BARON FIDELITY | PRIVACY

PRIVACY POLICY – APP BARON FIDELITY
pursuant to and for the purposes of art. 13 of Reg. (EU) 2016/679

This information contains the information required pursuant to art. 13 of R eg . ( EU ) 2016/679 relating to the protection of natural persons
with regard to the processing of personal data, as well as European or national legislative interventions and/or provisions of the supervisory authorities
following the publication of this information . We therefore invite you to take note of the information and express your consent to the
data processing.

1. OWNER OF L TREATMENT
The The data controller is QBSrl based in Fields Bisenzio (FI) , Via San Quirico n. 165 , tax code, VAT number and registration number
at the Company Register of Florence 06056000489 , in the person of his legal representative pro tempore .

2. DATA PROTECTION OFFICER (DPO / DPO )
Pursuant to art. 37 of the GDPR. The The data controller has appointed the Data Protection Officer also known as Data Protection Officer
as DPO whose contact details are released ( e - mail: dpo @ baronefirenze .it) which have also been published in the appropriate section of the site
Internet corporate .

3 . LEGAL BASIS AND PURPOSE OF THE PROCESSING
QBSrl treats i your data personal exclusively for carrying out the activity corporate and in particular for the following purposes :

to) For the stipulation and execution of the contract relating to ours products and/or services, i.e. for strictly related purposes and
instrumental to completion from the necessary activity pre-contractual, at the management of the relationship contractual (activity
administrative and accounting, customer assistance, complaint management, recovery of credit ).
b) To fulfill legal obligations and requests from the Authorities, as well as to comply with the provisions of the legislation current in the field
of prevention and combating money laundering and terrorist financing , where applicable.
c) For carrying out statistical analyses and market research internal for which data communication is not foreseen
save the disclosure of statistics in aggregate and anonymous form.
d) To register for our loyalty program will be requested personal data mandatory : name surname , date of
birth, email and mobile phone , For the carrying out of marketing activities direct through the sending of promotional material e
advertising for the purpose of offering our products and services similar to those you have already purchased , sending of advertising communications
via email, sms, push notifications (on App), Whatsapp Business , including our newsletter .
And) As part of our loyalty program, the data in the previous point d) will be treated for the prize operation or
called “Barone Fide lity” For accumulate reward points on both physical and virtual loyalty cards (issued by the company of the same name Apps) And
for any competitions instant win or draw dedicated to Fidelity holders only Card.
f) As part of our loyalty program the data from the previous point d) will be treated For profiling purposes al
in order to improve the commercial offer and the services offered through analysis of consumption habits and choices.

The conferment of his data for the purposes referred to in e letters a) b) and c) failure to do so is mandatory as it is necessary for the purposes pursued
communication of the data would therefore make it impossible to fulfill these purposes, while the treatments referred to in e letters d ) And) and f )
he requested his consent free and specific . Regarding the request Of data personal for prize operations referred to in the previous one
point d) the name and surname are used to identify the holder of the fidelity card, the date of birth to resolve cases of homonymy, the
email which user id for accessing the App and the telephone for communications directly with the user in case of winnings.

If we have previously acquired your consent, it may be revoked at any time by writing to the address And -
email : privacy@baronefirenze.it or by contacting the Data Protection Officer at the e - mail address: dpo@baronefirenze.it or
within the A pp Barone Fidelity independently revoking the respective consents.

4 . PROCESSING METHODS
The processing of your data will be based on the principles of lawfulness, correctness and transparency and can also be carried out through
automated processes designed to store, manage and transmit them accurately and will take place through technical measures and adequate organizational a
guarantee its safety and protection from unauthorized or illicit processing, loss, destruction or accidental damage. THE your data
will be used by appointed managers and authorized and appropriately natural persons educated . Not there they will be decision-making processes
automated.

5 . COMMUNICATION
For the pursuit of the purposes described in the previous point 3 , the personal data processed will be known to employees and staff
assimilated and by the Data Controller's collaborators, who will operate as subjects authorized to process personal data . Furthermore, your data
personal data will be processed by third parties belonging to the following categories:

• subjects who take care of administrative and fiscal obligations for the Data Controller;
• companies and consultants that provide legal consultancy activities;
• insurance companies and credit institutions;
• external companies that offer services related to merit verification credit, capital solidity, risk profile and
regulatory compliance (e.g. anti-money laundering);
• third-party companies that provide logistics services;
• companies that carry out technical coordination, assistance and maintenance of IT systems on our behalf ;
• in general, third-party companies that provide assistance regarding issues relating to the existing contract.

The subjects belonging to the above categories operate, in some cases, in total autonomy as distinct Data Controllers of the treatment, in
other hypotheses, as Data Controllers specifically appointed by the Data Controller in compliance with article 28 of the Reg . (EU) 2016/679.

PRIVACY POLICY – APP BARON FIDELITY

pursuant to and for the purposes of art. 13 of Reg. (EU) 2016/679

The complete and updated list of subjects to whom your personal data may be communicated can be requested from the registered office of

Holder. Your personal data will not be transferred to third parties outside the European Union and will not be object of diffusion.

6 . DATA RETENTION PERIOD

Your personal data will be kept for the entire time of membership loyalty program. Subsequently i his personal data

will be kept for a period not exceeding the limitation period established by law for any enforcement or defend a

right in court in his towards or towards third parties And for the period of time strictly necessary to pursue the specifications

purposes of the processing referred to in the point 3 of this information and, specifically:

• For the purposes indicated in letter a) b) and c) of par. 3, your personal data will be retained for time necessary for completion

of the relationships existing between the parties and subsequently for the period of time determined by current regulations , the data linked to

invoicing will be kept for ten years from the invoicing date, after which they will be deleted or

pseudonymization .

• For the purposes of marketing of which literally d ) of par. 3, your personal data will come processed anonymously after 24 months

from their registration; the data collected and processed for profiling purposes referred to in letter e) will be processed anonymously

12 months after their registration . At any time any user can withdraw your consent for each of the different ones

contact methods by acting on the appropriate options of the loyalty program App ;

• THE data personal collected for the prize operation called “Barone Fidelity” Of referred to in the letter And) of point 3 , will be preserved

for the entire duration of the “Barone Fidelity” prize operation and in any case no later than 24 months.

7 . RIGHTS OF THE INTERESTED PARTY REFERRED TO IN ARTICLES. 15, 16, 17, 18, 20, 21 AND 22 REG. (EU) 2016/679

• In art. 15 – Right of access : the interested party has the right to obtain confirmation from the data controller as to whether or not a data processing is in progress

processing of personal data concerning him and in this case, to obtain access to the personal data.

• Article 16 – Right of rectification: the interested party has the right to obtain from the data controller the rectification of inaccurate personal data that

concern without undue delay. Taking into account the purposes of the processing, the interested party has the right to obtain integration

of incomplete personal data , also by providing a supplementary declaration.

• Article 17 – Right to cancellation (right to be forgotten): the interested party has the right to obtain from the data controller the cancellation of

personal data concerning him without unjustified delay and the data controller has the obligation to cancel without unjustified

delay personal data .

• Article 18 – Right to limit processing: the interested party has the right to obtain from the data controller the limitation of

treatment when one of the following hypotheses occurs:

or a) the interested party disputes the accuracy of the personal data, for the period necessary for the data controller to verify and

the accuracy of such personal data;

or b) the processing is unlawful and the interested party opposes the deletion of the personal data and requests instead that it be limited

use;

or c) although the data controller no longer needs them for the purposes of the processing, the personal data are necessary

to the interested party for the assessment, exercise or defense of a right in court;

or d) the interested party has opposed the processing pursuant to Article 21, paragraph 1, pending verification regarding the possible

prevalence of the legitimate reasons of the data controller over those of the interested party.

• In art. 20 – Right to data portability: the interested party has the right to receive data in a structured, commonly used and readable format

automatic device the personal data concerning him provided to a data controller and has the right to transmit such data to a

other holder of the treatment without impediments from part of the holder of the treatment which there has provided.

When exercising your rights regarding data portability in accordance with paragraph 1, the interested party has the right to obtain the

direct transmission of personal data from one data controller to another, if technically possible.

• In art. 21 – Right of opposition : the interested party has the right to object at any time, for reasons related to his situation

in particular, to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters e) of), including the

profiling on the basis of these provisions.

• Article 22 – Right not to be subjected to automated decision-making, including profiling : the interested party has the right to

not be subjected to a decision based solely on automated processing, including profiling, which produces effects

legal matters that concern him or which similarly significantly affects you .

The above rights may be exercised against us by writing to the address e - mail privacy@baronefirenze.it or by contacting

Data Protection Officer at the e - mail address: dpo@baronefirenze.it .