”);

• Perform functional activities relating to the sale of companies and business branches, acquisitions, mergers, spin-offs or other transformations and to carry out such operations (“Purposes of Legitimate Business Interest”).

The processing of personal data for Contractual Purposes is mandatory as it is necessary for the purposes of logging on to the Site and using the specific services offered through the Site. The provision of personal data for Legal Purposes is mandatory as required under applicable law. In the event that the User does not want their personal data to be processed for these purposes, the same will be unable to use the Site and the services made available through it.

The processing of personal data for Montenegro Marketing and Third-Party Marketing Purposes is optional and subject to the User’s prior consent. Should no consent be provided, Montenegro and Gruppo Montenegro companies will be unable to keep the User updated on new products or services, promotions and offers, and cannot send communications or any other informative material.

The processing of data for the Purposes of Legitimate Business Interest is carried out pursuant to Article 24, Paragraph 1, Letter d) of the Privacy Code and in pursuit of the legitimate interest of Montenegro and its counterparties in performing the economic transactions indicated therein, pursuant to Article 6, Letter f) of the Privacy Code, properly balanced with the Users’ interests in so far as the processing takes place to the extent strictly necessary for these transactions to be executed.

For the purposes referred to in paragraph 4, Montenegro may disclose the Users’ data that are strictly necessary for each type of processing to the following categories of subjects:

•Montenegro collaborators, employees and suppliers as part of their duties and/or possible contractual agreements with the same, regarding the business relations with the Users

•Subcontractors and/or subsuppliers engaged in activities related to executing the services and products offered by Montenegro

•Other national and international companies of the Montenegro group in Italy and abroad, located in the countries specified in more detail in paragraph 7 below.

The User’s personal data are not disclosed.

Personal data may be freely transferred outside the national territory to EU countries, but can also be transferred outside the European Union, namely to the USA. In any case, any transfer of the User’s personal data to countries located outside the European Union will take place in compliance with the appropriate guarantees and will be appropriate for the purposes of the transfer itself, in accordance with applicable legislation, namely Article 44 of the Privacy Code and Articles 45 and 46 of the Privacy Regulation.

The User can obtain a copy of the guarantees implemented by Montenegro by sending a specific request to the following email address: privacy.montenegrocorporate@montenegro.it.

The Site is not intended for individuals under 18 years of age. Montenegro asks Users to declare their age before accessing the Site and does not voluntarily collect or process the personal data of any persons under 18 years of age that might use the Site.

The User may, at any time and free of charge (a) obtain confirmation of the existence or non-existence of data concerning them and have such data communicated to them; (b) be made aware of the origins of the data, the processing purposes and methods, in addition to the logic applied to the data processing operation carried out through the use of electronic tools; (c) request for the data to be updated, rectified or, if interested, integrated; (d) obtain the cancellation, anonymisation or blockage of any unlawfully processed data, in addition to objecting, for legitimate reasons, to the data processing; (e) to fully or partially object to the processing of their personal data for direct marketing purposes carried out via automated and/or traditional methods; (f) to withdraw consent for the processing of data at any time, without in any way prejudicing the lawfulness of the processing activities carried out before the consent was revoked.

In addition to the rights listed above, pursuant to the Privacy Regulation, the User may at any time and in the manner indicated below (a) request for the processing of personal data to be restricted in the event that (i) the User contests the accuracy of the personal data, for the period necessary to verify the accuracy of such personal data; (ii) the processing is unlawful and the User is opposed to the deletion of the personal data and instead requests that their use be restricted; (iii) although Montenegro no longer needs said data for processing purposes, the personal data are necessary for the User to establish, exercise or defend a right in court; (iv) the User has opposed the treatment pursuant to Art. 21, paragraph 1 of the European Privacy Regulation, pending verification of the possible prevalence of the data owner’s legitimate reasons for data processing with respect to those of the data subject; (b) object at any time to the processing of personal data; (c) request for personal data regarding them to be deleted without undue delay; (d) obtain the portability of personal data which regard them; (e) lodge a complaint with the Data Protection Supervisory Authority if the legal conditions are met.

The User can, at any time, exercise the above-mentioned rights, change their contact preferences, notify Montenegro of any updates to their data, request for any personal data disclosed to third parties to be deleted, or obtain further information about how Montenegro uses their personal data by contacting Montenegro via the following email address: email privacy.montenegrocorporate@montenegro.it.

Montenegro will retain personal data for the period necessary to fulfil the purposes for which they were collected, pursuant to paragraph 2 above. In any case, the following retention periods apply to the processing of personal data for the purposes indicated below:

➢ The data collected for Contractual Purposes, referred to in paragraph 4, letter a), are kept for the entire duration of the contract and for 10 years after the expiration of the same for defence purposes and/or to establish a Montenegro right in and/or out of court in the event of disputes related to the contract’s execution;

➢ The data collected for Lawful Purposes, referred to in paragraph 4, letter b), are kept for a period equal to the duration prescribed for each type of data by law;

➢ The data collected for Montenegro Marketing and Third-Party Marketing Purposes, referred to in paragraph 4, letters c) and d), are kept for a period of 24 months from the date of collection;

➢ The data collected for Purposes of Legitimate Business Interest, referred to in paragraph 4, letter e), are kept for a period of 10 months from the date of collection.

Once the above periods have elapsed, the User’s data may be deleted, anonymised and/or aggregated.

This policy is valid from the date indicated at the top of the page.

Montenegro may also make changes and/or additions to this policy as a consequence of any subsequent changes and/or reguloatory additions to the Privacy Regulation. You will be notified of any changes in advance and you can always view the newest version of the policy at the link www.vecchiaromagna.it

Should the User have any doubts, observations or complaints about the methods used to collect or use their personal data, the same is invited to contact Montenegro via the Site’s “Contact us” section.