Information pursuant to the former art. 13 of Regulation (EU) No. 2016/679

(“GDPR”)

---

Medicalchannel s.r.l. safeguards the confidentiality of personal data and ensures their necessary protection from any event that may put them at risk of violation. As provided by European Union Regulation No. 2016/679 ("GDPR"), specifically in its Article 13, the following information is provided to the user ("Data Subject") regarding the processing of their personal data.

Who we are and what data we process (former art. 13, 1st paragraph letter a, art. 15, letter b GDPR)

Medicalchannel s.r.l. does not require the Data Subject to provide "special" data, as defined in Article 9 of the GDPR. Special data includes personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, as well as genetic data, biometric data intended to uniquely identify an individual, and data related to health or the sexual life or sexual orientation of the individual.In the event that the requested service from Medicalchannel s.r.l. necessitates the processing of such special data, the Data Subject will receive specific information and will be asked to provide explicit consent. For any inquiries or requests, the Data Subject can contact the Data Controller using the following contact details:

• Medicalchannel s.r.l.
• Via San Savino 17/D – 40128 – Bologna
• Email: [email protected]

For how long are the Data Subject's data retained (art. 13, 2nd paragraph, letter a GDPR)

Unless explicitly expressing the desire to remove them, the personal data of the Data Subject will be kept for as long as necessary for the legitimate purposes for which they were collected. In the case of data provided to the Data Controller for the purposes of commercial promotion for services different from those already acquired by the Data Subject, for which they initially provided consent, they will be retained for 24 months, unless the consent is revoked. In the case of data provided to the Data Controller for profiling purposes, they will be retained for 12 months, subject to the revocation of the provided consent. It should be noted that if a user submits personal data to Medicalchannel s.r.l. that are not requested or not necessary for the execution of the requested service or the provision of a service closely related to it, Medicalchannel s.r.l. cannot be considered the owner of this data and will proceed to their deletion as soon as possible.

Regardless of the Data Subject's decision to remove them, personal data will be kept in any case according to the terms provided by current regulations and/or national regulations, exclusively to ensure specific obligations inherent to certain services. Additionally, personal data will be kept in any case to fulfill obligations (e.g., tax and accounting) that persist even after the termination of the contract (Article 2220 of the Civil Code); for these purposes, the Data Controller will retain only the data necessary for their pursuit. Exceptions are made in cases where rights arising from the contract and/or registration are asserted in court, in which case the Data Subject's personal data, only those necessary for such purposes, will be processed for the time strictly necessary for their pursuit.

Information for Customers, Potential Customers, and Suppliers (former Articles 13-14 EU Regulation 2016/679)

Medicalchannel s.r.l., as the Data Controller of your personal data, in accordance with EU Regulation 2016/679, hereafter 'GDPR,' hereby informs you that the aforementioned regulation ensures the protection of data subjects concerning the processing of personal data. This processing will adhere to the principles of fairness, lawfulness, transparency, and the protection of your privacy and rights.

Your personal data will be processed in accordance with the legislative provisions of the above-mentioned regulation and the confidentiality obligations provided therein.

Purposes of Data Processing (Article 13, 1st paragraph GDPR)

In particular, your data will be processed for the following purposes related to the fulfillment of legislative or contractual obligations:

• Mandatory legal obligations in the tax and accounting fields
• Post-service delivery assistance
• Litigation management
• Customer management
• Quality management
• Activity planning
• Customer satisfaction assessment
• Customer billing history
• Management of relationships during sales operations
• Supplier management
• Compliance with obligations under current laws
• Order history for supplies

The processing of data necessary for the fulfillment of these obligations is necessary for the proper management of the relationship, and their provision is mandatory to achieve the above-mentioned purposes. The Data Controller also informs that the non-disclosure or incorrect disclosure of any mandatory information may result in the inability of the Data Controller to guarantee the adequacy of the processing itself.

Your personal data may also, with your consent, be used for the following purposes:

• Sending commercial information via email
• Offering services or tools via telephone
• Providing information about our potential promotional activities
• Entrusting third parties with processing operations
• Electronic data processing
• Manual processing through paper archives

The provision of data for these purposes is optional, and your refusal to process will not compromise the continuation of the relationship or the adequacy of the processing itself.

(Considering 47 GDPR) The data controller, even without the explicit consent of the Data Subject, may use the contact details provided by the Data Subject for the direct sale of its Services, limited to cases where they concern Services similar to those subject to the sale, unless the Data Subject explicitly objects.

The personal data of the Data Subject may be processed, with consent, for commercial promotion purposes, market research, and analysis of services offered by the Data Controller, different from those purchased by the Data Subject. Such processing can be carried out through automated means, email, SMS, and telephone contact and may occur:

1. If the Data Subject has not revoked their consent to the use of data
2. In the case of telephone contact, if the Data Subject has not registered with the opposition register as per DPR No. 178/2010

The legal basis for such processing is the consent given by the Data Subject prior to the processing, which can be freely revoked at any time.

The Data Controller, in line with the provisions of Considering 49 of the GDPR, processes, also through its suppliers (third parties and/or recipients), the personal data of the Data Subject related to traffic to the extent strictly necessary and proportionate to ensure the security of networks and information. This involves the ability of a network or information system to withstand, at a certain security level, unforeseen events or malicious or illicit acts that compromise the availability, authenticity, integrity, and confidentiality of the stored or transmitted personal data. The Data Controller will promptly inform the Data Subjects if there is a particular risk of a violation of their data, subject to obligations arising from Article 33 of the GDPR regarding notifications of personal data breaches. The legal basis for such processing is compliance with legal obligations and the legitimate interest of the Data Controller in carrying out processing related to the protection of corporate assets and the security of the locations and systems of the Suppliers connected to Medicalchannel s.r.l..

The personal data of the Data Subject may also be processed for profiling purposes (such as data analysis and the chosen Services, proposing advertising messages and/or commercial offers in line with the choices expressed by the users themselves) only if the Data Subject has provided explicit and informed consent. The legal basis for such processing is the consent given by the Data Subject prior to the processing, which can be freely revoked at any time.

The personal data of the Data Subject, excluding special (Article 9 GDPR) or judicial (Article 10 GDPR) data, will be processed to allow checks for monitoring and prevention of fraudulent payments by software systems that perform automated verification prior to the negotiation of Services; failure to pass these checks with a negative outcome will result in the impossibility of completing the transaction. The Data Subject may, in any case, express their opinion, obtain an explanation, or contest the decision by stating their reasons by contacting [email protected]. Personal data collected for the sole purpose of anti-fraud checks, unlike data necessary for the correct execution of the requested service, will be immediately deleted at the end of the control phases.

The Services offered by the Data Controller are reserved for legal entities, legally capable, based on the national reference legislation, to conclude contractual obligations. The Data Controller, in order to prevent unauthorized access to its services, implements preventive measures to protect its legitimate interest, such as checking the tax code and/or other verifications when necessary for specific Services, the correctness of the identification data on identity documents issued by competent authorities.

Data Processing Methods (Article 32 GDPR)

Your personal data may be processed in the following ways:

• Entrusting third parties with processing operations
• Creation of profiles related to customers, suppliers, or consumers
• Processing via electronic computers
• Manual processing through paper archives
• Processing of data collected from third parties
• Data collection via phone
• Data collection via computer or telematics
• Processing through satellite platforms of Medicalchannel s.r.l. or connected to it

Each processing is carried out in compliance with the methods specified in Articles 6 and 32 of the GDPR and by adopting adequate security measures.

Data Communication (Article 13, 1st paragraph GDPR)

Your data will be communicated exclusively to competent and duly appointed subjects for the performance of services necessary for the correct management of the relationship, with a guarantee of the protection of the rights of the data subject.

Your data will be processed only by personnel expressly authorized by the Data Controller and, in particular, by the following categories of employees:

• Marketing office
• Administration office

Your data may be communicated to third parties duly appointed as Data Processors, in particular to:

• Consultants and freelance professionals, even in association
• Banks and credit institutions
• Non-banking financial intermediaries
• Within public and/or private subjects for whom data communication is mandatory or necessary in compliance with legal obligations or functional to the administration of the relationship

Data Disclosure (Article 13, 1st paragraph GDPR)

Your personal data will not be disclosed in any way.

Data Retention Period (Article 13, 2nd paragraph, letter a GDPR)

We inform you that, in compliance with the principles of lawfulness, purpose limitation, and data minimization, under Article 5 of the GDPR, the retention period of your personal data is:

• Established for a period not exceeding the achievement of the purposes for which they are collected and processed for the execution and performance of contractual purposes
• Established for a period not exceeding the performance of the services provided
• Established for a period not exceeding the achievement of the purposes for which they are collected and processed and in compliance with the mandatory times prescribed by law

Cookie Management

In case of doubts or concerns regarding the use of cookies, you can always intervene to prevent their setting and reading, for example, by changing the privacy settings within your browser to block certain types.

Since each browser - and often different versions of the same browser - differs significantly from others, if you prefer to act independently through your browser preferences, you can find detailed information on the necessary procedure in your browser's guide. For an overview of how to act for the most common browsers, you can visit http://www.cookiepedia.co.uk.

Advertising companies also allow you to opt-out of receiving targeted ads if you wish. This does not prevent the setting of cookies but interrupts the use and collection of some data by such companies. For more information and the possibility of opting out, visit http://www.youronlinechoices.eu/.

More information is available in our Cookie Policy.

The data controller, according to the Law, is:

• Medicalchannel s.r.l.
• Via San Savino 17/D – 40128 – Bologna
• Email: [email protected]

You have the right to obtain from the controller the erasure (right to be forgotten), the limitation, the updating, the rectification, the portability, the opposition to the processing of personal data concerning you, and, in general, you can exercise all the rights provided by Articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR.

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 - Rights of the Data Subject

1. The data subject has the right to obtain confirmation of the existence or not of personal data concerning them, even if not yet recorded, and their communication in an intelligible form.
2. The data subject has the right to obtain the indication:
   1. of the origin of personal data;
   2. of the purposes and methods of the processing;
   3. of the logic applied in case of processing carried out with the aid of electronic instruments;
   4. of the identifying details of the controller, the processors, and the designated representative under Article 5, paragraph 2;
   5. of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it as designated representative in the territory of the State, processors or persons in charge.
3. The data subject has the right to obtain:
   1. the updating, rectification, or, when interested, integration of data;
   2. the erasure, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
   3. certification that the operations referred to in letters a) and b) have been brought to the attention, including as regards their content, to those to whom the data have been communicated or disseminated, except in the case where such fulfillment is impossible or involves a use of means manifestly disproportionate to the protected right;
   4. data portability.
4. The data subject has the right to object, in whole or in part:
   1. for legitimate reasons to the processing of personal data concerning them, even if pertinent to the purpose of the collection;
   2. to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication.