INFORMATION PURSUANT TO ART. 13, D. LGS. n. 196/2003 AND ART. 13, REG. EU n. 2016/679 Pursuant to art. 13 of Legislative Decree 196/2003 (hereinafter the “Privacy Code”) and art. 13 of the EU Regulation n. 2016/679 (hereinafter “GDPR Regulation”), laying down provisions for the protection of persons and other subjects regarding the processing of personal data, we wish to inform you that the personal data you provide will be processed in compliance with the aforementioned legislation and confidentiality obligations to which our Company is bound. GF Aurora Srl. Provides some information regarding the processing of personal data provided by the user. It should be noted that, based on Article 4 of the GDPR Regulation, “processing” must be understood as: “any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction “. The personal data voluntarily provided by you to GF Aurora Srl. Upon registration, on the occasion of commercial relationships aimed at concluding contractual agreements and their execution, promotional activities or otherwise acquired in the context of our business, in compliance with the provisions legislative and contractual provisions in force, are subject to treatment based on principles of correctness, lawfulness and transparency, to protect your privacy and your rights, in compliance with the aforementioned legislation. Therefore, pursuant to art. 13 of the GDPR Regulation, we inform you as follows: DATA COLLECTION METHOD This site collects user data in two ways:

1. Data collected in an automated manner: while users are browsing, the following information may be collected, which are stored in the site’s server (hosting) log files:

– internet protocol address (IP); – type of browser; – parameters of the device used to connect to the site; – name of the internet service provider (ISP); – date and time of visit; – web page of origin of the visitor (referral) and exit; – possibly the number of clicks. These data are used for statistical and analytical purposes, in an exclusively aggregated form. The IP address is used exclusively for security purposes and is not crossed with any other data.

2. Data provided voluntarily: The site may collect other data in case of voluntary use of services by users, such as commenting, communication services (contact forms, comment boxes, request for quotation or information), and will be used exclusively for the provision of the requested service:

– name and surname; – email address; – telephone number. PURPOSE OF THE TREATMENT Your personal data will be processed for the following purposes:

1. institutional, connected or instrumental to the activity of GF Aurora Srl. Such as archiving, processing, invoicing, customer management;

2. to fulfill legal obligations related to civil, fiscal and accounting regulations, for the purposes of administrative management of the relationship you have established with GF Aurora Srl .;

3. to fulfill contractual obligations, technical support and technical information, after-sales assistance;

4. profiling, to satisfy market and statistical surveys relating to the products covered by the activity of GF Aurora Srl, also aimed at assessing the degree of user satisfaction (customer satisfaction);

5. direct marketing, for communication on future commercial initiatives, announcements of new products, services and offers from GF Aurora Srl. By sending advertising material and newsletters by e-mail and / or by post;

6. statistics, for the collection of data and information in an exclusively aggregated and anonymous form in order to verify the correct functioning of our website. None of this information is related to the natural or legal person user of the site and does not allow identification in any way; therefore, consent is not required;

7. security, for the collection of data and information in order to protect the security of the site (spam filters, firewalls, virus detection) and users and to prevent or unmask fraud or abuse to the detriment of the website. The data are recorded automatically and may possibly also include personal data (IP address) that could be used, in accordance with the laws in force on the subject, in order to block attempts to damage the site itself or to cause damage to other users, or in any case harmful activities. or constituting a crime. These data are never used for user identification or profiling and are periodically deleted; therefore, consent is not required;

8. ancillary activities, for communication to third parties who perform functions necessary or instrumental to the operation of the service and to allow third parties to carry out technical, logistical and other activities on our behalf. Suppliers have access only to personal data that are necessary to carry out their duties, undertake not to use the data for other purposes and are required to process personal data in accordance with current regulations.

SENSITIVE DATA (“PARTICULAR CATEGORIES OF DATA”, ART. 9 OF THE REGULATION) The sensitive / particular data that you may provide will be processed only for the operations necessary to fulfill the obligations, including pre-contractual ones, deriving from the supply relationship to the interested party of goods , performance or services, in accordance with the principle of relevance and non-excess of the data processed necessary to fulfill contractual obligations. Pursuant to art. 13 par. 1, lett. c) of the GDPR Regulation, it is recalled that the consent can be revoked at any time, without affecting the lawfulness of the processing based on the consent given before the revocation. LEGAL BASIS OF THE PROCESSING The processing of personal and sensitive / particular personal data provided by you is justified by the need to comply with the legal and tax obligations to which the Data Controller is subject, as well as the need to execute the contract of which you are a party, or the execution of pre-contractual measures adopted at your request. The provision of your personal data and any sensitive / particular data is necessary in order to be able to regularly fulfill the contractual and legal obligations connected to the commercial relationship you have established with GF Aurora Srl: in their absence, it is not possible for us to follow up on the contractual relationship. . The processing of data for direct marketing and profiling purposes is based on the consent of the interested party.

1. personal data are processed in such a way as to guarantee adequate security and confidentiality. To this end, the data are collected in our database and protected with suitable security measures to prevent unauthorized access or use of personal data and of the equipment used for processing;

2. any sensitive / particular data collected are stored in the computer systems of GF Aurora Srl, reducing the use of personal and identification data when the purposes pursued can be achieved through anonymous data and appropriate methods that allow the data subject to be identified only in case of necessity. Sensitive / particular data that are excessive or no longer necessary as they relate to the performance of evaluation activities that are now exhausted will not be subject to further and / or different use by the Data Controller;

3. in compliance with the aforementioned purposes and permitted by law, your personal data may be disclosed externally in the context of: associated, controlling and affiliated companies of GF Aurora Srl .; of the commercial partners of GF Aurora Srl. (manufacturing companies, suppliers, carriers and couriers, etc.); only as regards the personal data, of the companies that carry out surveys relating to the sphere of satisfaction of customers; given that GF Aurora Srl. operates internationally, the data in question may be transferred abroad, within the EU territory, for the execution of the contract concluded between you and GF Aurora Srl … These data are transferred with the help of appropriate guarantees for their protection.

TRANSFER OF DATA COLLECTED IN NON-EU COUNTRIES This website may share some of the data collected with services located outside the European Union area. In particular, with Google, Facebook and Microsoft (LinkedIn), through social plugins and the Google Analytics service. The transfer is authorized on the basis of specific decisions of the European Union and of the Guarantor for the protection of personal data, in particular, it is the decision 1250/2016 (Privacy Shield – https://www.garanteprivacy.it/web/guest/ home / docweb / – / docweb-display / docweb / 5306161), for which no further consent is required. The aforementioned companies guarantee their adherence to the Privacy Shield. DATA STORAGE PERIOD Personal, personal and sensitive / particular data, object of treatment on this site and in the execution of the contract, will be kept compatibly with the legal and fiscal obligations (for example national fiscal or anti-fraud laws, duration of the product warranty, etc.) that require the retention of data for a certain period of time. With reference to personal data subject to processing for direct marketing or profiling purposes, they will be kept in compliance with the principle of proportionality and in any case until the purposes of the processing have been pursued. In this regard, as required by art. 21 of the GDPR Regulation, the interested party may exercise the right to object at any time to the processing of personal data concerning him carried out for these purposes, including profiling. SECURITY MEASURES We treat visitor / user data in a lawful and correct manner, adopting appropriate security measures to prevent unauthorized access, disclosure, modification or unauthorized destruction of the data. We are committed to protecting the security of your personal data when they are sent, using special software. The processing is carried out using IT and / or telematic tools, with organizational methods and with logic strictly related to the purposes indicated. In addition to the Data Controller, in some cases, categories of employees involved in the organization of the site or external subjects (such as third party technical service providers, hosting providers) may have access to the data. COOKIES This site uses cookies, text files that are recorded on the user’s terminal or that allow access to information on the user’s terminal. Cookies allow information on visitor preferences to be stored, they are used in order to verify the correct functioning of the site and to improve its functionality, by customizing the content of the pages based on the type of browser used, or to simplify navigation by automating the procedures ( eg login, site language, etc.) and, finally, for the analysis of the use of the site by visitors. This site uses the following categories of cookies: they are used in order to verify the correct functioning of the site and to improve its functionality, by customizing the content of the pages based on the type of browser used, or to simplify navigation by automating the procedures (eg login, site language, etc.) and finally, for the analysis of the use of the site by visitors. This site uses the following categories of cookies: they are used in order to verify the correct functioning of the site and to improve its functionality, by customizing the content of the pages based on the type of browser used, or to simplify navigation by automating the procedures (eg login, site language, etc.) and finally, for the analysis of the use of the site by visitors. This site uses the following categories of cookies:

1. technical cookies: used for the sole purpose of transmitting an electronic communication, to ensure the correct display of the site and navigation within it. Furthermore, they allow to distinguish between the various connected users in order to provide a requested service to the right user (login), and for site security reasons. Some of these cookies are deleted when the browser is closed (session cookies), others have a longer duration (such as the cookie necessary to keep the user’s consent in relation to the use of cookies). Consent is not required for these cookies;

2. analysis cookies: used directly by the site operator to collect information, in aggregate form, on the number of users and how they visit the site. They are assimilated to technical cookies if the service is anonymized;

3. profiling and marketing cookies: used exclusively by third parties other than the owner of this site to collect information on user behavior while browsing, and on interests and consumption habits, also in order to provide personalized advertising.

By clicking “ACCEPT” on the banner present at the first access to the site, or by clicking on the X or browsing the site, the visitor expressly consents to the use of cookies and similar technologies, and in particular to the registration of these cookies on his terminal for the purposes indicated above, or access via cookies to information on your terminal. For more information and how to disable cookies, visit the following link: Extended information on cookies. (add link to extended cookie information) THIRD-PARTY COOKIES This site also acts as an intermediary for third-party cookies (such as buttons for social networks), used to provide additional services and features to visitors and to simplify the use of the site itself, or to provide personalized advertising. This site has no control over their cookies entirely managed by third parties and does not have access to the information collected through these cookies. Information on the use of these cookies and their purposes, as well as on how to disable them, are provided directly by the third parties on the pages indicated below. It is recalled that, generally, the tracking of users does not involve identification of the same, unless the user is already registered for the service and is not already logged in, in which case it is understood that the user has already given his consent. directly to the third party when registering for the relevant service (eg Facebook). This site uses cookies from the following third parties: – Google Inc. For information on the use of data and their processing by Google, it is recommended to read the privacy policy of Google and the methods of use of data by Google when using partner sites or apps. – Google Analytics Used to analyze the use of the site by users, compile reports on site activity and user behavior, check how often users visit the site, how the site is tracked and which pages are visited most frequently. The information is combined with information collected from other sites in order to create a comparative picture of the use of the site compared to other sites of the same category. Collected data: browser ID, date and time of interaction with the site, page of origin, IP address. Place of data processing: European Union – the anonymisation of the service being active. The data collected do not allow the personal identification of users, and are not crossed with other information relating to the same person. They are treated in aggregate form and anonymized (truncated to the last octet). On the basis of a specific agreement (DPA), Google Inc. (data controller) is prohibited from crossing such data with those obtained from other services. Further information on Google Analytics cookies can be found on the Google Analytics Cookie Usage on Websites page. The user can selectively disable (opt-out) the collection of data by Google Analytics by installing the specific component provided by Google on their browser (opt out). – Adobe Analytics For information on the use of data and their processing by Adobe Analytics, it is recommended to read the privacy policy and how to disable it (opt-out). To view the extended information on cookies, also with reference to third parties, use the following link (add link to extended cookie information) PLUGIN SOCIAL NETWORK This site also incorporates plugins and / or buttons in order to allow easy sharing of contents on your favorite social networks. When the user visits a page of our website that contains a plugin, his browser connects directly to the servers of the social network from which the plugin is loaded, which server can track his visit to the site and, if necessary, associate it with your social network account, in particular, if the user is logged in at the time of the visit or if he or she recently browsed one of the websites containing social plugins. If you do not want the social network to record the data relating to your visit to this website, you must log out of your social network account and, if necessary, delete the cookies that the social network has installed in the browser used. Plugins with advanced user privacy protection functions are installed on this site, which do not send cookies or access cookies on the user’s browser when the page is opened but only after clicking on the plugin. The collection and use of information by these third parties are governed by their respective privacy policies, to which please refer: – Facebook (cookie information link) – Twitter (cookie information link) – Google+ (cookie information link). RIGHTS OF THE INTERESTED PARTY The interested party has the rights referred to in art. 7 of the Privacy Code and art. 15 (right of access) of EU Regulation no. 2016/679, or the rights of:

1. obtain confirmation of the existence or not of personal data concerning him, even if not yet registered, and their communication in an intelligible form;

2. obtain the indication: a) of the origin of the personal data; b) the purposes and methods of the processing; c) of the logic applied in case of treatment carried out with the aid of electronic instruments; d) the identity of the owner, manager and the representative appointed pursuant to art. 5, paragraph 2, of the Privacy Code and art. 3, paragraph 1 of the GDPR; e) the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as appointed representative in the State, managers or agents;

3. obtain: a) updating, rectification or, when interested, integration of data; b) the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including data which need not be kept for the purposes for which the data were collected or subsequently processed; c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment is proves impossible or involves the use of means that are manifestly disproportionate to the protected right;

4. object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning him, even if pertinent to the purpose of the collection; b) to the processing of personal data concerning him for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communications;

5. the right to lodge a complaint with the Supervisory Authority for any matter relating to the aforementioned data processing.

Furthermore, pursuant to art. from 16 to 22 of EU Regulation no. 2016/679, the interested party may exercise:

1. the right of rectification (Article 16);

2. the right to be forgotten (cancellation art. 17);

III. the right to limit the processing (Article 18);

1. the right to obtain from the Data Controller the notification to the recipients to whom the data have been transmitted of any corrections or cancellations or limitations of processing (Article 19);

2. the right to portability (Article 20);

3. the right to object (Article 21);

VII. the right to refuse the automated process (Article 22). In this way, you are allowed to access your data to:

1. a) verify its truthfulness;

2. b) modify them if they become inaccurate;

3. c) integrate them also with a supplementary declaration;

4. d) request cancellation.

The interested party may revoke the consent expressed in relation to the distinct purposes indicated above at any time, except for the impossibility of continuing commercial relations as indicated and without prejudice to the processing of the data previously acquired for the fulfillment of fiscal obligations dependent on the concluded contracts. The interested party may exercise the rights reserved to him at any time, by contacting the following contacts: E-mail: gfaurora@pec.it; DATA CONTROLLER The data controller is: GF Aurora Srl, in the person of its pro tempore legal representative Mondanaro Luisa, with registered office in Via Console Cesario 3 80132 napoli; E-mail: gfaurora@pec.it Last update: 09.06.2021