Information for the processing of personal data pursuant to the legislative decree 196/2003 of 30 June 2003 (Code on the protection of personal data) Pursuant to the legislative decree 196/2003, International Hotel Network, with main offices in Rome in Piazza San Salvatore in Lauro 13, is solely responsible for the processing of personal data and informs that data obtained will be processed in accordance with the above-stated law and the principles of fairness, legality and transparency as well as the protection of your privacy. Moreover, International Hotel Network ensures that employees responsible for data processing are only in charge of carrying out single operations with written instructions and only have access to the information strictly necessary to completing the assigned task. 1. Source of data Personal data in the possession of International Hotel Network is gathered directly from the client or third-party companies. In any case, all personal data shall be processed according to the law and the principles of fairness, legality and transparency as well as the protection of your privacy and rights. 2. Exclusion of sensitive data International Hotel Network asserts that sensitive personal data sent of your own accord which may disclose racial or ethnic origins, religious views, philosophical or other type of opinions, political stances, political party or trade union affiliation, or data concerning state of health or sexual life shall not be processed without express written consent and shall undergo all procedures established be the legislative decree 196/2003. 3. Purposes for which data is used Upon client’s consent, supplied data shall be processed, directly or through third parties, in compliance with requirements established by law, regulations or EU norms, and in particular in observance of all contractual obligations, as well as for the following purposes: Elaboration of statistical market research and studies; Commercial and marketing activities (distribution of advertising or informational material and newsletters); Recruitment activities (Employment section). In the absence of consent, the data provided shall be processed exclusively in relation to carrying out contractual obligations. 4. Methods of data processing Data processing may be performed using electronic and/or paper means and/or through data transmission, even by third parties when necessary or purposeful to carrying out TCL S.p.A. activities. In any case, data shall be processed in such a way to ensure your security and privacy. 5. Diffusion of data Data can be communicated to the following groups of subjects who may, in turn, process the same solely in order to carry out requests: Commercial partners and other companies that provide specific services Credit institutions Non-banking intermediaries and companies that issue/manage credit cards Third parties that, on behalf of International Hotel Network, provide IT services (data entry companies, computer-based filing of client reports), auditing and financial statement certifications or other services (regarding payments, statements, checks, and other securities; transmission, packaging, transportation and sorting of client communications). Other companies within the same group. An updated list of these companies may be requested free of charge by writing to International Hotel Network SpA at privacy@charminghr.com. 6. Rights pursuant to article 13 of the legislative decree 196/03 The following rights established in art. 13 of legislative decree 196/03 may be exercised with regards to the processing of your data. For your convenience we have restated them here below: "Art. 13 1. The interested party or person from whom the personal data has been collected shall be informed beforehand, orally or in writing, as to: a. the purposes and modes of processing to which the data are to be subjected; b. the obligatory or optional nature of the conferral of the data; c. the consequences of a refusal to respond; d. the subjects or categories of subjects to which the personal data may be made known or that may be made acquainted therewith as managers or specifically assigned employees, and the context for the diffusion of such data; e. the rights as per article 7; f. the data identifying the Owner and, if designated, the representative in the territory of the state pursuant to article 5, and the manager. When the Owner has designated a number of managers, at least one of them shall be indicated, detailing the site of the communications network or the procedures by which the updated list of managers may be easily known. When a manager has been designated to respond to the interested party in the event of exercising the rights as per article 7, this manager is indicated. 2. The information as per subsection 1 also contains the elements provided for by the specific provisions hereof, and may not include elements already known to the person that provides the data or knowledge, which may concretely hinder the carrying out, by a public subject, of inspection or monitoring functions for the purposes of state defence or security or for the purposes of preventing, ascertaining, or stopping crimes. 3. The Authority may, by its own provision, identify simplified modes for the information provided by public assistance and information telephone services. 4. If the personal data are not gathered from the interested party, the information as per subsection 1, including the categories of data treated, is given to the interested party upon registering the data or, when their communication is provided for, no later than the first communication. 5. The provision pursuant to subsection 4 does not apply when: a. the data are treated based on an obligation provided for by the law, by a regulation, or by European Community regulations; b. the data are treated for the purposes of carrying out the defence investigations pursuant to law no. 397 of 7 December 2000 or, in any event, to exercise or defend a right in court, provided that the data are treated exclusively towards these ends and for the period strictly needed for the achievement thereof; c. the information to the interested party involves a use of means that the Guarantor, prescribing any appropriate measures, declares clearly disproportional to the protected right, or is shown in the Guarantor’s opinion to be impossible." 7. Data processing owner International Hotel Network is the owner of this data processing, located in Piazza San Salvatore in Lauro 13, 00198 Rome. 8. Person in charge of processing The general manager is in charge of data processing. For all matters regarding the processing or diffusion of your data, please contact the person in charge by writing to privacy@charminghr.com. 9. Rights as per article 7 of the legislative decree 196/03 Lastly, we remind you that the rights established in art. 7 of legislative decree 196/03 with regards to the processing of your data may be exercised at any time. For your convenience we have restated them here below: "Art. 7 - Right to access personal data, and other rights 1. The interested party has the right to obtain confirmation of the existence or non-existence of personal data regarding said party even if the data has yet to be recorded, and communication thereof in intelligible form. 2. The interested party has the right to obtain indication of: a. the origin of the personal data; b. the purposes and modes of processing; c. the logic applied in the event of processing made with the aid of electronic instruments; d. the data identifying the Owner, managers, and representative designated pursuant to article 5, subsection 2; e. the subjects or categories of subjects to which the personal data may be made known or that may be made acquainted therewith as designated representative in the territory of the state, managers, or specifically assigned employees. 3. The interested party has the right to obtain: a. the update, rectification, or, when interested, the supplement of the data; b. the deletion, transformation to anonymous form, or blocking of the data treated in violation of the law, including those for which conservation is not necessary for the purposes for which the data were gathered or subsequently treated; c. certification that the operations pursuant to letters a) and b) were brought to the knowledge, also as regards their content, to whom the data were made known or spread, except for the case in which fulfilment is impossible or involves the use of means clearly disproportional to the protected right. 4. The interested party has the right to oppose, in all or in part: a. for legitimate reasons, the processing of the personal data regarding said party, provided that said data are pertinent to the purposes of the collection; b. the processing of the personal data regarding said party for the purposes of sending advertising or direct sales material or performing market research or commercial communication."