Information according articles 13 e 14 of UE 2016/679 of april 27, 2016 Regulation, concerning data protection (General Data Protection Regulation – GDPR) and Decreto Legislativo june 30, 2003, n. 196 and following modifications and integrations (in particular, Decreto Legislativo august 10, 2018, n. 101).

Dear Madam/Sir,

The present information is for individuals or individuals operating on behalf of legal entities. With reference to the request form to be sent to us, we would like to inform you that the UE 2016/679 of april 27, 2016 Regulation (General Data Protection Regulation – GDPR), concerning physical individuals data protections, protects people with respect to the processing of their personal data. This regulation defines the processing of data as “any operation, or set of operations, carried out with or without the help of electronic or automated means, involving personal data or personal data sets, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, whether they are contained or not in a data bank”. As a concerned party, or rather a subject to which the data refers (qualified by the Regulation as personal data), supplied through the present form, we would like to inform you that this data will be subject to processing based on the principles of accuracy, legality and transparency to protect your confidentiality and rights in accordance with the aforementioned regulation.

Pursuant to articles 13 and 14 of said Regulation, we would like to provide you with the information regarding the processing that will be performed on your personal data, also in case this first contact would lead to a contract stipulation.

Collected personal data.

• Identification data (name, surname, company or business name, main office, VAT number, tax code, telephone and fax numbers, electronic mail addresses, fiscal data, etc.);

• Economic and commercial data (bank coordinates, data on financial solvency, data relating to your company’s economic and patrimonial trends, etc.).

These data are supplied directly by you or gathered, even verbally, through third party processors (for example: commercial information companies; registers, public data banks or lists; organisational societies; other public subjects; etc.).

Purpose.

The purposes of processing personal data are the following:

1. the stipulating of contracts with you and related tasks;

2. implementing of laws deriving from civil, fiscal and accounting standards, European Community regulations, etc.;

3. implementing provisions imposed by an authority and enshrined in law and regulated by control and monitoring bodies;

4. administrative, financial, organizational and commercial management of the relationship (for example: issuing of invoices, payments, income, deliveries, relationships with any subcontractors, etc.);

5. protecting of the contractual rights of our company, even during litigation;

6. inquiries into the level of customer satisfaction;

7. market evaluations and statistical analyses;

8. promotional, marketing and direct sales activities pertaining to products and services similar to those in the contractual relationship, through the sending (even by electronic mail or telefax) of promotional and advertising material, commercial communications and offers for products and services from our company or third party subjects.

Processing method.

The personal data will be processed using both automatic and non automatic methods (computer systems, telematics, manual and in paper form) and entered into the pertinent data banks (customers, suppliers, administration, etc.). The staff members involved in fulfilling the contracts and the relative commercial, administrative and organizational management may gain access and thus become aware of this data. These staff members will be expressly designated by the undersigned as persons in charge of the processing. The processing will be performed in compliance with the provisions of the Regulation designed to ensure the confidentiality and security of the data, as well as the exactness, revision and pertinence of the data itself with respect to the declared purposes and in order to avoid access and consequent processing by unauthorized subjects. The data will be processed and updated throughout the contractual relationship and, if necessary, always for the aforementioned purposes, even after the conclusion of the relations until all the legal obligations have been explicitly completed.

Communication and dissemination.

Without prejudice to the communications made while carrying out the obligations foreseen by EC laws, regulations and rules, the data can be communicated to the following subjects or categories of subjects in relation to the purposes indicated in part 1, 2, 3, 4 and 5:

• controlled companies, holding companies, companies connected to or syndicated with the undersigned;

• credit institutes for the management of proceeds and payments;

• financial administrations and other companies or public institutes for fulfilment of the regulatory obligations;

• companies, professional offices or associations that the undersigned uses (for example: in the fields of administration, accounting, taxation, law, etc.);

• credit status information agencies and companies;

• legal offices and companies for the protection of the contractual rights;

• trade associations or groups;

• debt collection companies; factoring companies;

• computer and corporate consulting organisations;

• transport companies delivering products and merchandise on our behalf;

• companies operating in the servicing sector for our machines and equipment kept at your facility and used to carry out the contractually foreseen services;

• any subcontractors responsible for carrying out activities not directly performed by the undersigned;

• subjects who have authorization to access the data based on the provisions of the law and secondary regulations.

These subjects or categories of subjects process the data for the same purposes as those mentioned above as autonomous data controllers.

For the purpose indicated in point 6, the data may be communicated to consultants or specialized companies.

For the purpose indicated in point 7, there is no provision for communicating your personal information other than in aggregate and anonymous form through the divulging of the statistical results.

For the purpose indicated in point 8, your data may be communicated to third parties during the presentation or sending of material for the service bid by the undersigned or by third party subjects.

The dissemination of the personal data is not foreseen. This term is intended to mean the disclosing of personal data to unidentified entities, in any form whatsoever, including making available or consulting such

Data.

Mandatory or optional nature.

The conveyance of the data and the relative processing are required to fulfill the purposes listed in points 1, 2, 3, 4 and 5 concerning the obligations foreseen by the regulatory provisions; it follows that their lack of communication could make this Tender Contract impossible to enforce. The e-mail addresses that you provided for the sale of similar services or products, may be used without your consent for the direct sales of our products or services, unless you refuse. This data processing can be opposed at any time.

The conveyance of the data for the purposes indicated in points 6, 7 and 8 is considered optional, thus, refusal to provide such data will entail no consequences, except the impossibility of putting initiatives in place designed to improve the services we provide you, as well as keeping you updated on the development of our

Offers.

Data processors and persons in charge of processing.

The subjects or categories of subjects who can access the personal data as Data Processors or Persons in charge of processing are:

• administration, finance and control staff; sales department;

• computer system maintenance and management personnel;

• collaborators who are specifically authorized to process this data in compliance with the instructions received and for the indicated purposes.

The Data Processor is the company ATTICA s.r.l., Via Giotto 227, 41125 MODENA (MO), Italy.

The Data Controller is Consorzio TRASH BUSTERS, Via Giotto 227, 41125 MODENA (MO), Italy, represented by its President, Mrs. Franca Falcone.

You may contact the Data Controller at any time to exercise your rights provided for by articles from 15 to 22 of the UE 2016/679 of april 27, 2016 Regulation, synthesized here below:

a) asking for existence or not of personal data concerning him or her;

b) obtaining information about purposes of the processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed and, where possible, the envisaged period for which the personal data will be stored;

c) obtaining from the controller the rectification and the erasure of personal data concerning him or her;

d) obtaining the restriction of the processing;

e) obtaining the data portability, i.e. the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided;

f) opposing at any time to processing of personal data also in case data are processed for direct marketing purposes;

g) opposing to processing of personal data concerning him or her, including profiling based on those provisions;

h) asking the Data Controller for accessing, rectifying, erasing personal data concerning him or her, as well as for the restriction or opposition to the processing, in addition to the right of data portability;

i) withdrawing his or her consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;

j) lodging a complaint with a single supervisory authority in particular in the Member State of his or her habitual residence (Garante Privacy).

Any request for the exercise of your rights should be sent to the e-mail address attica@trashbusters.it.

Received information consent form

The undersigned, which has obtained information provided by the Data Controller in compliance with articles 13 and 14 of the UE 2016/679 of april 27, 2016 Regulation, gives his or her consent (mandatory):

a) for the processing of his or her data in order to execute this Contract;

b) for the following purposes:

1. the execution of contracts stipulated with the Consorzio TRASH BUSTERS and its related tasks;

2. implementing of laws deriving from civil, fiscal and accounting standards, European Community regulations, etc.;

3. implementing provisions imposed by an authority and enshrined in law and regulated by control and monitoring bodies;

4. administrative, financial, organizational and commercial management of the relationship (for example: issuing of invoices, payments, income, deliveries, relationships with any subcontractors, etc.);

5. protecting of the contractual rights of the Consorzio TRASH BUSTERS, even during litigation;

c) authorizing their communication to the following subjects or categories of subjects:

• controlled companies, holding companies, companies connected to or syndicated with the Consorzio TRASH BUSTERS;

• credit institutes for the management of proceeds and payments;

• financial administrations and other companies or public institutes for fulfilment of the regulatory obligations;

• companies, professional offices or associations that the Consorzio TRASH BUSTERS uses (for example: in the fields of administration, accounting, taxation, law, etc.);

• credit status information agencies and companies;

• legal offices and companies for the protection of the contractual rights;

• trade associations or groups;

• debt collection companies; factoring companies;

• computer and corporate consulting organisations;

• transport companies delivering products and merchandise on behalf of the Consorzio TRASH BUSTERS;

• companies operating in the servicing sector for the machines and equipment owned by Consorzio TRASH BUSTERS kept at our facility and used to carry out the contractually foreseen services;

• any subcontractors responsible for carrying out activities not directly performed by the Consorzio TRASH BUSTERS;

• subjects who have authorization to access the data based on the legal provisions of secondary regulations.

The undersigned, also

􀀀 Gives its consent (optional) 􀀀 Does NOT give its consent

a1) for the processing of his data in order to execute this Contract;

b1) for the following purposes:

6. inquiries into the level of customer satisfaction;

7. market evaluations and statistical analyses;

8. promotional, marketing and direct sales activities pertaining to products and services similar to those in the contractual relationship, through the sending (even by electronic mail or telefax) of promotional and advertising material, commercial communications and offers for products and services from Consorzio TRASH BUSTERS or third party subjects;

c1) authorizing their communication to the following subjects or categories of subjects:

• potential customers of the Consorzio TRASH BUSTERS, through presentation or the sending of promotional material, mentioning me as a reference;

• consultants and companies specialized in the activities mentioned in points 6, 7 and 8.