SUPPLIER PRIVACY POLICY

Your personal data are processed for the following purposes:

1. to comply with legal obligations, regulations, EU legislation, and civil and tax laws (for example, invoicing and accounting requirements);

2. to fulfil pre-contractual and contractual obligations towards the data subject (for example, requesting quotations from suppliers, handling supplier quotations, purchase orders and related invoicing, etc.);

3. to manage requests, reports, enquiries, or service requests submitted by the data subject;

4. to implement Altergon's internal operating procedures relating to security, access control, and the compilation and analysis of internal statistics;

5. to protect Altergon's legitimate interests in judicial proceedings or other legal contexts, in accordance with applicable law.

Processing may be carried out using electronic and automated means by Altergon's duly trained and formally authorized personnel, by appointed Data Processors, including Altergon's service providers with proven expertise and reliability acting under the Controller's instructions and supervision, as well as by external parties acting as independent Data Controllers, such as tax consultants and statutory auditors. In all cases, processing will be carried out by adopting appropriate technical and organizational measures to ensure the security and confidentiality of personal data.

The processing activities described above may also be performed with the support of external Data Processors located within Member States of the European Union. Where a Data Processor is established outside the European Union, any transfer of personal data shall take place in compliance with Chapter V of the GDPR, ensuring that one of the legal transfer mechanisms provided for in Articles 45 et seq. of the Regulation is in place.

Altergon processes personal data only where one of the legal bases provided by applicable legislation exists, namely:

a) for the purpose referred to in point 1 above, processing is based on Art. 6(1)(c) GDPR, as it is necessary for compliance with a legal obligation;

b) for the purpose referred to in point 2 above, processing is based on Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract to which the data subject is a party;

c) for the purpose referred to in point 3 above, processing is based on Art. 6(1)(b) GDPR, as it is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract;

d) for the purpose referred to in point 4 above, processing is based on Art. 6(1)(f) GDPR, as it is necessary for the purposes of the legitimate interests pursued by the Controller;

e) for the purpose referred to in point 5 above, processing is based on Art. 6(1)(f) GDPR, as it is necessary for the purposes of the legitimate interests pursued by the Controller.

Where necessary for the above purposes, your personal data may be disclosed to:

✓ Public Authorities and authority, where required by law, and to any other parties entitled to access such data pursuant to legal or regulatory provisions;

✓ companies or financial institutions with which Altergon has business relationships for the management of receivables and payables (including factoring companies, debt collection agencies, and credit insurance companies);

✓ Altergon's internal authorized personnel and external Data Processors, duly trained and formally appointed, acting within the scope of their respective duties, as well as external service providers acting as independent Data Controllers with proven expertise and reliability;

✓ natural persons and/or legal entities, whether public or private (including law firms, judicial offices, Chambers of Commerce, etc.), where disclosure is necessary or instrumental for carrying out the Company's activities and exclusively for the purposes described in this Privacy Notice.

The updated list of appointed Data Processors is available upon request by contacting privacy@altergon.it

Personal data processed by Altergon will not be disseminated.

Personal data will be retained as follows:

✓ Data collected for the conclusion and performance of contracts with the Data subject:

the personal data you provide will be processed for the entire duration of the contractual relationship and subsequently retained only for the period required to comply with applicable legal and regulatory obligations, unless further retention is necessary for the establishment, exercise, or defence of legal claims, or to comply with additional legal obligations or orders issued by public authorities.

✓ Data collected in connection with requests or reports submitted by the Data subject:

such data will be retained for the time necessary to manage and fulfil the relevant request or report. Data processed to implement Altergon's internal security and access control procedures will be retained for 10 years.

Altergon does not carry out any automated decision-making processes, including profiling, defined in Art. 22 of Regulation (EU) 2016/679.

Under the GDPR, you are entitled to exercise the following rights. In particular, you may request that Altergon:

1. Access (Art. 15 GDPR): obtain confirmation as to whether or not personal data concerning you are being processed and receive additional information regarding such processing;

2. Rectification (Art. 16 GDPR): request the correction or completion of inaccurate or incomplete personal data;

3. Erasure (Art. 17 GDPR): request the deletion of your personal data where they are no longer necessary for the purposes for which they were collected, where consent has been withdrawn (where applicable), where you have objected to processing and there are no overriding legitimate grounds for processing, where processing is unlawful, or where erasure is required by law;

4. Restriction of Processing (Art. 18 GDPR): request the restriction of processing where one of the conditions set out in Art. 18 GDPR applies;

5. Objection (Art. 21 GDPR): object at any time to processing based on Altergon's legitimate interests, unless compelling legitimate grounds exist which override your interests, rights and freedoms, including for the establishment, exercise or defence of legal claims;

6. Data Portability (Art. 20 GDPR): receive your personal data in a structured, commonly used and machine-readable format, or request that such data be transmitted to another data controller where technically feasible.

You may exercise these and any other rights granted under Regulation (EU) 2016/679 by contacting the Data Controller using the contact details provided below. You also have the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Italian Data Protection Authority ("Garante per la Protezione dei Dati Personali").

The Data Controller in question is Altergon Italia S.r.l. Unipersonale, P.IVA 01367710439, with registered office at Via Privata Cesare Battisti, 1, Milan – 20122 and operational headquarters in Zona Industriale A.S.I. di Morra De Sanctis – 83040 (AV), Tel. 0827.21.52.32 – Fax 0827.23.137 – E-mail: privacy@altergon.it