NOTICE ON PROCESSING OF PERSONAL DATA - THERMO ICE APP

1. Holder of the processing of Personal Data and Data Protection Officer

   1. The Data Controller, Gewiss S.p.A. (hereinafter "Gewiss") wishes to illustrate to you, with this Information, how the personal data collected through the use of our product called "Thermo ICE WiFi" (the "Product") and our application called "Thermo will be processed". ICE App "(the" Application ").

   2. The DPO will be contacted at the e-mail address dpo@pec.gewiss.com.

   3. This document is prepared in accordance with the art. 13 of the European Regulation n. 2016/679 concerning the protection of individuals with regard to the processing of personal data (hereinafter "GDPR"), as well as taking into account the recommendations and clarifications provided by the Work Group art. 29 in "Opinion No. 2/2013 on applications for smart devices", as well as the "Guidelines on transparency pursuant to Regulation 2016/679" (WP260 rev. 01).

2. Object and method of processing

   1. Gewiss will treat the following personal data communicated or legitimately found by you (hereinafter "Personal Data"):

      1. DATA GIVEN ON THE OCCASION OF REGISTRATION TO THE APP

         When you register through the application and create an account, the following data is collected: the e-mail address, the username and the account password.

      2. APPLICATION DATA OF THE APP

         When you use the App, the following information will be treated:
         • the IP address or ID of your device;
         • the model and brand of your device;
         • the URI (Uniform Resource Identifier) ​​addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numeric code indicating the response status given by the server ( good result, error, etc.) and other parameters relating to the operating system and IT environment of your device;
         • data relating to physical quantities (for example, temperature, humidity) measured by Thermo Ice sensors;
         • electrical measurement data (for example, energy, power, voltage) or consumption (for example, water) and related summary graphs over time;
         • data related to the parameter settings of the functions performed by the device, such as logic functions, timers, scenarios, irrigation, load control, temperature control profiles;
         • information on the interactions you made with the App, including commands for activating the device;
         • e-mail addresses used for sending notifications following events;

3. Purpose of the processing, legal bases and mandatory conferment

   1. Below are the purposes for which your personal data are processed by Gewiss and the legal basis of the related processing.

      1. Purpose of processing: Access to the App and its use by the user;
         Legal basis of the processing: Execution of a contract.
      2. Purpose of the processing: to fulfill obligations set by regulations and by the applicable national and supranational legislation;
         Legal basis of the processing: need to fulfill the legal obligations.
      3. Purpose of processing: Communications with the user (for example, if you contact Gewiss by e-mail or otherwise, you may use Personal Data to answer questions or to resolve problems, or in relation to "push" notifications. linked exclusively to the best use of the service);
         Legal basis of the processing: Execution of a contract.
      4. Purpose of the processing: Direct marketing purposes. By way of example: sending - with automated contact methods (such as sms, mms and e-mail) and traditional (as telephone calls with operator and traditional mail) - of promotional and commercial communications relating to services / products offered by the Company or reporting of events corporate, market research and statistical analysis; as well as sending questionnaires to the user for the purpose of detecting the degree of customer satisfaction regarding the quality of the services rendered.
         Legal basis of the processing: Consent (optional and revocable at any time).
      5. Purpose of the processing: any need for extrajudicial credit recovery or to ascertain, exercise or defend the rights of the Data Controller in court;
         Legal basis of the treatment: legitimate interest.

   2. The provision of your personal data is necessary for the execution of a contract of which you are part. Your refusal could make it impossible for Gewiss to carry out the purpose for which the Personal Data is collected.

   3. Consent to the processing of personal data for purposes 3.1 lett. d) is free, optional and revocable at any time. Withdrawal of consent does not affect the lawfulness of consent-based processing prior to revocation.

4. Period of conservation

   1. Your Personal Data will normally be kept for the entire duration of the contractual relationship with Gewiss, in compliance with the principles of proportionality and necessity and, in any case, until the purposes of the processing have been pursued.

   2. Your Personal Data will normally be stored until you have revoked your consent and in any case will be canceled within a maximum period of 10 years from the date of termination of your contractual relationship with Gewiss, without prejudice to the possible preservation of the themselves where necessary for the purposes of managing ongoing legal actions (ie until the terms of the appeals can be exhausted) and the fulfillment of specific legal obligations.

   3. Finally, your personal data will be stored for the purpose of direct marketing, until the consent is revoked;

5. Processing methods

   1. The processing of Personal Data is based on principles of correctness, lawfulness and transparency and minimization of data (privacy by design).

   2. The processing of Personal Data may be carried out either manually or using automated methods designed to memorize, process and transmit them and will be carried out by means of technical and organizational measures suitable, as far as reason and state of the art are concerned, to guarantee, among other things, security , the confidentiality, integrity, availability and resilience of systems and services, avoiding the risk of unauthorized loss, destruction, access or disclosure or, in any case, unlawful use, as well as through reasonable measures to promptly cancel or correct data inaccurate with respect to the purposes for which they are processed.

6. Data recipients

   1. Personal Data may be processed by external parties acting as data controllers such as, by way of example, authorities and supervisory and control bodies and in general subjects, public or private, legitimized by current legislation to request data.

   2. With reference to the purposes referred to in point 3, personal data may be communicated to third parties such as, by way of example but not limited to:

      • Professional Studies
      • Insurance companies
      • Companies that do market research
      • Energy and construction companies

   3. The Personal Data may also be processed by Gewiss trusted companies that perform on behalf of the latter hosting services or tasks of a technical nature, such as the management and technical maintenance of the server where the data reside, to which adequate operating instructions are given. These companies are appointed Data Processors pursuant to art. 28 of the GDPR.

7. Extra U.E.

   1. Personal Data will be processed within the European Union and stored on servers located within the European Union. If, for technical and / or operational reasons, it is necessary to make use of subjects located outside the European Union, or to transfer some of the data collected to systems managed in the cloud and located outside the European Union, the treatment will be regulated in compliance with the provisions of Chapter V of the GDPR and authorized on the basis of specific European Union decisions. All the necessary precautions will therefore be taken in order to guarantee the most complete protection of Personal Data. In particular, the transfer will be made on the basis of adequacy decisions of the third countries addressed by the European Commission and of adequate guarantees from the third party subject pursuant to art. 46 of the GDPR.

8. Authorized subjects for the treatment

   1. Personal Data may be processed exclusively by employees of company departments appointed to pursue the aforementioned purposes, who have been expressly authorized to treat and who have received adequate operating instructions.

9. Rights

   1. In relation to the processing of Personal Data, you can ask Gewiss:
      • access to Personal Data concerning you;
      • their cancellation;
      the correction of inaccurate data;
      • the integration of incomplete data;
      • the limitation of processing in the cases provided for by art. 18 GDPR (in the following cases: (a) the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; (b) the processing is unlawful and the data subject opposes the deletion of personal data and instead requests that its use be limited, (c) although the data controller no longer needs it for the purposes of processing, personal data is required by the data subject for verification, l the exercise or defense of a right in court, (d) the party concerned has opposed the processing pursuant to Article 21, paragraph 1, pending verification regarding the possible prevalence of the legitimate reasons of the data controller compared to those of the interested party);
      • the opposition to the processing in the hypothesis of your legitimate interest (in accordance with art. 21 of the GDPR, the interested party has the right to object at any time, for reasons connected to his particular situation, to the processing of personal data which they concern him for the legitimate interest of the Data Controller The Data Controller refrains from further processing personal data unless he demonstrates the existence of legitimate cogent reasons for proceeding with processing which prevail over the interests, rights and freedoms of the data subject or for 'verification, exercise or defense of a right in court);
      • to receive the data in a structured format, commonly used and readable by an automatic device, as well as, if technically feasible, to transmit them to another holder without hindrance if the conditions for exercising the right to portability set forth in the present are present; 'art. 20 of the GDPR (the treatment is based on consent or on the contract and is carried out with automated tools);
   2. Interested parties have the right to revoke the consent given at any time for marketing purposes, as well as to oppose the processing of data for marketing purposes. The possibility remains for the interested party who prefers to be contacted for the aforementioned purpose exclusively through traditional methods, to express his opposition only to receiving communications through automated means.
   3. These rights can be exercised by sending a written notice to the address below or an e-mail to domodivision@gewiss.com, as well as using the access tools available within the App.
   4. Interested parties also have the right to lodge a complaint with the competent control authority in the Member State in which they habitually reside or work or of the State in which the alleged violation occurred.

10. Owner contact details

    Gewiss SpA, company with sole shareholder, Via A. Volta, 1, 24069 Cenate Sotto Bergamo, tax identification number and VAT number IT 00385040167, share capital of 60,000,000.00 Euro (int. Vers.); phone number: +39 035 946 111; email address privacy@gewiss.com.

11. Dati di contatto del Data Protection Officer di Gewiss (DPO)

    Il DPO sarà contattabile all’indirizzo e-mail dpo@pec.gewiss.com

12. Changes to the Privacy Policy

    Gewiss reserves the right to update or modify this Privacy Policy periodically and at any time. In this case, Gewiss will provide you with a clearly visible notice which, depending on the circumstances, may for example be displayed within the App or transmitted via e-mail. You are therefore invited to read these notices carefully

DECLARATION OF CONSENT OF THE INTERESTED PARTY