PRIVACY POLICY

Privacy Notice under article 13 of General Data Protection Regulation EU 2016/679 (GDPR)

Util Industries S.p.A with registered offices at Via Giovanni XXIII, 10 – 14019 Villanova d’Asti AT (Italy) (hereinafter, “Company” or “Data Controller“) is committed to protecting the online privacy of the users of its websites.

A) Source of personal data and Data Controller

As such, this Privacy Policy has been written, under Article 13 of EU Regulation 2016/679 (hereinafter, the “Regulation“), in order to allow you to understand our policy regarding your privacy, and how your personal information will be handled when using our websites [www .utilgroup.com] (hereinafter “Website”) The information and data which you may provide, or which may otherwise be collected in the context of your use of Company’s services – e.g., access to reserved areas in the Website, newsletter etc(hereinafter “Servizi“), will be used processed in compliance with the Regulation and with confidentiality obligations guiding Company’s activities.

This means, in particular, that any personal data processing carried out by the Company will respect the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, and confidentiality.

The data controller regarding all personal data processing operations carried out through the Website is Util Industries S.p.A with registered offices at Via Giovanni XXIII, 10 – 14019 Villanova d’Asti AT (Italy), as identified at the start of this Privacy Policy.

This Privacy Policy is provided only for this Website and not for other websites that may be consulted by the user via links. Please refer to any specific sections of the Website where you can find specific information and any requests for consent for individual processing.

B) Personal Data processed

As you use the Website, we inform you that the Company may process personal data related to you (article 4(1) of the Regulation) hereinafter “Personal Data”. Personal Data which may be processed by the Company through the Website are as follows:

1) Browsing Data

The Website’s operation, as is standard with any website on the Internet, involves the use of computer systems and software procedures, which collect information about the Website’s users as part of their routine operation. While the Company does not collect this information in order to link it to specific users, it is still possible to identify those users either directly via that information, or by using other information collected – as such, this information is also considered Personal Data. This information includes several parameters related to your operating system and IT environment, including your IP address, location (country), the domain names of your computer, the URI (Uniform Resource Identifier) addresses of resources you request on the Website, the time of requests made, the method used to submit requests to the server, the dimensions of the file obtained in response to a request, the numerical code indicating the status of the response sent by the server (successful, error, etc.), and so on.

These data are used exclusively to compile anonymous, statistical information on the use of the Website, as well as to ensure its correct operation (see the Website Cookie Policy) and identify any faults and/or abuse of the Website – the data is deleted immediately after processing, unless it must be used to identify responsible parties in the event of cybercrime committed which harms the Website or third parties.

2) Data provided voluntarily by the data subject

Except for what specified for browsing data, you are free to submit your Personal Data requested in any request form on the website (e.g., to activate the newsletter service, to sign in or to complete a purchase). Failure to provide such data could make impossible for the Company to provide the related service. In those cases, will be required the sole information that are necessary to provide the requested service (see the corresponding privacy notices).

When using some of the Website’s Services, you could submit Personal Data related to other persons. In any situation where you decide to share Personal Data related to other persons through the Website, you will be considered as an independent data controller regarding that Personal Data and must assume all inherent legal obligations and responsibilities. This means that you must also make sure that you have these third parties’ consent to their Personal Data being used in this manner before providing them to the Company, or another appropriate legal basis (art. 6 of the Regulation) which may allow for lawful processing of this information. To this end, you must fully indemnify the Company against any complaints, claims or demands for compensation for damages which may arise from the processing of this Personal Data, initiated by the third parties whose information is processed via the Website by your initiative.

C) Purpose of the processing

The Company intends to use your Personal Data, collected through the Website, for the following purposes:

• To provide the Services of the Website;

The legal basis to process your Personal Data is the necessity of the processing for the performance of a contract with you, as well as to take steps at your request prior to entering into a contract with you – Art. 6(1)(b) of the Regulation.

It is not mandatory for you to submit your Personal Data for these purposes; however, if you do not, the Company will not be able to provide some Services to you.

D) Recipients of Personal Data

Your Personal Data may be shared, for the purposes listed above, with:

• Persons authorised by the Company to process Personal Data needed to carry out activities strictly related to the provision of the Services, who have undertaken an obligation of confidentiality or are subject to an appropriate legal obligation of confidentiality (e.g., employees and system administrators).

• Third parties engaged in order to manage the Website, acting as data processors on the Company’s behalf (the complete and updated list of data processors is available at www.smog.agency)

• Public entities, bodies, or authorities to whom your Personal Data may be disclosed, in accordance with the applicable law or binding orders of those entities, bodies or authorities.

E) Transfers of Personal Data

Some of your Personal Data are shared with Recipients who may be located outside the European Economic Area. The Company ensures that your Personal Data are processed by these Recipients in accordance with the Regulation. Under the Regulation, these transfers can be based on an adequacy decision, on the Standard Contractual Clauses approved by the European Commission or on another appropriate legal basis

F) Retention of Personal Data

Your Personal Data will be kept only for the time necessary for the purposes for which they are collected, in compliance with the principle of data minimization referred to in Article 5.1.c) of the Regulation.

In any case, your personal data will be kept for the time necessary for the provision of the Website’s Services. For the retention periods related to the all the different processing of the personal data collected through the forms on the site, please refer to the relevant privacy notices.

G) Data subject rights

Under Articles 15 and following of the Regulation, you, as a data subject, are entitled to request from the Company, at any time, access to your Personal Data, the rectification and erasure of your Personal Data, as well as to object to its processing. You are also entitled to request the restriction of the processing of your Personal Data in the cases set out in Article 18 of the Regulation, as well as to obtain the Personal Data you have provided to the Company in a structured, commonly used and machine-readable format, in the cases set out in Article 20 of the Regulation.

In any case, please note that, as a data subject, you are entitled to file a complaint with the competent supervisory authorities for the protection of Personal Data (article 77 of the Regulation), if you believe that the processing of your Personal Data carried out through this Website violates applicable law.

H) Amendments

This Privacy Policy entered into force on 10/10/2021. The Company reserves the right to amend this Privacy Policy partly or fully, or simply to update its content, e.g., as a result of changes in applicable law. The Company will inform you of such changes as soon as they are introduced, and they will be binding as soon as they are published on the Website.

The Company therefore invites you to regularly visit this section in order to acquaint yourself with the latest, updated version of the Privacy Policy, so that you may remain constantly informed on how the Company collects and uses Personal Data.