INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

Pursuant to art. 13 of Regulation (EU) no. 2016/679, “on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” (hereinafter the “GDPR”), the companies Grimaldi Group S.p.A., Grimaldi Euromed S.p.A. and Grimaldi Deep Sea S.p.A., as joint controllers of the processing of your personal data (hereinafter the “Joint Controllers”), are required to provide you with some information regarding the methods and purposes related to the processing.

In accordance with art. 26 of the GDPR, the abovementioned Joint Controllers have determined, by means of an internal agreement, their respective responsibilities, for the External Relations area, regarding compliance with the obligations deriving from the GDPR.

The table below provides a very brief summary of the contents of this information notice.

The Joint Controllers have appointed a Data Protection Officer, who has a specialist knowledge of data protection rules and practices and is therefore able to carry out the tasks referred to in art. 39 of the GDPR, who can be contacted at the following e-mail address: DPO@grimaldi.napoli.it.

You may contact the Joint Controllers at the following email address: privacy@grimaldi.napoli.it.

• Categories of processed personal data

Your common personal data – name, surname and contact details - are processed. No special categories of personal data pursuant to art. 9 of the GDPR will be processed and, if the Joint Controllers receive them, they will immediately delete them.

• Purposes and legal basis of the processing

Your personal data are processed (i) for the purpose of disclosing and promoting the activities and the services of Grimaldi Group; and (ii) to send you information content (for example, newspapers, magazines, etc.) produced by third-parties publishing companies, which are business partners of the Joint Controllers.

Your personal data’s processing activities are based on your express and specific consent. We remind you that with a single consent you can authorize us to send you commercial communications by non-automated means (telephone with operator, paper mail) and automated means (sms, push notifications, email), in compliance with the provision of the Italian Data Protection Authority dated May 15, 2013, but that you can at any time object to such communications, even by selecting the contact tools (e.g. email yes, sms no).

Please note that your consent is not required if you have already purchased products and/or services from the Joint Controllers and the information material sent to you concerns similar products and/or services (art. 130, paragraph 4, of Italian Legislative Decree 196/2003 the “Privacy Act”).

The provision of your personal data is optional. However, failure to provide, even partially, the requested data will make it impossible for the Joint Controllers to proceed with the full provision of the service provided.

• Methods of processing and personal data’s retention period

We would also like to inform you that your personal data are processed, also using IT tools, in compliance with the principles set forth in the GDPR, which provides that the data shall be:

• processed according to the principles of lawfulness, fairness and transparency;
• collected and recorded for specific, explicit and legitimate purposes (“purpose limitation” principle);
• adequate, relevant, and not excessive with respect to the purposes of processing (“data minimisation” principle);
• accurate and up to date (“accuracy” principle);
• kept for no longer than is necessary for the purposes for which the data are processed (“storage limitation” principle);
• processed by means of instruments suitable to guarantee their security and confidentiality, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage (“integrity and confidentiality” principle).

Your personal data will be kept until it is necessary for the purposes of the processing, as indicated above.

• Communication of personal data

We inform you that your personal data may be communicated by the Joint Controllers to public and/or private organizations authorized to receive them by law (e.g. to the financial administration, to the authorities appointed by law, to supervisory and control bodies, within the limits of the legislative, regulatory or contractual provisions), to publishing companies which are business partners of the Joint Controllers, to suppliers that deal with the dispatch of information communications in paper form as well as to persons, companies, associations or professional firms that provide services or activities of assistance and advice to the Joint Controllers, with particular but not exclusive reference to accounting, administrative, tax, IT and/or financial matters and to legal consultants.

Your personal data will not be subject to transfer to third countries with respect to the European Union.

• Rights of the data subjects

You may exercise your rights at any time under articles 15-22 of the GDPR:

• to access to your personal data, requesting your data to be made available to you in an intelligible form, as well as the purposes on which the processing is based (art. 15);
• to obtain the rectification (art. 16) or erasure (art. 17) of your personal data or the limitation of the processing (art. 18);
• to withdraw the consent given, without prejudice to the lawfulness of the processing carried out before the withdrawal;
• to obtain the portability of data (art. 20);
• to object to the processing of data, within the limits set by the GDPR (art. 21);
• to lodge a complaint with the competent supervisory authority.

You may exercise the abovementioned rights by sending your request to the following e-mail address: privacy@grimaldi.napoli.it. With respect to information communications received in electronic form, you may exercise your right to object by using the “unsubscribe” function at the bottom of each email received from the Joint Controllers.