PRIVACY POLICY

Gilmar Divisione Industria S.p.A. (hereinafter referred to as “Gilmar”) respects your privacy and is committed to processing your personal data with the utmost care and in full compliance with the relevant provisions governing the protection of personal data, including Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”) and Legislative Decree no. 196/2003, also updated pursuant to Legislative Decree no. 101/2018.

This Privacy Policy therefore aims to inform you, with the utmost transparency, about the processing of personal data carried out by Gilmar, as part of its activities to promote and sell its products, including those available on the www.iceberg.com website (hereinafter referred to as the “Website”).

This Privacy Policy does not apply to other websites, web pages or online services accessible from the Website, such as through redirects to resources outside the www.iceberg.com domain.

For us, it is important to provide clear and complete information on how we collect, use and store your personal data, in the context of the relationship established between you and Gilmar and including through your interaction with the Website. For this reason, we encourage you to carefully read this Privacy Policy before sending Gilmar any information and/or personal data of any type.

Personal data refers to any information that makes it possible to identify a person, including indirectly (e.g. by combining said data with other information). By way of example, your email address, first and last name, data relating to your purchase order, etc. are considered to be personal data.

Gilmar does not sell products available on its Website to minors and does not process the personal data of such individuals.

For this reason, if you are under 18 years old, please do not provide us with any personal information, do not subscribe to the Gilmar newsletter, do not register on the Website and do not carry out financial transactions to purchase products online. Purchases on the Website may be made by your parents, by your guardian or by a person over eighteen years of age. In the event that we determine that personal data belonging to a minor has been communicated to Gilmar, such data shall be deleted.

THE DATA CONTROLLER

The Data Controller for the processing of personal data that you may provide to us is Gilmar Divisione Industria S.p.A., with registered office in San Giovanni in Marignano (RN), Italy, in Via Malpasso no. 723-725, reachable by phone or email at:

Tel: +39 0541 959111

Email address: privacy@gilmar.it

DATA PROTECTION OFFICER

Pursuant to art. 37 of the Regulation (EU) 2016/679, Gilmar Divisione Industria S.p.A. has voluntarily designated a Data Protection Officer (“DPO”), which can be contacted at Gilmar Divisione Industria S.p.A., Via Malpasso no. 723-725, 47842 San Giovanni in Marignano (RN), Italy, or by sending an e-mail to dpo@gilmar.it.

TYPES OF PERSONAL DATA PROCESSED

When you browse, interact or make purchases on the Website, Gilmar processes the following types of personal data:

1. the data that your provide to Gilmar to make purchases and/or to register on the Website; such data includes your first and last name, your email address, your date of birth, your gender, your tax information and billing address, the address to ship your purchase, your phone number, your payment method and the data relating to your transaction, your username and password;

2. subject to your consent, your email address to subscribe to Gilmar’s newsletter service;

3. data that you provide to Gilmar when you fill out the “Contact Us” form available on the Website, such as your name, email address, the country where you are located, the information you wish to provide by filling out the “Message” field found on the same form and eventually your telephone number and your order number;

4. browsing data which, although constituting information that is not collected in order to be associated with identified users, could, by its very nature, make it possible to identify the site users if processed and associated with data held by third parties.

This category of data includes data collected automatically while browsing the Website and necessary for the functioning of the same, such as IP addresses, domain names of computers used to connect to the site, addresses in URI (Uniform Resource Identifier) notation of requested resources, the time the request is made, the method used to submit the request to the server, the file size obtained in response, the numerical code indicating the response status from the server (successful, error, etc.) and other parameters related to the user's operating system and computer environment;

5. data and information regarding your access to the Website, purchases and any returns you may have made;

6. subject to your consent, your buying habits;

7. in case you registered on the Website through Facebook or Google, Gilmar automatically collects the required registration data from such subjects, asking you to provide any missing data.

PURPOSE AND COMPULSORY OR OPTIONAL NATURE OF THE DATA PROCESSING

Gilmar processes your personal data for the following purposes:

1. to provide a reply to your requests for information and/or assistance, made using the “Contact Us” form available on the Website;

2. to conclude and enforce the purchase contract between you and Gilmar concerning the products offered on the Website; the execution of the contract requires the use of your data, among other things to finalise the transaction, to ship and deliver the purchased products to you, to respond to your requests for information regarding purchases, to provide after-sales service, as well as to handle any requests for exchanges and/or returns and to process refunds;

3. to comply with applicable legal obligations, including for tax purposes and to protect its rights;

4. to allow you to browse the Website and for computer security purposes.

The provision of your personal data for all the aforementioned purposes is not mandatory. However, your refusal to provide such data shall make it impossible for Gilmar to conclude a contract with you and to respond to your requests, including that of supplying you the products available on the Website;

5. to allow you to register on the Website and the subsequent use of the features available on the same (e.g. the creation of a “wish list”, retention of your order history and returns);

The provision of personal data for such activities is optional. In fact, you can make purchases on the Website using the “guest” mode. However, in this case you shall not be able to take advantage of the additional features described above, provided to registered users;

6. subject to your consent, Gilmar shall process your personal data for marketing purposes, for example to provide you with promotions, discounts, rebates or other services, to send you newsletters, promotional or commercial information, free products, invitations to events and to conduct market research;

7. subject to your consent, Gilmar shall use your personal data to carry out profiling activities, including carrying out an analysis of your purchases (identifying the type, frequency and amounts spent) and of your interactions with the Website, in order to send you commercial and promotional offers in line with your specific interests and your buying habits, developing products and services closer to your personal needs.

The provision of personal data which Gilmar may use for marketing and profiling purposes is entirely optional. However, if you do not provide such data, it shall be impossible for Gilmar to carry out marketing and profiling activities and therefore to send you communications of a commercial nature, discounts and promotions as described above.

Failure to consent to the processing of your personal data for marketing and profiling purposes, or the subsequent revocation of your consent for such purposes, shall not prevent you from browsing the Website and making purchases through the same

LEGAL BASIS OF THE DATA PROCESSING

Gilmar processes your personal data based on the following conditions of legitimacy:

1. to enforce the sales contract between you and Gilmar, or with the intention of establishing an eventual business relationship with you (and therefore as relating to the implementation of pre-contractual measures), pursuant to Article 6, letter b) of the GDPR.

The data processing activities legitimised by this legal basis concern:

• providing answers to your requests for information about the products offered on the Website or about Gilmar’s business activities;

• your registration on the Website;

• the conclusion of the transaction, the delivery of products that you have purchased, providing answers to your requests for information about your purchases, the provision of after-sales services, the handling of requests for exchanges and/or returns and to process refunds;

2. to allow Gilmar to comply with the applicable legal obligations, pursuant to Article 6, letter c) of the GDPR.

The data processing activities legitimised by this legal basis concern:

• the retention of fiscal, accounting and administrative documentation and/or certifying the successful purchase transaction, containing your identification data;

3. to allow Gilmar to pursue its legitimate interests, in accordance with Article 6, letter f) of the GDPR, consisting of the protection of its rights, in carrying out e-commerce activities and in the adoption of computer security systems.

The data processing activities legitimised by this legal basis concern:

• the acquisition of personal information necessary to facilitate browsing and registration on the Website;

• the storage of personal identification data necessary for the conclusion of the purchase contract between you and Gilmar, as well as data relating to your purchase of Gilmar products on the Website;

• retention of your Website registration data

4. your consent to the processing of your personal data by Gilmar for marketing and/or profiling purposes, pursuant to Article 6, letter a) of the GDPR.

The data processing activities legitimised by this legal basis concern:

• the offer of promotions, discounts, rebates or other services, sending commercial or promotional information, newsletters, free products and invitations to events;

• market analysis and research activities;

• analysis of your purchases and of your interactions with the Website and sending commercial and promotional offers based on your personal interests and your buying habits

Gilmar shall process your personal data for marketing and profiling purposes, only after obtaining your specific consent to carry out such data processing activities. Your consent is optional and may be revoked at any time (in the manner described in the WITHDRAWAL OF CONSENT/OPPOSITION TO THE PROCESSING OF PERSONAL DATA section of this Privacy Policy). Without your consent, Gilmar shall not process your personal data for marketing and/or profiling purposes

SUBJECTS WHO HAVE ACCESS TO YOUR PERSONAL DATA

Gilmar limits access to personal data as much as possible, making such data available to its staff, duly authorised to access the data in order to carry out their professional duties.

Gilmar’s staff shall process the personal data within the limits and in compliance with the provisions entrusted to it by the same.

Your personal data may also be shared with companies affiliated with Gilmar and disclosed to independent subjects on which the latter relies to carry out its normal business activities.

These subjects shall process your personal data in a capacity of Data Processors, according to the instructions provided by Gilmar, as well as in a capacity of independent Data Controllers.

Gilmar provides to said subjects only the data strictly necessary to perform the agreed-upon services.

The suppliers of such services fall into the following categories:

• companies, consultants and IT service providers;

• couriers;

• companies and professionals that provide tax, accounting and administrative consultancy services;

• credit, digital and postal payment institutions;

• financial administration;

• communication agencies;

Gilmar may also disclose your personal data to its legal representatives and/or consultants, to enforce its general conditions of sale and/or legal regulations, to fulfil the requests of judicial and administrative authorities and/or to protect its rights in judicial, arbitration or similar legal proceedings, as well as for other reasons related to the protection of the rights and freedoms of others

DATA PROCESSING METHOD AND SCOPE OF CIRCULATION OF PERSONAL DATA

Gilmar processes personal data on paper and with the help of electronic and automated means, within the limits of the purposes set out in this Privacy Policy and taking the appropriate measures to maintain the confidentiality and privacy of said data.

Gilmar pays great attention to the protection and privacy of personal data and consequently does not engage in the dissemination and/or marketing of personal data.

In some cases, your personal data may be transferred outside the European Union. This transfer shall take place ensuring adequate protection levels for your personal data, including pursuant to the requirements set out in Articles 45 and 46 of the GDPR.

In particular, personal data shall be transferred outside the European Union to countries that provide an adequate level of data protection, as determined by the specific decisions of the European Commission.

In other cases, transfers of personal data outside the European Union, may take place where adequate assurances and safeguards for the protection of your personal data are issued by Gilmar’s suppliers or subcontractors and received by the latter. Such parties, in fact, are required to sign appropriate agreements that include the standard contractual clauses for the protection of personal data adopted by the European Commission.

Moreover, the legitimacy of the transfer of personal data in the United States is guaranteed by the adherence of Gilmar’s providers located in that territory to the “Privacy Shield” principles.

Additional information on the Privacy Shield (the agreement governing the transfer of data between the EU and the United States) is available by consulting the following links:

• Privacy Shield ;

• Information page on the Privacy Shield published by the Italian Authority for the Protection of Personal Data / Garante .

DATA RETENTION PERIOD

Your personal data shall be retained by Gilmar for a limited period of time, necessary to achieve the purposes of each data processing activity identified above. At the end of this period, your data shall be deleted or made anonymous.

Personal data processed in order to fulfil the commitments provided for by the contracts, including pre-contractual activities, shall be retained by Gilmar for a period of 10 years from the execution of the contractually provided service, or, in the case where the pre-contractual activities do not lead to the conclusion of a contract, the data provided by filling out the Contact Us form shall be retained for the time strictly necessary to respond to your requests and then deleted.

Personal data processed as part of the management and keeping of company accounts and for billing purposes shall be retained by Gilmar for the time necessary to fulfil the company’s tax and record keeping obligations, and no later than 10 fiscal years from the invoicing date.

Credentials for access to the private area of the Website shall be retained by Gilmar until such time that you request to close your account.

Data provided in the “my orders” and “my returns” sections shall be retained by Gilmar for the time needed to complete your requests and deleted once such requests have been fulfilled.

Within 24 months from the time data has been collected for delivery of our newsletter and fulfilment of marketing activities, Gilmar shall attempt to obtain new consent to pursue these activities, in the absence of which the data in question shall be deleted.

Personal data used for profiling purposes shall be deleted or made anonymous by Gilmar within 12 months from its receipt. After 12 months, Gilmar may continue to process your data only if you provide new consent to the processing of your data for profiling purposes.

CLOSING YOUR ACCOUNT - WITHDRAWAL OF CONSENT

To request to close your account, you can send an email to privacy@gilmar.it.

You may, at any time, object to the processing of your personal data by Gilmar for profiling purposes, for sending newsletters and for the fulfilment of any marketing activities, including sending promotional messages, invitations to events, discounts and free products.

You may revoke your consent to such data processing activities by sending an email to privacy@gilmar.it , or by following the instructions provided at the bottom of the newsletter or of promotional communications received from Gilmar.

Once your request has been received, we will make sure to immediately stop the processing of your personal data based on the consent that you have revoked. Other types of data processing, or data processing based on different conditions of legitimacy from the consent revoked, shall continue to be conducted as provided for in this Privacy Policy and in full compliance with applicable regulations.

The withdrawal of consent to the processing of your personal data for marketing and/or profiling purposes shall not affect the legitimacy of data processing carried out by Gilmar based on consent given before such withdrawal.

YOUR RIGHTS

You may contact Gilmar at any time, by sending an email to privacy@gilmar.it, requesting to receive the list of Data Processors (i.e. Gilmar's service providers entrusted to process your personal data on the basis of the instructions and guidelines provided by Gilmar).

Also by sending an email to privacy@gilmar.it you can request to exercise the rights provided for by the applicable legislation on the protection of confidentiality of personal data (pursuant to the provisions set out in Articles 15 to 22 of the GDPR), and in particular:

1. the right to obtain confirmation of whether your personal data is being processed or otherwise, to have access to your personal data processed by Gilmar, to know the purpose of such processing, the categories of data processed and the recipients or categories of recipients to whom your data have been or will be communicated or disclosed. You are also entitled to know the retention period of your personal data or, where this is not possible, the criteria used to determine this period.

2. the right to verify the accuracy and correctness of your personal data and its origin, to request the integration, updating, correction, deletion or anonymisation of your personal data, as well as the limitation of the processing of your data (pursuant to the cases provided for in Articles 17 and 18 of the GDPR);

3. submit a complaint to the Supervisory Authority (the Italian Authority for the Protection of Personal Data or Garante).

4. in case of transfer of your data to a third country, the right to be informed of the existence of adequate safeguards relating to such transfers, pursuant to Article 46 of the GDPR.

5. the right to oppose the processing of personal data, carried out by Gilmar on the basis of its legitimate interest, for reasons related to a particular situation, provided that no prevailing motives exist to allow Gilmar to continue with the data processing (e.g. the need to protect its rights in court);

6. the right to be informed of the existence of an automated decision-making process, including profiling, as referred to in Article 22, paragraphs 1 and 4 of the GDPR and, in such cases, to obtain meaningful information about the logic involved, as well as the significance and the expected consequences of such processing for the Data Subject.

7. the ability to exercise the right to portability of your personal data.

Once your request has been received, Gilmar shall process it as quickly as possible and with utmost seriousness, in order to allow you to exercise your rights, providing a reply without delay and, in any case, within one month from receiving the request. In cases of particular complexity, the timeframe for replying to your request may be extended to up to 2 months from receiving the request. In this case, Gilmar shall keep you informed on the status of the fulfilment of your request.

(last updated 15 June 2020)