Privacy Notice regarding the processing of personal data on the website

Nero Lifestyle Srl, with registered office in Milan, Piazza Castello n.26 – 20122, CF and VAT number 01378080111, as data controller (hereinafter, "Data Controller"), informs you pursuant to EU Regulation 2016/679 ("GDPR") and current national legislation on the protection of personal data that your data will be processed in the manner and for the following purposes:

1. Object of the processing

The Data Controller processes the personal identification and non-particular data (hereinafter "Data" or "Personal Data") communicated by you when browsing the Data Controller's website https://www.nerolifestyle.com/ (hereinafter referred to as the "Site") and, in particular:

• email address and any other data that may be provided when requesting information sent to the Data Controller;
• name, surname, address, email address, telephone number, place and data of birth, tax code, data on the educational and professional background and any other data that may be contained in the CV provided at the time of the application sent to the Data Controller;
• browsing data such as IP addresses or domain names of the computers used by users who connect to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's computer environment. This information is collected through the cookies described in the website's Cookie Policy, below, to which reference is made.

2. Purposes and legal bases of the processing

Your Data are processed, without your prior consent, for the following purposes and legal bases:

• the execution of the contract and/or pre-contractual commitments:

- managing a contact request from you;

- using the website;

- providing adequate technical assistance;

- correctly carrying out the personnel selection process (e.g., managing applications).

• the pursuit of a legitimate interest of the Data Controller:

- to manage and maintain the Website;

- to carry out statistics – carried out by means of the analytical cookies described in the Cookie Policy of the website, below, to which reference is made – aimed at optimising and improving navigation on the website without identifying the user;

- to prevent or discover fraudulent activities or abuses harmful to the Website;

- to exercise the rights of the Data Controller, for example, the right of defense in court.

• the fulfilment of legal obligations:

- comply with the obligations provided for by laws, regulations, EU legislation, orders and prescriptions of the competent authorities.

3. Processing methods

The processing of your Data is carried out – by electronic means – by means of the operations of collection, recording, updating, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, cancellation and destruction of the Data.

4. Data retention

The Data Controller processes the Data for the time necessary to fulfil the above purposes and in any case, without prejudice to the statutory limitation periods, for no longer than 5 years for all the processing indicated in point 2, excluding those of:

• correctly carry out the selection process of personnel for which the data is stored for 1 year from the collection of the CV;
• carry out statistics using analytical cookies, processing for which the data retention time is indicated in the Cookie Policy of the website, below, to which reference is made.

5. Provision of Data

The provision of Data for the purposes mentioned above is optional. Refusal to provide such Data will make it impossible to proceed with the processing indicated in point 2.

6. Access to Data

Your Data may be accessed for the purposes set out above:

• employees and/or collaborators of the Data Controller, in their capacity as persons authorized and/or system administrators;
• Group companies or third parties (e.g., IT service providers, suppliers, credit institutions, professional firms, etc.) who carry out outsourced activities on behalf of the Data Controller, in their capacity as data controllers.

7. Communication of Data

Your Data may be communicated, even without your consent, for the purposes referred to above to control bodies, law enforcement agencies or the judiciary that will process them, at their express request, as independent data controllers for institutional purposes and/or by law during investigations and controls. Your Data may also be communicated to third parties (e.g., partners, freelancers, agents, etc.), as independent data controllers, for the performance of activities instrumental to the purposes mentioned above.

T8. ransfer of data

Your Data will not be transferred to non-EU countries.

9. Rights of the data subject

The Data Controller The information that, as a data subject, if the limitations provided for by law are not met, has the right to:

• obtain confirmation of the existence or otherwise of your personal data, even if not yet recorded, and that such data are made available to you in intelligible form;
• obtain information and, where appropriate, a copy of: a) the origin and category of the personal data; b) the logic applied in the case of processing carried out with the aid of electronic tools; c) the purposes and methods of processing; d) the identification details of the data controller and data processors; e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them, in particular if recipients of third countries or international organisations; (e) where possible, the data retention period or the criteria used to determine that period; f) the existence of an automated decision-making process, including profiling, and if so, the logic used, the importance and the expected consequences for the data subject; g) the existence of adequate guarantees in the event of data transfer to a non-EU country or to an international organisation;
• obtain, without undue delay, the updating and correction of inaccurate data or, when interested, the integration of incomplete data;
• obtain the cancellation, transformation into anonymous form or blocking of data: a) unlawfully processed; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) if you withdraw the consent on which the processing is based and if there is no other legal basis, d) if you have objected to the processing and there is no overriding valid reason to continue the processing; e) in the event of compliance with a legal obligation; f) in the case of data relating to minors. The Data Controller may refuse erasure only in the case of: a) exercising the right to freedom of expression and information; b) compliance with a legal obligation, performance of a task carried out in the public interest or exercise of official authority; c) reasons of public health interest; (d) archiving in the public interest, scientific or historical research or for statistical purposes; e) exercise of a right in court;
• obtain the limitation of processing in the event of: a) contesting the accuracy of the personal data; b) unlawful processing by the Data Controller to prevent its cancellation; c) exercise of your right in court; d) verification of whether the legitimate reasons of the Data Controller prevail over those of the data subject;
• receive, if the processing is carried out by automatic means, without hindrance and in a structured, commonly used and readable format, the personal data concerning you in order to transmit them to another data controller or – if technically feasible – to obtain direct transmission by the Data Controller to another data controller;
• object, in whole or in part: a) for legitimate reasons related to your particular situation to the processing of personal data concerning you; b) the processing of personal data concerning the use of personal data for the purpose of sending advertising material or direct sales or for the performance of market research or commercial communication, through the use of automated call systems without the intervention of an operator by email and/or through traditional marketing methods by telephone and/or paper mail;
• lodge a complaint with the Data Protection Authority.

In the above cases, where necessary, the Data Controller will inform the third parties to whom your personal data are communicated of any exercise of the rights by you, except in specific cases (e.g. when this fulfilment proves impossible or involves the use of means manifestly disproportionate to the protected right).

10. Methods of exercising rights

You may exercise these rights at any time:

• by sending a registered letter to the Data Controller's address;
• by sending an email to privacy@blastness.com;

11. Data Controller and Data Processor

The data controller is Nero Lifestyle Srl, with registered office in Milan, Piazza Castella n.26 – 20122, CF and VAT number 01378080111

12. Data Protection Officer

The Data Controller has also appointed a Personal Data Protection Officer (DPO), a specialist in the field, who will monitor the methods adopted to protect your personal data and who will be a point of contact for any of your requests or concerns about the processing of personal data. To contact the DPO, you can write to dpo@blastness.com.