PRIVACY INFORMATION FOR CUSTOMERS AND SUPPLIERS

Dear customer/supplier, Manifatture Tessili Prete S.r.l. (hereinafter "owner") provides you, pursuant to art. 13 EU Regulation No. 2016/679 (hereinafter GDPR) the following information: 1. SUBJECT OF THE TREATMENT. The holder processes personal, identifying and non-specific data (e.g. name, surname, tax code, VAT, email, telephone number, mobile phone etc.) - hereinafter "data" - communicated by you on the occasion of the conclusion of contracts for services/services with the holder or at the time of the request for information.

2. PURPOSE OF THE TREATMENT. Your data are processed without your express consent (art. 6 lett. b, and GDPR) for the following service purposes: respond to your requests for information; conclude contracts for the services of the owner; fulfill the pre-contractual, contractual and fiscal obligations arising from relationships with you in being; fulfill the obligations provided by law, regulation, Community legislation or an order of the Authority (e.g. with regard to money laundering); exercise the rights of the holder (e.g. right of defence in court for breach of contract); prevent or discover fraudulent activities or abuses harmful to the website; send by email or other for promotional purposes. If the owner intends to process your data for a purpose other than those described in this paragraph, you will be informed before such further processing. Manifatture Tessili Prete s.r.l. collects anonymous information on the use of the platform for ecommerce in order to recognize users who return to visit the site and to improve its usability on the basis of anonymous behavioural profiles. For this, the platform for e-commerce Manifatture Tessili Prete s.r.l. makes use of “cookies”, small text files saved in the computer of the visitor. They are designed to recognise visitors and increase their convenience, for example by storing the password. In this context, Manifatture Tessili Prete s.r.l. e-commerce platform uses Google Analytics, a web data analysis service provided by Google, Inc. (“Google”), Inc. About Google Analytics. A list of cookies used by the e-commerce platform is available in our privacy policy on this site. During registration and authentication, the email address entered in the corresponding field is transformed into a non-readable hash key based on a homogeneous encryption logic. The hash key is used to recognize visitors who return to visit the site and to improve usability based on anonymous behavioural profiles. It is created by the SHA-1 hashing algorithm that generates 160-bit hash keys (20 bytes) in line with the Secure hash Standard (SHS) standard. The encryption logic is one-way, so the keys can’t be decrypted. This logic avoids the collection and storage of e-mail addresses in a readable form.

3. LEGITIMATE INTERESTS OF THE HOLDER. The legitimate interests of the holder are to respect and honour the contractual obligations entered into by the parties. Pursuant to art. 6 GDPR the lawfulness of the processing is based on the manifestly expressed consent of the data subject.

4. ACCESS TO DATA, COMMUNICATION AND TRANSFER. Your data may be made accessible for the purposes of point 2: to employees and collaborators of the holder in their capacity as authorized and/or internal controllers and/or system administrators; to third parties (our network of agents, credit institutions, professionals and external consultants) outsourcing activities on behalf of the holder, as independent external owners or processors appointed by the holder. Without your express consent (art. 6 lett. b) and c) GDPR) the holder may communicate your data for the purposes of point 2. to Supervisory Bodies, Judicial authorities as well as to all other persons to whom communication is mandatory by law for the accomplishment of such purposes. These data subjects will process the data in their capacity as independent data controllers. Your data will not be disseminated. Data management and storage will take place on the company’s server. If your personal data, for contractual purposes, are transferred to non-EU countries, the holder guarantees that such data will be processed with an adequate level of protection. In particular, if your data is transferred to Switzerland, the appropriate level of protection is guaranteed by the European Commission Decision of 26 July 2000 (2000/518 EC) and subsequent amendments; if your data is transferred to the U.S.A. the appropriate level of protection is guaranteed by the European Commission’s Implementing Decision (EU) 2016/1250 of 12 July 2016

5. OPTIONAL / MANDATORY CONTRIBUTION. The provision of data for the purposes referred to in point 2 is mandatory as it is required by legal and contractual obligations. Any refusal to supply them or any subsequent lack of authorization to process them may determine the inability of the holder to carry out the contractual relationships themselves (the person concerned does not receive the performance, breach of contract and liability, not discharging legal obligations with related legal sanctions, etc.).

6. TIME OF CONSERVATION OF DATA. Without prejudice to the five-year or ten-year retention periods for documents and related data of a civil, accounting and tax nature as provided for in the laws in force, any other data will be kept for 10 years (or for a longer period but only for statistical purposes) from termination of the service/supply/ product relationship unless you withdraw your consent or request for cancellation.

7. RIGHTS OF THE PERSON CONCERNED. Except in cases of legal obligations, public interest or exercise of official authority, you have the right, at any time, to revoke your consent to the processing of data and, in this case, the lawfulness of the processing based on consent expressed before the revocation shall not be affected. The Article 15 of the GDPR confers upon you, as a data subject, the exercise of specific rights, including that of obtaining from the data controller confirmation of the existence or otherwise of your personal data and their making available in intelligible form; the right to have knowledge of the origin of the data, the purpose and modalities of the processing, the logic applied to the processing, the identification details of the holder and the subjects to whom the data can be communicated; the right to obtain the updating, rectification and integration of data, the deletion, the transformation into anonymous form or the blocking of data processed in violation of the law; the right to object, for legitimate reasons, the processing of your data. The GDPR provides the right to the oblivion of your data (art. 17), their limitation (art. 18), their portability (art. 20) and, in case of automated decision-making (cd. profiling), their human treatment (art. 22). The exercise of rights shall not be subject to any formal constraint and shall be free of charge.

8. TIME TO RESPOND TO REQUESTS. In the event of a request by you for information relating to your data, the holder will reply as soon as possible - unless this proves impossible or involves a disproportionate effort - and, in any case, not later than 30 days from the request. Any impossibility or delay on the part of the holder in satisfying the requests will be motivated.

9. COMPLAINTS AND APPEALS. If you feel harmed in any of the rights listed in point 7, you can complain to the Data Protection Supervisor (following the procedures and indications published on the Authority’s website on www.garantecy.it) or an administrative or judicial remedy. 10. HOLDER OF THE TREATMENT. The data controller is Manifatture Tessili Prete S.r.l., registered office in Oberdan Road n. 54 – 84018 Scafati (SA) to which it is possible to turn for any request, request or information, including the exercise of the rights referred to in point 7.