1. DATA CONTROLLER

ELLEA Ingegneria S.r.l
Corso Vittorio Emanuele II, 83
10128 – Turin
P.IVA IT07920760720 – REA: BA-591297
Cap. soc. € 10,200 i.v.
pec: amministrazione@pec.elleaing.com
Hereafter, “Ellea” or the “Owner”

2. PERSONAL DATA PROCESSED

– Browsing Data
– Personal Data (first name, last name, date of birth for proof of age of majority, which may be required for specific
purchases or to participate in sweepstakes, e-mail address and cell phone number);
– Contact Data (e-mail address and phone number);
– Data related to purchases made on the Site;
– Billing Data (e.g. VAT number. SDI code, etc.);
(jointly also referred to as the “Data”).

3. COLLECTION OF PERSONAL DATA

– Navigation data
The computer systems and software procedures used to operate this Site acquire, in the course of their normal
operation, certain personal data, including IP addresses or domain names of the computers used by users connecting to the Site of
Ellea, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used in
submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given
by the server (successful, error, etc.) and other parameters related to the user’s operating system and computer environment.
This data, collected by means of cookies and metadata described in the Cookie Policy of the Ellea Site, to which reference is made, and used for the sole purpose of
obtaining anonymous statistical information on the use of the Site and to check its correct functioning, is deleted
immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical crimes
computer crimes to the detriment of the site.
– Contact, personal, purchase and billing data
These data are collected by the Data Controller as a result of the data subject’s entry on the Site at the time of purchase on the Site and
will be processed for the purposes and in the manner described in this policy.

4. PURPOSE AND LEGAL BASIS FOR PROCESSING

In some sections of the Site, in connection with specific services, some of the Data listed above are requested, which will be processed by the
Data Controller for the purposes and legal bases set out below.
– For the execution of pre-contractual measures and/or a contract to which you are a party:
– for the management and technical administration of the website;
– to proceed with the ‘purchase of products of Ellea;
– to receive and properly process requests for information and contact received.
– For handling the shipping and delivery of the ordered products;
– For participation in any operations and contests with prizes, in the manner specified in the relevant regulations
shown on the Site.
– Based on a legitimate interest of the Owner (soft spam ex art. 130 paragraph 4 of D. lgs 196/2003 as updated
by D. lgs 101/2018 – Code for the protection of personal data), for the promotion by e-mail of goods or services
similar to those of the sale, without prejudice to the possibility to object at any time.
– In addition, with your prior consent, which is optional and revocable at any time, the personal data collected may
Be processed for additional purposes, and in particular for:
o Marketing: to send you communications of initiatives, commercial offers including on digital media, questionnaires and
market research of the Data Controller through digital channels (e.g. by e-mail);
In any case, your personal data may also be processed, where necessary, for the following purposes:- For the need to fulfill legal obligations, and in particular to fulfill obligations under regulations and applicable national and supranational
legislation (tax compliance, administrative etc.);
– On the basis in a legitimate interest (judicial protection), to ascertain, exercise or defend the rights of the Owner in
judicial and/or extrajudicial proceedings.

5. RETENTION PERIOD

– For the entire contractual term and, after termination, for the ordinary limitation period of 10 years, for processing
having as its legal basis the execution of pre-contractual measures and/or a contract to which the data subject is a party.
– Until the exercise of its right to opt-out for the activity of promotion by e-mail of services similar to those of the sale,
based on the legitimate interest of the Owner (soft spam);
– Marketing consent granted by customers who have made a purchase of products on the Site will be retained for a
period of 4 years, corresponding to the average life cycle of the products or vehicles on which they will be installed and, therefore, to the average period
of interest expected for new Ellea products. In any case, this is without prejudice to the possibility for the data subject to renew
such consent by the end of this period and, in any case, his or her right to withdraw consent at any time.
– For the duration stipulated by law (10 years for administrative-accounting fulfillment) for the processing of fulfillment
of legal obligations;
– In the case of judicial litigation, for the duration of the same, until the exhaustion of the time limit for the exhaustion of the time limit for the admissibility of actions
of appeal, for the processing of judicial protection of the Holder on the basis of his legitimate interest.
The personal data in question, once the above retention periods have elapsed, will be destroyed, deleted or anonymized
consistent with the technical procedures for deletion and backup and with the accountability requirements in the hands of the Data Controller.

6. COMPULSORY NATURE OF THE PROVISION OF DATA

The provision of Data processed for the purposes of the execution of pre-contractual measures and/or a contract and the fulfillment of
legal obligations is necessary for the conclusion of the various contractual relationships, the execution of orders and services requested and the fulfillment
of legal obligations.
Therefore, any refusal on the part of the data subject will result in the impossibility, on the part of the Data Controller, to provide the requested service.
In relation to any optional processing, the provision of data is entirely optional and the data subject may express at
any time his or her right to opt-out. Optional processing means the processing of data not indicated on the Site as
obligatory with the affixing of an asterisk (*) and processing for marketing purposes based on the free and informed consent
of the data subject.
With regard to browsing data, please refer to the Cookie Policy which can be accessed from the link on the Site at the bottom of the
page.

7. RECIPIENTS OF DATA

The Data may be known and processed by the employees of the company functions assigned to the pursuit of the above-mentioned
purposes, who have been expressly authorized to the processing and have received appropriate operational instructions.
The Data, moreover, may be processed by external parties operating as autonomous controllers such as, by way of example, organs
of supervision and control, Public Authorities that expressly request it for administrative or institutional purposes and in general
all parties entitled by current national and European regulations to request such data.
The Data may also be processed, on behalf of the Company, by external parties that qualify as data processors (pursuant to
Article 28 of the GDPR). Such parties, by way of example, may be:
– companies that perform the service of management and/or maintenance of the Company’s website;
– Companies that provide e-commerce platform management services;
– Companies that offer support in conducting market studies;
– Companies that offer services for sending e-mail and promotional materials;
– companies that offer customer management services (CRM);
– companies that offer services for the management of the information system and telecommunications networks, including electronic mail
;
– companies that offer services for sending documentation and/or products (post offices, forwarding agents, couriers, etc.);
– banking and/or payment institutions for the management of collections and payments resulting from the execution of contracts.
– agencies and entities in charge of managing administrative paperwork related to the execution of operations or sweepstakes.
The full list of data processors is available upon request to be sent to the Controller using the contact details given
in Section 9 below.

8. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

Your Personal Data will not be transferred outside the European Union.
Where this is the case, with respect to data collected using cookies, the Data Controller will, to the extent of its competence, adopt appropriate
safeguards, including applicable adequacy decisions and Standard Contractual Clauses
adopted by the European Commission.

9. RIGHTS OF INTERESTED PARTIES

The rights related to the personal data that ELLEA Ingegneria s.r.l. processes are, according to Articles 15 and ss of Regulation (EU) 679/2016:
– Right to rectification. Possibility for users and customers to obtain the rectification of personal data concerning you or communicated to us by you
;
– Right to limitation. Possibility for users and customers to obtain a limitation of the processing of personal data in
report:
or to the accuracy of your personal data during the period when Ellea needs to verify its accuracy;
or to the case where processing is unlawful, to request a restriction of processing as an alternative to the
deletion of personal data;
or to the case in which there is no longer a need for Ellea to retain personal data but the user or customer
needs it to ascertain, exercise or defend his or her rights in court; or
or to the possibility you object to the processing while Ellea verifies whether its legitimate reasons prevail over
different reasons posed by the data subject.
– Right to Access. Ability to request from Ellea information about the personal data stored about you, including
information about what categories of personal data Ellea owns or controls, for what purpose they are used, where they were
collected (if not directly from you), and to whom they may have been disclosed;
– Right to portability. Following your request, Ellea will transfer your personal data to another Data Controller
if technically possible, provided that the processing is based on your consent or is necessary for
the performance of a contract.
– Right to erasure. Possibility to obtain from Ellea the deletion of your personal data if:
o the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
or you have the right to object to further processing of your personal data and you exercise this right at
opposition;
or the personal data has been processed unlawfully,
unless the processing is necessary by virtue of legal or statutory obligations or in order to establish, exercise or defend a
right in court.
– Right to Opposition. Possibility to object at any time to the processing of the data subject’s personal data, at
the condition that the processing is not based on consent but on the legitimate interests of Ellea or third parties. In such cases, Ellea
will no longer process the data subject’s personal data unless compelling and legitimate reasons can be demonstrated, an
overriding interest in the processing or establishment, or the exercise or defense of a right in court. In the case of
opposition to processing, it is appropriate and useful to specify whether the data subject intends to delete his or her personal data or
limit its processing.
– Right to lodge a complaint. In the event of an alleged violation of the applicable privacy law, it is possible
to file a complaint with the competent authorities of the country or place where the alleged violation is alleged to have occurred.
Data subjects may exercise the rights listed and described above:
– by contacting the Company’s Privacy Office, by mail at: Ferno (VA), via Quarto 30/32/34
– by e-mail at: info@elleaing.com.

In addition, data subjects, where processing is based on consent or contract and is carried out by automated
means, have the right to receive in a structured, commonly used and machine-readable format the data, as well as,
if technically feasible, to transmit them to another data controller without hindrance.

Data subjects have the right to lodge a complaint with the competent supervisory authority in the member state in which they usually reside
or work or the state in which the alleged infringement occurred.

10. CHANGES TO THIS PRIVACY POLICY

Any future changes or additions to the processing of personal data as described in this Privacy Policy
will be notified through the usual communication channels used by Ellea (e.g., via the website)