Information pursuant to Article 13 of Regulation No. 2016/679/EU (the “GDPR”) Business Intelligence Consulting S.r.l. (“BIC”), located at Piazza Buenos Aires 5, 00198, Rome, represented by its legal representative pro tempore, in the ordinary course of its business, comes into contact with, uses, and therefore processes personal data of employees/collaborators of affiliated companies/clients/partners/suppliers (the “Data Subjects”), to whom it provides this notice pursuant to Article 13 of the GDPR.

BIC, pursuant to Article 6(b) of the GDPR, will process the personal data of Data Subjects (name and surname; email; job title; possible corporate mobile phone number; tax code and VAT number) exclusively for the purpose of concluding commercial contracts and any other agreements/assignments with the company where the Data Subject is employed and/or for executing pre-contractual measures requested by the Data Subject on behalf of said company. Additionally, pursuant to Article 6(c) of the GDPR, BIC processes this data to comply with legal obligations. The processing of Data Subjects' data is necessary for BIC’s commercial activities; otherwise, any contractual or pre-contractual relationship with the company where the Data Subject is employed would not be possible. The Data Subject may always refuse to provide their data to BIC; however, this could make it impossible to establish contractual relationships between the parties. BIC recommends that Data Subjects avoid providing or indicating personal data beyond what is strictly necessary for BIC’s activities in communications or interactions with BIC.

For the same purposes and/or purposes strictly related to the aforementioned activities, BIC may disclose Data Subjects' data to third parties, appointed by BIC as data processors pursuant to Article 28 of the GDPR, who will perform or provide specific services such as: accounting; payment processing, invoicing, administration, etc. A complete list of such processors is available at BIC's headquarters and can always be requested. BIC processes the personal data of Data Subjects using appropriate manual procedures or electronic tools in accordance with the principles of fairness, lawfulness, minimization, transparency, and data confidentiality, in compliance with the obligations established by laws, regulations, or EU legislation. BIC will retain the personal data of Data Subjects for as long as necessary to conduct its activities and as long as the Data Subject continues to perform the same duties or role at companies with which BIC maintains commercial relationships. BIC will not transfer, under any circumstances, the personal data of Data Subjects to a third country or an international organization unless strictly necessary for the aforementioned purposes. In such a case, BIC will carry out such transfer only if it has previously identified the existence of one or more conditions under Articles 45 et seq. of the GDPR that legitimize the transfer. BIC does not carry out any automated processing (including profiling) of Data Subjects' data.

Data Subjects, pursuant to Articles 15 et seq. of the GDPR, may exercise their rights at any time against BIC, as well as request confirmation as to whether or not their data is being processed, and, if so, obtain access to such data and the following information:

• a) Purpose of processing;
• b) Categories of personal data processed;
• c) Recipients or categories of recipients to whom the personal data has been or will be disclosed;
• d) Where possible, the expected data retention period or, if not possible, the criteria used to determine such period;
• e) The existence of the right to request rectification or deletion of personal data, restriction of processing, or to object to processing;
• f) The right to lodge a complaint with a supervisory authority;
• g) If the data is not collected from the Data Subject, any available information about its source;
• h) The existence of automated decision-making processes;
• i) A copy of the processed personal data (in case of requests for additional copies, provided this does not infringe on the rights and freedoms of others, BIC may charge a reasonable administrative cost fee).

The information will be provided in a commonly used electronic format, unless otherwise specified by the Data Subject. Additionally, Data Subjects have the right to obtain:

• a) The updating, rectification, or, where relevant, integration of data;
• b) The deletion, anonymization, or blocking of data processed in violation of the law, including data that does not need to be retained for the purposes for which it was collected or subsequently processed;
• c) Certification that the rectification or deletion operations have been communicated to any recipients of the data, unless this proves impossible or involves a disproportionate effort compared to the protected right;
• d) The right to data portability, meaning the right to request that the data be transferred, if technically feasible, to another data controller;
• e) The right to object, in whole or in part, for legitimate reasons, to the processing of personal data, even if relevant to the purpose of collection.