Privacy Information

According to article 13 of Legislative Decree no. 196 of 30th June 2003 ("Privacy Code"), article 13 of European Regulation no. 679 of 2016 (the "Privacy Regulation"), and Recommendation no. 2 of 2001 adopted pursuant to article 29 of Directive no. 95/46/EC, Retail Food S.r.l. intends to inform you and all users and/or visitors of the site www.vyta.it (respectively the "Users" and the "Site"), about the use of personal data, log files and cookies collected through the Site.

1. Data Controller, Data Processors and Data Protection Officer

The Data Controller is Retail Food S.r.l. (Tax Id. Code and VAT No. 08469981008), with registered office in Rome, Via Vicenza 5/A, e-mail info@Vyta.it, (hereinafter, "Controller").

The updated list of appointed data processors may be provided upon request by data subjects and/or Users.

In the event that a Data Protection Officer is appointed, his/her identification data will be made known by means of their publication, supplementing this information notice.

2. Information automatically collected from the Site - Cookies

a) Information automatically collected

Like all websites, our Site too makes use of log files, in which information collected in an automated manner during your visits is stored. The computer systems and software procedures used to operate the Site, in fact, automatically acquire during use some information, the transmission of which is implicit in the use of Internet communication protocols.

The information collected is as follows: • Internet Protocol (IP) address or domain name of the device you are using;

• browser type and device parameters used to connect to the Site;
• The URI (Uniform Resource Identifier) addresses of the requested resources or the method used to submit the request to the server;
• the name of your Internet service provider (ISP);
• date and time of the visit;
• web page of origin (referral) and of exit of the User;
• possibly the number of clicks;
• the size of the file obtained in reply;
• the numerical code indicating the status of the response given by the server (successful, error, etc.);
• other parameters relating to the operating system and the IT environment of your device

Such information is processed in an automated manner and collected exclusively in an aggregate form for the purpose of verifying the correct functioning of the Site.

b) Cookies

Cookies are used on the Site. Cookies are text files stored on computer, which allow you to record some parameters and data communicated to the computer system, through the browser you use. These tools therefore allow an analysis of your habits in the use of the Site, for different purposes: execution of computer authentications, monitoring of sessions, storage of information on specific configurations regarding users accessing the server, storage of preferences, etc. The types of cookies comprise:

• Technical cookies: are used to navigate or provide a service requested by you. Without the use of such cookies, some operations could not be carried out or would be more complex and/or less secure.

• Profiling cookies: they are used to track your navigation and create profiles on your tastes, habits, choices, etc. In this way, messages can be transmitted to your device in line with your preferences already expressed in the previous online navigation.

Your consent is not required for the installation of the technical cookies. Your consent is required for the installation of profiling cookies: If you do not want your device to receive and store profiling cookies, you can change the security settings of your browser. Below are brief instructions on how to do this in the four most common browsers:

Microsoft Internet Explorer: Click the "Tools" icon in the top right corner and select "Internet Options". In the pop-up window, select "Privacy". Here you can adjust your cookie settings.

Google Chrome: Click on the wrench in the upper right corner and select "Settings". Now select "Show advanced settings" and change the "Privacy" settings.

Mozilla Firefox: From the drop-down menu in the top left corner select "Options". In the pop-up window, select "Privacy". Here you can adjust your cookie settings.

Safari: From the drop-down menu in the upper right corner, select "Preferences". Select "Security" and here you can adjust your cookie settings.

Please note, however, that by disabling the use of profiling cookies you will not be able to take full advantage of some features of the Site.

While browsing the Site, you may also receive on your terminal Cookies that are sent by different websites or web servers (hereinafter "Third Parties"). Third parties, who use cookies on our Site, are:

Google Analytics, a service of the company Google Inc. "("Google"), the information on which can be found at https://www.google.com/analytics/learn/privacy.html?hl=en. You can refuse the installation of cookies used by Google Analytics by selecting the corresponding parameters in the specific options of your Google browser.

Through the use of the Site, the use of cookies is considered accepted and consent is given to the processing of data collected by Third Parties.

3. Processing purposes relative to the Personal Data you provide by using the Site

Your data will be processed for the following purposes:

(i) remember your browsing preferences in order to offer you a faster consultation of the website www.vyta.it (the "Site") and for the technical management of the Site;

(ii) activities of "sheer customer loyalty", allowing you to request and/or activate and/or manage the Vyta-Card and join in the related activities, which cannot be joined in anonymously, which may be associated with promotions or discounts;

(iii) update you on all our promotional and marketing initiatives, including direct ones, also by sending advertising and/or promotional material using automated tools and/or traditional contact means, for example push notifications, e-mails ("Newsletter") and/or by sending text messages, mms ("Marketing Services");

(iv) analyse your preferences, habits, interests and consumer choices, including the type, frequency and location of purchases, in order to set up statistics, create specific user profiles and carry out predictive activities in relation to your future consumption (hereinafter, "Profiling Activity"));

The processing of data for the above-mentioned purposes will be carried out in compliance with the Privacy Code, the Privacy Regulation, and all specific industry regulations, including the provisions of the "Rules of the Guarantor for customer loyalty programs" of 24th February 2005 and the "Guidelines on the processing of personal data for online profiling" of 19th March 2015.

In compliance with the "Guidelines on promotional activities and combating spam" of 4th July 2013, we point out that any consent you may give for the sending of commercial, promotional and marketing communications using automated tools will also extend to the traditional contact methods.

The data you provide will be processed primarily by information tools under the authority of the Data Controller, by persons specifically appointed, authorized and instructed to process them, in compliance with Article 30 of the Privacy Code and Articles 28 and 29 of the Privacy Regulation. We inform you that suitable security measures are also taken in accordance with articles 5 and 32 of the Privacy Regulation to prevent data loss, illegal or incorrect use and unauthorized access.

4. Required or optional consent relative to data provision, the consequences of any refusal, and lawful basis for processing

Please note that for the purposes referred to in point (i) of article 2 above, you are required to provide your personal data because failing to do so will prevent you from the following actions, through the Site:

i) request and/or obtain and/or register the VyTA-Card, benefitting from the advantages connected with it and its use, including the collection of points and/or other activities to which promotions, discounts, etc. may be linked.

Instead, the provision of your Personal Data is not required but optional for the purposes referred to in points (iii) and (iv) of article 3 above. Failure to provide your data for the purposes listed above will not allow us to send you the Newsletter, nor render Marketing Services and Profiling Activities. To this end, you may freely decide whether to give your consent for such purposes and without this inhibiting the ability to use the Services on the Site or request and / or obtain and / or register the VyTACard with the benefits associated with it.

Please note that, in any case and at any time, you may request the Controller to delete your data by a simple communication to be sent, without any special formalities, to the addresses referred to in article1 above.

With reference to the purposes referred to in points (i) and (ii) of article 3 above, the lawful basis of the processing is in fact the execution of the services provided through the Site and requested by you (pursuant to article 6, paragraph 1, letter b of the Privacy Regulation and article 24, paragraph 1, letter b of the Privacy Code); instead, with reference to the purposes referred to in points (iii) and (iv) of article 3 above, the lawful basis of the processing is your consent, freely given, (pursuant to article 6, paragraph 1, letter a of the Privacy Regulation and article 23 of the Privacy Code).

5. To whom and to what extent we can communicate your data

Your data may be communicated, within the EU, in full compliance with the provisions of the Privacy Code and the Privacy Regulation, to the following subjects:

(i) tax administration and/or other public authorities, where required to do so by law or at their request;

(ii) structures, persons and external companies used by the Data Controller to carry out activities connected with, instrumental to or consequent to the sending of the Newsletter and the provision of Marketing Services, Profiling Activity and the issuance and management of the Vyta-Card;

(iii) external consultants (e.g. for tax compliance management), if not appointed in writing as Data Processors; (iv) to associates and/or subsidiaries and/or parent companies, which are designated as Joint Data Controllers.

The information collected automatically from the Site, referred to in point 2. Above, as well as some anonymous data relating to the number and type of interactions with activities connected with sheer customer loyalty activities may also be transferred to Third Party cloud servers outside the EU, since such processing is necessary for the execution of Site Services and requested by you. The lawful basis of such processing is, therefore, article 49, paragraph 1, letter b of the Privacy Regulation and article 43, paragraph 1, letter b of the Privacy Code.

6. Your rights

Please note that you may exercise your rights under Article 7 of the Privacy Code and Articles 15, 16, 17, 18, 20 and 21 of the Privacy Regulation at any time by sending a written notice to the addresses of the Controller referred to in article 1 above and, accordingly, obtain:

- confirm of the existence or not of your personal data with indication of the relative origin, and you may verify its exactness or request its updating, correction or integration;

- access, rectification, erasure or restriction of processing;

- cancellation, transformation into anonymous form or blocking of data processed in violation of the law.

You may also oppose to the processing of your personal data.

With reference to the Newsletter and Marketing Services, we point out that your right to request the termination of the processing carried out through automated contact means ù also extends to the traditional ones. Moreover, you may exercise this right only in part, i.e. by requesting the interruption, for example, of the sending of promotional communications through one or more of the contact tools for which you have given your consent.

7. Processing duration

Without prejudice to legal obligations, personal data will be kept for a specified period, based on criteria depending the nature of the services provided. Please note that the data stored for Profiling or Marketing purposes will be kept for a period not exceeding 12 and 24 months respectively from their recording.

8. Security measures

Through the Site your data are processed in compliance with the applicable law and using appropriate security measures in accordance with the legislation in force pursuant to Articles 5 and 32 of the Privacy Regulation.

In this regard, we confirm, among other things, the adoption of appropriate security measures to prevent unauthorized access, theft, disclosure, modification or destruction of your data.

9. Changes to this Privacy Information

The Data Controller reserves the right to make changes to this Privacy Information. In this case you will be promptly informed when you use the Site again.