INFORMATION NOTICE REGARDING THE PROCESSING OF ALBEN APP USERS’ PERSONAL DATA

IN ACCORDANCE WITH ARTICLE 13 OF THE EU REGULATION 2016/679 (GDPR)

DATA CONTROLLER

ESA S.p.A.

Address: Via delle Canovine 2/4 - 24126 Bergamo (BG)

Tel. no.:

+39 0356227411

E-mail address: esa_privacy@esacombustion.it

(“Company” or “Data Controller”).

PERSONAL DATA PROCESSED

The Company provides users, as data subjects concerned with the processing, with information regarding the

processing of their personal data collected following registration to the Alben App (hereinafter, the “App”) and

its related use.

Specifically, the personal data collected and processed through the App are the following common data:

• personal details, such as first name and last name,

• contact information, such as email address;

• user-related data, such as username and password;

• other common data, such as company name and country.

The personal data listed above are hereinafter referred to as "Personal Data".

DATA PROCESSING

PURPOSES

LEGAL BASIS FOR

PROCESSING DATA

DATA RETENTION

PERIOD

To allow users to register for the App by

creating accounts and use the App to

control burners and check their

parameters.

Performance of a contract (art. 6, par. 1,

letter b) of the GDPR).

In the case of representatives of legal

entity clients, the legitimate interests of

the controller (Art. 6, letter f) of the

GDPR).

The collected Personal Data will be stored

until a deletion request is made by the

user.

However, in the event of user inactivity

for a period of 2 years, the Personal Data

collected through the App and the user's

profile will be deleted, with prior notice to

the user 30 days before deletion, unless

the user accesses their reserved area

within the specified time frame.

Additionally, the user can request deletion

at any time through the App or by directly

contacting ESA at the addresses provided

in this information notice.

To send technical material to the user. Performance of a contract (art. 6, par. 1,

letter b) of the GDPR).

The collected Personal Data will be stored

until a deletion request is made by the

user.

However, in the event of user inactivity

for a period of 2 years, the Personal Data

collected through the App and the user's

profile will be deleted, with prior notice to

the user 30 days before deletion, unless

the user accesses their reserved area

within the specified time frame.

Additionally, the user can request deletion

at any time through the App or by directly

contacting ESA at the addresses provided

in this information notice.

To provide support regarding the ESA

products

Performance of a contract (art. 6, par. 1,

letter b) of the GDPR).

The collected Personal Data will be stored

until a deletion request is made by the

user.

However, in the event of user inactivity

for a period of 2 years, the Personal Data

collected through the App and the user's

profile will be deleted, with prior notice to

the user 30 days before deletion, unless

the user accesses their reserved area

within the specified time frame.

Additionally, the user can request deletion

at any time through the App or by directly

contacting ESA at the addresses provided

in this information notice.

Marketing purposes (sending

business/promotional communication)

via automatic contact methods (e.g. e-

mail) on offers, discounts, promotions,

and updates on the Company's products

and/or services (so-called “direct

marketing”).

Consent, which is optional and can be

withdrawn at any time (art. 6, par. 1,

letter a) of the GDPR).

Persona Data are retained for 12 months

from collection or until a request for

consent withdrawal is made by the user.

If necessary to ascertain, exercise and/or

safeguard Company rights in legal

proceedings.

Legitimate interests (art. 6, par. 1, letter

f) of the GDPR)

For the duration of any legal disputes until

completion of the terms of

implementation outlined in legal

remedies.

Once the aforementioned retention period has lapsed the Personal Data will be destroyed compatibly with the technical erasure

and backup procedures and with the accountability requirements of the Data Controller.

DATA PROVISION

Personal Data must be provided to use the App and to respond to the user's requests. It is

understood that the provision of Personal Data for processing purposes based on the data

subject's consent is optional. Refusing to provide consent means the Company will not process

the Personal Data for that purpose.

PARTIES AUTHORISED TO PROCESS DATA

Personal Data may be processed by employees in Company departments that are responsible for

carrying out the activities outlined above and have been authorised to process the Data and have

received suitable operating instructions according to articles 29 of the GDPR and 2-quaterdecies

of D.Lgs. 196/2003 as amended and adapted to the GDPR by D.Lgs. 101/2018.

DATA RECIPIENTS

Personal Data may be communicated to parties operating as data controllers, such as supervisory

bodies and authorities, and private or public organisations in general authorised to request

Personal Data. Personal Data may be also processed, on behalf of the Company, by third parties

designated as data processors who have been provided with proper operating instructions and

who provide the Company with services instrumental to the purposes indicated in this privacy

notice.

PERSONAL DATA TRANSFERS OUTSIDE THE EU

No transfers of Personal Data outside the European Union are foreseen.

In case Personal Data are transferred to countries outside the European Union (EU) or the

European Economic Area (EEA) that have not been considered adequate by the European

Commission, the transfer mechanisms set forth in Article 46 of the GDPR (such as standard

contractual clauses) will be used, considering whether "additional measures" are provided to

ensure a level of protection substantially equivalent to that required by EU law.

DATA SUBJECTS’ RIGHTS - COMPLAINT TO THE SUPERVISORY BODY

By contacting the Data Controller via e-mail sent to esa_privacy@esacombustion.it data subjects

can ask the Company for access to Personal Data, or the correction or deletion of Personal Data,

and also have the right to restrict processing

of the Personal Data in the cases set out in article

18 of the GDPR.

Data subjects have the right to withdraw their consent at any time by contacting the Company

or by accessing the designated area of the App and clicking the "withdraw" button. Such

withdrawal will not affect the lawfulness of processing based on consent given prior to its

withdrawal.

Data subjects have the right to object, according to article 21 of the GDPR, easily and free of

charge, for reasons related to their particular situation in cases of processing based on legitimate

interest or consent given for so-called “direct marketing” by contacting the Company.

Data subjects, in cases where processing is based on consent or contract and is carried out by

automated means, can exercise the right to data portability under article 20 of the GDPR. This

means they have the right to receive the Personal Data in a structured, commonly used and

machine-readable format, and to transmit the Personal Data to another data controller without

obstruction.

Data subjects have the right to lodge a complaint with the competent Supervisory Authority in

the member state where they are resident or where they work, or the member state where the

alleged breach took place.