DATA CONTROLLER

Ariston Thermo S.p.A., Viale Aristide Merloni, 45 60044 Fabriano (AN) Italy

T. +39 0732 6011 Fax: +39 0732 602331

Fiscal Code e VAT: IT01026940427

(“Company”).

DATA PROCESSING PURPOSES

LEGAL BASIS FOR PROCESSING DATA

DATA RETENTION PERIOD

Purposes relating to establishing and executing the contractual relationship between the Customer and the Company,

including use of specific Applications.

Execution of the contract with regard to data on legal representatives.

Legitimate interest with regard to data on Customer employees/consultants involved in contract activities.

Contractual term and, after expiry, for the standard limitation period of 10 years.

Participation in any loyalty

programs and/or recording of data in the Company's CRM

Performance of a contract to which the data

subject is a party

Contractual term and, after expiry, for the

standard limitation period of 10 years.

Carrying out administrative and accounting tasks - such as accounting and treasury management, as well as invoicing (for example, checking and recording invoices), in compliance with the requirements of current

legislation.

Need to comply with a legal obligation to which the Company is subject.

Retention period required by law (10 years for administrative and accounting purposes)

Out-of-court debt recovery

Legitimate interest (legal protection)

In case of litigation, for the entire

duration of the same, until the time limit for appeal has expired.

If necessary, in order to establish, exercise or defend the rights of the Data Controller in

legal proceedings

Legitimate interest (legal protection)

Once the aforementioned retention period has lapsed the data will be destroyed or made anonymous

DATA PROVISION

Personal and contact data are mandatory for the conclusion of the agreement

DATA RECIPIENTS

The data may be processed by external parties operating as data controllers such as, by way of example, supervisory and control authorities and, in general, public or private parties entitled to request the data. The data may be communicated to public notaries and law firms as well as to accountants.

The data may also be processed, on behalf of the Company, by external parties designated as processor, who are given adequate operating instructions. These subjects are essentially included in the following categories:

1. Companies offering email services;

2. companies offering website maintenance services;

3. companies offering support in carrying out market research.

4. companies and agencies in the field of event management and trade fairs

5. companies that offer services instrumental to the pursuit of the purposes set out in this information notice (media agencies, IT suppliers, freight forwarders,

softwarehouse & system integrators, e-commerce companies, consulting companies, etc.);

1. companies offering call center and customer care services;

2. information provider companies;

SUBJECTS AUTHORIZED TO PROCESSING DATA

Data may be processed by employees in company departments who are responsible for

carrying out the activities outlined above and have been authorised to process the data and have received suitable operating instructions.

PERSONAL DATA TRANSFERS OUTSIDE THE EU

The data may be transferred abroad to non-European countries, and in particular in the USA, a country whose level of data protection has been deemed appropriate by the European Commission pursuant to art. 45 of the GDPR (Privacy Shield)

The decision of adequacy of the European Commission can be consulted at the following link: http://eur-lex.europa.eu/legal-content/IT/TXT/PDF/?uri=CELEX:32016D1250&from=IT

DATA SUBJECTS’ RIGHTS- COMPLAINT TO THE SUPERVISORY BODY

By Ariston Thermo S.p.A. by mail address Viale Aristide Merloni 45, via e-mail sent to

privacy.aristonthermo@aristonthermo.com , data subjects can ask the Company for access to personal data, or the correction or , and also have the right to restrict processing of the data in the cases set out in article 18 of the GDPR, and object to processing in the case of legitimate interests of the controller.

Furthermore, in the case where processing is based on consent or a contract and carried out

with automated tools, data subjects have the right to receive the personal data in a structured, commonly used and machine-readable format, and to transmit the data to another data controller without obstruction.

Data subjects have the right to lodge a complaint to the competent Supervisory Authority

in the member state where they are resident or where they work, or the member state where the alleged breach took place.

Data subjects have the right to withdraw consent at any time in relation to data processed

for marketing purposes, and object to data being processed for these purposes. Data subjects have the possibility of stating a preference for being contacted for the aforementioned purposes through conventional methods and objecting to receiving

communication through automatic methods only.

INFORMATION NOTICE ACKNOWLEDGEMENT

By signing this document, I hereby confirm that I have received and read the information

on privacy and undertake to provide it for employees/consultants in the company I represent.

              (location),   / /   (date)

Stamp and signature