Privacy Notice for the Processing of Personal Data pursuant to Article 13 of EU Regulation 2016/679

Pursuant to Article 13 of European Regulation 2016/679 on personal data protection, this notice provides the necessary information regarding the processing of personal data provided by users (hereinafter, “Users”) of the website www.moltenifarma.it (hereinafter, the “Site”). This notice does not apply to other websites that may be accessible via links on the Site; L. MOLTENI & C. DEI F.LLI ALITTI Società di Esercizio S.p.a. (hereinafter, also referred to as “Molteni”) is not responsible for the processing of data carried out by third-party websites.

This notice is also provided in accordance with Recommendation no. 2/2001, adopted on May 17, 2001, by the European data protection authorities gathered in the Group established by Article 29 of Directive 95/46/EC. Specifically, the recommendation identified certain minimum requirements for the collection of personal data online, including the methods, timing, and nature of the information that data controllers must provide to Users when they access web pages, regardless of the purposes of their connection.

The "Data Controller," Location, and Data Processing Methods

Under Regulation (EU) 2016/679, the Data Controller is Molteni. Data processing will take place at Molteni’s headquarters and will be carried out both automatically and manually, using methods and tools designed to ensure maximum security and confidentiality, by personnel authorized for this purpose (including those who occasionally process data on behalf of Molteni for maintenance activities), in compliance with Articles 32 et seq. of the European Regulation.

Data will be stored for a period not exceeding what is necessary to achieve the purposes for which it is collected and processed.

Data resulting from web services may be communicated to technical and instrumental partners used by Molteni to provide the services requested by Users.

Personal data provided by Users submitting requests for informational material (requests for information, responses to inquiries, etc.) will be used solely to fulfill the requested service or performance and will only be disclosed to third parties if necessary (for example, providing requested services through technical and instrumental partners).

Types of Data Processed

Personal/Identifying Data

Personal data refers to any information relating to an identified or identifiable natural person, even indirectly, by reference to any other information, including a personal identification number. Identifying data, in particular, refers to personal data that allows the direct identification of the data subject (e.g., name, surname, date of birth, residence or domicile, email address, phone numbers, etc.).

Browsing Data

The IT systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified Users but, by its very nature, could allow Users to be identified through processing and association with data held by third parties. This category of data includes IP addresses or domain names of computers used by Users, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numeric code indicating the status of the server's response (successful, error, etc.), and other parameters related to the operating system and the User’s IT environment. The data could be used to ascertain responsibility in case of hypothetical cybercrimes against the Site.

Data Provided Voluntarily by Users

The optional and voluntary sending of email messages to addresses indicated on the Site and/or the completion of data collection forms involves the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included. Specific notices will be progressively displayed or provided on Site pages prepared for particular services upon request.

Purpose of Processing, Requiring Consent Where Mandated by European Regulation

Personal data provided by the User to Molteni will be used for legal purposes, to provide ancillary services for the User, and to address specific requests.

In particular, voluntarily provided personal data will be processed for the following purposes:

• Website navigation;

• Possible contact requests, including the provision of requested information;

• General administrative and accounting activities. In terms of data protection regulations, processing for administrative and accounting purposes refers to activities related to organizational, administrative, financial, and accounting tasks, regardless of the type of processed data. These purposes include internal organizational activities and obligations related to contractual or pre-contractual agreements;

• Subscription to mailing lists;

• Marketing and market research: to receive promotional material via automated means such as email and SMS, as well as traditional methods like mail and telephone; to conduct customer satisfaction surveys; and to promote products, services, programs, prize contests, and events offered by Molteni.

Communication and Disclosure of User Data

User data will not be disseminated but may be communicated by Molteni to (i) entities providing services instrumental to the above purposes; (ii) suppliers, banks, insurance institutions, or other entities acting on behalf of Molteni for the listed activities; (iii) consultants assisting Molteni in legal, tax, pension, accounting, and organizational matters; (iv) authorities or other entities as required by law.

Provision of Data and Consequences of Refusal

Except for browsing data, the provision of personal data by the User is optional.

Failure to provide or providing inaccurate/incomplete information may make it impossible, without any liability on the part of Molteni, to manage or execute the activities described under the purposes of processing.

User Rights

The data subject has the right to exercise the following rights under Articles 15 et seq. of EU Regulation 2016/679:

• Right of access and rectification (Articles 15 and 16 of the EU Regulation)
• Right to data erasure (Article 17 of the EU Regulation)
• Right to restrict processing (Article 18 of the EU Regulation)
• Right to data portability (Article 20 of the EU Regulation)
• Right to object (Article 21 of the EU Regulation)
• Right to lodge a complaint (Article 77 of the EU Regulation)

The data subject may exercise these rights regarding specific data processing activities performed by the Data Controller using the contact details provided earlier in this notice.

A complete and updated list of Data Processors is available upon request from the Data Controller.

Requests can be directed to Molteni’s Data Protection Officer via email at dpo@moltenifarma.it or by regular mail addressed to: L. MOLTENI & C. DEI F.LLI ALITTI Società di Esercizio S.p.a., S.S. 67 (Tosco Romagnola) – Loc. Granatieri – 50018 Scandicci (Fi).

In addition, pursuant to Article 77 of EU Regulation 2016/679, the User has the right to lodge a complaint with the Data Protection Authority if the processing violates the Regulation.

Privacy Policy Changes

Molteni reserves the right to modify, update, add, or remove parts of this privacy policy at its discretion and at any time. Users are encouraged to review changes periodically. To facilitate verification, this notice will include the date of the last update. Use of the Site following changes implies acceptance of those changes.