Pursuant to art. 13 of the 2016/679 European Regulation on the protection of personal data (GDPR), we inform you that the personal data you provide or otherwise acquired will be processed in compliance with current legislation and the principles of correctness, lawfulness, transparency and protection of confidentiality. provided for by it. HOLDER OF THE TREATMENT The Data Controller is Cardamomo Srl, based in Lecco, Piazza XX Settembre 45, in the person of its pro tempore legal representative who, within the scope of its prerogatives, may avail itself of the collaboration of specifically identified managers or agents. The owner can be contacted at the e-mail address info@cardamomosrl.it COLLECTED DATA The data collected by the Data Controller are those provided by the user (for example, name, surname, gender, date of birth, social security number, document, e-mail, telephone, purchases made). METHOD OF TREATMENT The data will be processed with the aid of IT and / or paper tools, according to logic strictly related to the purposes indicated above and in any case adopting procedures and measures suitable to protect their security and confidentiality. PURPOSE OF THE TREATMENT The data processing will be aimed at carrying out the activities listed below: a) carrying out, with your express written consent, direct marketing activities, such as the sending - also by e-mail, SMS and MMS - of advertising material and communications with informative and / or promotional content in relation to products or services provided and / or promoted by the Owner or by its commercial partners, including free gifts and free samples; b) carrying out, with your express written consent, individual or aggregate profiling activities and market research aimed, for example, at the analysis of consumption habits and choices, the processing of statistics on the same or the assessment of the degree of satisfaction with respect to the products and services offered. NATURE OF DATA PROVISION For the purposes referred to in letter a) of the previous point, the provision of data is optional. For the purposes referred to in letter b) of the previous point, the provision of data is optional and any refusal to provide such data and to give the relative consent makes it impossible for the Data Controller to follow up on direct marketing activities and profiling indicated therein.

SCOPE OF DISCLOSURE OF DATA The data processing will be carried out by personnel directly employed by the Data Controller and / or by natural or legal persons specifically identified by the latter as data processors or persons in charge of processing. The data provided will in no case be disclosed or communicated to third parties, except for the subjects whose right to access the data is recognized by law or by orders of the authorities as well as the subjects, even external and / or foreign, of which the Data Controller uses including suppliers of software solutions, web applications and storage services also provided through Cloud Computing systems, all of which reside in the European Economic Area, and used for this purpose. STORAGE PERIODS The Personal Data will be kept by the Data Controller for a period of six months. The Data Controller may be obliged to keep the customer's Personal Data for a longer period in compliance with a legal obligation or by order of an authority. At the end of the retention period, the Personal Data and the acquired data of the customer will be deleted. Therefore, at the end of this term the right of access, cancellation, rectification and the right to data portability can no longer be exercised.

RIGHTS OF THE INTERESTED PARTIES The subjects to whom the personal data refer may at any time exercise their recognized rights towards the Data Controller, pursuant to European Regulation 679/2016 (GDPR) and national legislation. In particular, they will be able to: a) have confirmation of the existence or not of personal data concerning them, even if not yet registered, and have communication of it in an intelligible form; b) obtain an indication of the origin of personal data, of the purposes and methods of processing; of the logic applied in case of treatment carried out with the aid of electronic instruments; of the identification details of the owner, of the managers and of the designated representative c) obtain the updating, rectification or integration of the data; d) obtain the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those that do not need to be kept for the purposes for which the data were collected or subsequently processed; e) have attestation that the aforementioned operations have been brought to the attention of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible or involves the use of means manifestly disproportionate to the protected right; f) object, in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purpose of the collection, and to the processing of personal data concerning them for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication. g) receive your data and those entered in the application, in a structured and readable form by a data processor and in a format commonly used by an IT device (data portability); To exercise these rights, the interested party may contact the Data Controller directly.