Privacy disclosure to shareholders

PRIVACY DISCLOSURE TO SHAREHOLDERS
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 

Dear Shareholder,
regarding the processing of your personal data, we hereby submit to you the privacy disclosure which has been prepared by Buzzi S.p.A., with registered office in via Luigi Buzzi, 6 - 15033 Casale Monferrato (AL) - Italy (hereinafter referred to as “the Company”), according to the protection of your personal data in compliance with the relevant legislation.

I.    Data Controller, Data Protection Officer and useful contacts 

The Company processes your data and is considered as Data Controller for legal purposes. In this capacity it is responsible for ensuring the application of the organizational and technical measures which are necessary and adequate for the protection of your data. 
The Company has appointed the Data Protection Officer (DPO), who is responsible for ensuring compliance with the rules for the protection of your privacy and can be contacted, for any matter concerning the processing of your data, through the following dedicated email address: privacy@buzziunicem.it.

II.    Information on the procedures and the duration of personal data processing

Procedures and purpose of personal data processing
We inform you that the personal data which you provide, which are communicated by third parties or which are taken from public sources as well as those referring to third parties (for example, personal data of delegated persons or their substitutes) are processed in accordance with the current European and Italian legislation. The Company undertakes to process them according to the principles of fairness, lawfulness and transparency, in compliance with the purposes indicated below, by collecting them to the extent necessary and by making them accessible only to staff authorized and instructed for that purpose. Data are processed by traditional means, as well as IT or telematic tools. In particular, during the meeting, the data processing also could take place through the use of a registration system for the sole purpose of facilitating the writing of the minutes. Your personal data will be processed for the following purposes relating to the execution of the corporate contract: (i) keeping of the shareholders' register and related activities; (ii) accreditation and registration for attendance at meetings of the Company as well as registration and recording of the interventions and voting at the meeting; (iii) sending of corporate communications and documentation; (iv) payment of dividends; (v) possible exercise of the right of withdrawal or of any other right connected with the corporate relationship. The legal basis of the processing is the corporate contract, therefore, pursuant to current legislation, it is not necessary to obtain any specific consent for the processing of data.
In addition to the above-said purposes, the aforementioned data may be processed to fulfill the obligations established by the law, the regulations or the legislation of EU. In this case the legal basis is constituted by the law obligation and likewise it is not necessary to obtain any specific consent for the processing of data.

Period of retention of your data
The Company will keep your data until the conclusion of the corporate contract and then for a period not exceeding ten years (term beyond which the rights arising from the contract will be prescribed), as well as for the period established by law for administrative purposes as well as management purposes for any complaints/disputes in civil, administrative and/or criminal matters.

Communication and access to your data 
The Company may communicate your personal data to:
- Third parties (as an indication: financial institutions, professional offices, consultants, audit companies, etc.) that carry out activities on behalf of the Data Controller, in their capacity as processors, or as independent data controllers;
- judicial authorities, institutions and/or public authorities (Stock Exchange, Consob, etc.), as well as to those subjects who must be informed by law. These subjects will process data in their capacity as independent data controllers.
Your personal data will not be disseminated but only communicated in the cases described above and/or required by law.
Personal data will be transferred outside the European Union only if strictly necessary and, in any case, in the presence of a decision by the European Commission regarding the adequacy of the level of data protection applicable in the State of destination or on the basis of appropriate guarantees provided for in articles 46 and 47 of the Regulation.

III.    Your rights

With reference to the processed data, the Company guarantees you the right to:

• obtain the confirmation that your personal data exist or not as well as a copy of them in intelligible form;
• obtain the updating, rectification or integration of your data;
• request the erasure of your data, in the terms allowed by the regulations, or request that they are rendered anonymous;
• oppose, in whole or in part, for legitimate reasons, to the processing of your personal data;
• obtain the restriction or limitation of processing, in case of violation, request for rectification or objection;
• request the portability of electronically processed data, provided on the basis of a consent or a contract;
• withdraw the consent to the processing of your data, where applicable. 

We inform you that the Company undertakes to respond to your requests within one month, except in particularly complex cases, which could take up to two months. However, the Company will explain to you the reason for the waiting within one month from your request.
The outcome of your request will be provided in writing or electronically. If you request the rectification or the erasure of your personal data or the restriction of processing, the Company undertakes to communicate the results of your requests to each of the recipients of your data, unless this proves impossible or involves a disproportionate effort.
The withdrawal of the consent does not affect the lawfulness of the processing previously performed.
All these rights can be exercised by writing to the attention of the Data Protection Officer (DPO) at privacy@buzziunicem.it, or by registered letter with return receipt to the address of the Data Controller: Buzzi S.p.A., with registered offices and administrative headquarters in via Luigi Buzzi 6, 15033 Casale Monferrato (AL), Italy.

IV.    Modification and updating of the disclosure

The Company informs you that the disclosure text may be subject to changes and that, in any case, its constantly updated version is available on the Company's website www.buzziunicem.com in the privacy section.