INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF THE EU REGULATION 2016/679

Dear Dr,

in compliance with the obligations set out in the EU Regulation 2016/679 on the processing of personal data (hereinafter "GDPR"), Univet S.r.l. intends to provide you with information about the processing of their personal data.

1. Data Controller and Processor of the processing of personal data

The Company UNIVET S.R.L., with registered office in Bergamo, Via Giuseppe Verdi 11 (hereinafter also "UNIVET" or "Company") is the Data Controller of the processing of personal data supplied by you.

Dr. Alessandro Ceriani is the Processor of the processing of your personal data.

UNIVET keeps an updated list of the people in charge of processing personal data at UNIVET’s headquarters.

2. Personal data processed

In order to provide the requested products or services, UNIVET may request and use some of your personal data (for example, when sending purchase orders, when contacting our customer care service, when requesting communications, when creating an account on our site www.univet.it, or when interacting with our site). This personal data includes:

- Contact details including name, surname, e-mail, telephone number, address;

- Login and account information, password and unique user ID;

- Personal data including gender, hometown, date of birth;

- Information on payment methods, bank details and billing address;

- Contractual data;

- Images;

- Health related data (e.g. eye prescriptions);

- Personal preferences (e.g. for marketing and cookies).

UNIVET automatically collects your data when you interact with UNIVET’s site. These so-called navigation data include: the IP addresses or the domain names of the computers used by the users connecting to the site, the addresses in the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and to the user's computer environment.

3. Purposes of processing personal data

The purposes of processing personal data are the following:

1) Preliminary activities to the potential conclusion of a contract;

2) Stipulation and performance of a contract;

3) Production of personalized lenses;

4) Marketing of workplace protection tools;

5) Operational, management and accounting requirements;

6) Give feedback to the contacts collected during the participation in events, conferences and fairs;

7) Fulfillment of legal obligations;

8) Loyalty card management;

9) Warranty extension management;

10) Commercial purposes, advertising, marketing (for example interaction with Social Network: to interact with the social network functions through the pages of the Site; and integration of external content: to view and interact with any content hosted on third party sites and integrated into the site);

11) Statistics and analysis (for example to conduct analysis and research, including profiling, to improve services and products and commercial proposals);

4. Legal bases for the processing

The legal basis of the processing for the purposes referred to in the numbers 1 to 5 of the preceding paragraph is the performance of the contract and of pre-contractual measures taken at your request

(art. 6, co. 1, lett. b, GDPR).

The legal basis of the processing for the purpose referred to in the number 6 of the preceding paragraph is the UNIVET’s legitimate interest (art. 6, co. 1, lett. f, GDPR).

The legal basis of the processing for the purpose referred to in the number 7 of the preceding paragraph is the fulfillment of legal obligations (art. 6, co. 1, lett. c, GDPR).

The legal basis of the processing for the purpose referred to in the numbers 8 and 9 of the preceding paragraph is the performance of the contract and the user's consent (art. 6, co. 1, lett. a), b), GDPR).

The legal basis of the processing for the purpose referred to in the numbers 10 and 11 of the preceding paragraph is the UNIVET’s legitimate interest (art. 6, co. 1, lett. f, GDPR) and the user’s consent (art. 6, co. 1, lett. a, GDPR).

If the requested supply relates to eyeglasses with corrective lenses, it is necessary that you provide UNIVET with the personal data contained within the prescription. Being personal data belonging to a particular category of data pursuant to art. 9 GDPR, the processing is permitted by virtue of the consent you have provided.

5. Provision of personal data

The provision of personal data, including those relating to health, for the purposes indicated in paragraphs 1 to 7 of paragraph n. 3, is:

- mandatory to fulfill the obligations established by law;

- necessary for the correct establishment and continuation of contractual relations with you.

Any refusal to provide the above data could make it impossible to execute the contract, as well as to supply the product or provide the requested service.

The conferment for other purposes is optional, but failure to provide it would make it impossible to perform some fundamental activities for UNIVET.

It is always possible to deny the possibility of processing personal data already provided for the purposes indicated in paragraphs 8 to 11 of paragraph n. 3.

6. Modalities of processing personal data

The processing of personal data may consist specifically in collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, alignment or combination, restriction, erasure or destruction. UNIVET will process personal data both with the use of paper support and with the aid of electronic IT and telematics tools both with automated methods.

7. Communication of personal data

The communication of personal data outside of UNIVET, collected for the purposes referred to in paragraph n. 3, can only take place if:

- This communication is mandatory to fulfill an obligation established by law or regulation;

- This communication is necessary for the execution of the requested service.

Therefore, personal data are accessible for the purposes indicated in paragraph n. 3 to:

a) Employees and collaborators of the Data Controller, in their capacity as assignees and / or internal Processor;

b) Third party companies or other entities that carry out outsourcing activities on behalf of the Data Controller.

In particular, the data may be communicated to the following categories of subjects: other companies of the UNIVET group such as ULC that deals with production, manufacturers of xray lenses, web site providers, commercial network, marketing network, banking institutions and companies specialized in management of payments, law firms and consultancy, subjects in charge of auditing the financial statements of our company, public authorities and administrations for legal obligations, Italian and foreign suppliers, management and production companies for marketing and advertising, agencies for the marketing of products.

Your personal data will not be disseminated.

8. Transfer of personal data abroad

For the sole purpose of the performance of the contract, UNIVET may communicate personal data from the user to third parties (for example companies belonging to the UNIVET group, suppliers, etc.) located in European Union countries.

Also for the purposes of the contract, UNIVET may communicate the user's personal data to third parties located in non-EU countries based on adequacy decisions, appropriate safeguards and in any case based on the consent requested where necessary.

Communication can be essential for the execution of the contract.

9. Data subjects' rights

Pursuant to articles 13, 15, 16, 17, 18, 20, 21 GDPR, the user has the right to:

a) obtain from UNIVET the confirmation that it is or is not underway the processing of personal data concerning him and, in this case, to obtain access to personal data and the following information: (i) the purposes of the processing; (ii) the categories of personal data in question; (iii) the recipients to whom the personal data have been or will be communicated, in particular if recipients of Third Countries or international organizations; iv) whenever it is possible, the retention period of the personal data provided or, if it is not possible, the criteria used to determine this period; (v) the existence of the right to request to UNIVET the rectification or cancellation of personal data or the limitation of the processing of personal data concerning him or to object to their processing; (vi) the right to lodge a complaint with the supervisory authority; (vii) if the data are not collected from the data subject, all information available on their origin; (viii) the existence of an automated decision-making process, including profiling;

b) obtain from UNIVET the correction of inaccurate personal data concerning him without undue delay and the integration of incomplete personal data;

c) obtain from UNIVET the cancellation of personal data concerning him without undue delay if one of the reasons indicated in art. 17 GDPR;

d) obtain from UNIVET the limitation of the processing when one of the hypotheses foreseen by the art. 18 GDPR;

e) receive, in a structured format, commonly used and readable by automatic devices, the personal data supplied to UNIVET and to transmit such data to another Data Controller without impediments by UNIVET and, if technically feasible, to obtain direct transmission of the data personal data from one Data Controller to another;

f) oppose at any time the processing of personal data concerning him pursuant to art. 6, co. 1, lett. f, GDPR, including profiling based on this provision and the processing of personal data for direct marketing purposes, including profiling related to this purpose.

10. The procedure for the exercise of the rights

At any time, the user can exercise his rights by sending:

- an e-mail to the following address: privacy@univet.it;

- a registered letter to the following address: Bergamo, Via Giuseppe Verdi 11.

11. Personal data retention

UNIVET will process the personal data provided by the user for the time necessary for the performance of the contract and for the fulfillment of its legal obligations. Furthermore, UNIVET will keep the data for as long as necessary in relation to the average life of products sold the fulfillment of obligations and the exercise of rights related to the existing user relationship, the need to defend and control fraud.

The right of data’s subjects remains at any time to request the deletion of data and / or the interruption of their processing for marketing purposes.

12. Cookie

UNIVET receives and logs information from the user's browser when using his site, which may also include personal data. UNIVET uses cookies to collect this information, which may include among others: (i) IP address; (ii) unique cookie identifier, information about cookies and information about the fact that the device has software to access certain features; (iii) unique device identifier and type of device; (iv) domain, browser type and language, (v) operating system and system settings; (vi) country and time zone; and (vii) access times and referring URLs.

UNIVET uses cookies to monitor the use of the site by its clients/prospective clients and to understand their preferences (such as the choices of the country and language). In this way, UNIVET can provide services to its customers and improve their online experience. In particular, UNIVET uses technical cookies. These cookies are necessary for the basic functionality of the site and are therefore always enabled. UNIVET uses this data for the sole purpose of obtaining anonymous statistical information about the use of the site and in order to check its correct functioning. After this processing, they are deleted immediately. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site: except for this eventuality, at present the data on web contacts do not persist for more than seven days.

The Website uses technical cookies to save browsing preferences and improve the user experience of the site. This category includes cookies that manage any authentication or user settings.

The Site also uses third-party cookies, technical, analytics or profiling, with the following purposes:

- Statistics and analysis: to allow the Data Controller to monitor and analyze traffic data on the site and analyze user behavior, in order to improve the service performed. These data are collected by making anonymous the IP address of the user, used directly by the Data Controller without the intervention of third parties, similar to the technical cookies of the first part.

- Interaction with Social Network: to interact with the functionalities of social networks through the pages of the site (sharing, like, etc.). The acquired data may be subject to the privacy settings configured by the user on the social network itself if it has an account.

- Integration of external content: to view and interact with any content hosted on third-party sites and integrated into the site (videos, images, maps, etc.).

12.1. References to third-party privacy policies

Google Analytics - Place of processing: USA - Privacy policy

12.2. To enable or disable cookies

You can choose to enable or disable cookies by adjusting the settings of your navigation browser according to the instructions made available by the relative suppliers. Disabling session cookies may prevent the user from properly using all the features of the site.

Additional methods for managing third-party cookies:

- through the website of the EDAA association: www.youronlinechoices.com

- directly in the Privacy Policy sections of the respective third parties.