Privacy notice - Code of Conduct

Mottura Serrature di Sicurezza S.p.a., with registered office in Sant’Ambrogio di Torino (TO), Strada antica di Francia n° 34, (hereinafter "MOTTURA", the "Company", "we"), e-mail: privacy@mottura.it as data controller collects and processes personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), the Legislative Decree . June 30, 2003, n. 196 ("Privacy Code"), Legislative Decree 10 August 2018, n. 101 of adaptation of the Privacy Code to the GDPR (the "Adjustment Decree"), in compliance with the privacy principles and the rights of the interested party.

This constitutes the information provided pursuant to art. 13 GDPR in order to protect the rights of all persons involved in an investigation of the Code of Conduct (including those who report suspected violations of the MOTTURA Code of Conduct), to ensure fair and secure processing of their personal data, to provide information on MOTTURA's rights and ensure that MOTTURA complies with applicable data protection law. MOTTURA needs to detect any violations of the Code of Conduct, investigate reports of possible violations of the Code of Conduct and take corrective action, then process certain personal information (called "personal data") concerning the individuals involved in an investigation of the Code of Conduct.

This disclosure includes information on the type of personal data MOTTURA processes in relation to such individuals, for which MOTTURA is the "data controller". Personal data is processed in accordance with this information and the data protection law. By reading this information, you confirm that you have been informed of how we process your personal data. You have several rights in relation to this treatment.1. Qual è lo scopo della presente informativa?

Your rights include:

• the rights of access and rectification of your personal data
• the right to object to the processing of personal data
• the right to limit the processing of personal data
• the right to request the deletion of your personal data
• the right to data portability to another data controller, where technically possible.

Please note that situations may arise where you will not be able to exercise your rights. If you are not satisfied with how your personal data is processed by us, you have the right to lodge a complaint with a data protection body.

Your rights are described in more detail below.

MOTTURA has appointed a so-called Data Protection Officer ("DPM"). If you have any questions about how ASSA ABLOY collects, processes and stores personal data, you can contact the DPM at the address privacy@mottura.it for the attention of: MOTTURA, the Data Protection Manager.

In this Notice, the term "personal data" is used to indicate any information that can be used, on its own or in combination with any other information, to identify a living individual, as well as any other data that can be considered of a personal nature. under the data protection laws applicable to MOTTURA.

This Notice applies to all personal data that in any form is considered processed under the laws in force in relation to you as a complainant of an alleged violation of the Code of Conduct, including personal data that is stored, archived, collected, transferred , disclosed or otherwise otherwise managed.

We process personal data to investigate suspected violations of the Code of Conduct and to take any corrective action. Specifically, we will only collect and process the personal data of the individual who reports potential violations of the Code of Conduct, as indicated in the "Data Processing Guidelines" set out in Annex A. We will process such data only to fulfill the purposes indicated. in this information and in the Guidelines for data processing, as well as to comply with applicable laws.

MOTTURA will process personal data only for the purposes for which it was collected and as indicated in the Data Processing Guidelines. We have adopted adequate technical and organizational measures for the protection of personal data, in order to ensure that only a limited number of authorized persons (as per Annex B) can access personal data. We use technical security systems, such as firewalls, cryptographic technologies, passwords and antivirus programs, to prevent and avoid the unauthorized use of personal data. The organizational measures taken are detailed in the Data Protection Compliance Program.

Authority

In connection with investigations or legal proceedings, MOTTURA may need to provide personal data to both regulatory and regulatory authorities, or courts. Such disclosures will be made in accordance with the law in force, in order to comply with legal obligations.

ASSA ABLOY group company

In addition, as the ASSA ABLOY group carries out business activities in different countries, it may be necessary to transfer personal data to ASSA ABLOY companies outside your home country who need to receive such data for the purposes indicated in the Data Processing Guidelines.

Companies commissioned by MOTTURA

Your personal data may also be transferred to and processed by third party providers and suppliers who perform services for MOTTURA, to enable these companies to perform the services we request. Services that may be requested include the provision of legal and consultancy services regarding investigations. These companies will only be provided with the personal data necessary to fulfill the purposes indicated in the Data Processing Guidelines. All third party providers and suppliers will be required to follow our instructions as well as the written agreement applicable to data processors, as well as any other agreements in place between MOTTURA and the third party provider / supplier, and will be required to implement technical measures and organizational measures suitable for the protection of the personal data of our employees.

A legal person receiving personal data may be located in a country that offers a lower level of protection than the country in which you or another citizen are located. The transfer of personal data to countries that guarantee such data a lower level of protection will take place in accordance with the applicable policies of MOTTURA regarding the transfer of personal data, from time to time in order to ensure that such transfer is in compliance with the law. If the transfer of personal data takes place to countries that guarantee such data a lower level of protection, this transfer will take place in accordance with the "Guidelines for the transfer of personal data" referred to in Annex B.

Personal data will be available only to authorized employees and / or individuals appointed as consultants by MOTTURA, whose position is such as to require the processing of personal data in order to carry out their duties. These employees and / or consultants will be able to access the data only in compliance with the principle of "minimum privilege", according to which access will be allowed only to personal data whose processing is strictly necessary for the performance of their duties. Personal data will therefore only be accessible to the roles listed in Annex B. Personal data may also be available to employees and / or third-party consultants to whom MOTTURA has disclosed the personal data as indicated in Section 5.

We will not retain or process personal data for a period that goes beyond what is necessary to fulfill the purposes indicated in the Data Processing Guidelines or to comply with the laws in force in your country. Consequently, once the purpose for a specific type of personal data has been fulfilled, we will cease to use them for that purpose and, if not relevant for any other purpose, we will delete them as soon as reasonably possible.

You can contact the Company at any time at the addresses indicated at the beginning of this Privacy Notice and at the email address privacy@mottura.it to request the updated list of our data processors and exercise your privacy rights pursuant to Articles. 15 ss. GDPR:

Right of access: You have the right to obtain from us confirmation of the existence or not of personal data concerning you and, if so, to request access to such personal data. The access information includes, among others, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom the personal data have been or will be communicated, the sources of the personal data, the duration of storage. and the technical security measures adopted to safeguard personal data in case of transfer outside the EEA. However, this is not an absolute right and the interests of other people may limit the right of access.

For more detailed information on how MOTTURA processes the personal information collected in relation to any requests relating to the management of your personal data, consult the MOTTURA Privacy Policy - Request for Access to Personal Data. 

Right of access: You have the right to obtain from us confirmation of the existence or not of personal data concerning you and, if so, to request access to such personal data. The access information includes, among others, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom the personal data have been or will be communicated, the sources of the personal data, the duration of storage. and the technical security measures adopted to safeguard personal data in case of transfer outside the EEA. However, this is not an absolute right and the interests of other people may limit the right of access.

For more detailed information on how MOTTURA processes the personal information collected in relation to any requests relating to the management of your personal data, consult the MOTTURA Privacy Policy - Request for Access to Personal Data.

Right of rectification: In certain circumstances, you have the right to obtain from us the rectification, i.e. the correction of inaccurate personal data concerning you and also the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.

Right to erasure: In certain circumstances, you have the right to obtain the erasure of your personal data. In such cases, we will take steps to erase, or permanently make unintelligible, such personal data.

Right to restriction of processing: In certain circumstances, you have the right to obtain from us the restriction of the processing of your personal data. In this case, the data will be marked and may only be processed by us for certain purposes.

Right to object to processing: In certain circumstances, you have the right to object, at any time, for reasons related to your particular situation, to the processing of your personal data by us and we may be required to refrain from processing your data personal data, as in the case of the processing of personal data for direct marketing purposes, including profiling if it is connected to this purpose. If you exercise this right, your personal data will no longer be processed by MOTTURA for the purposes referred to in this Privacy Notice unless the Company demonstrates compelling legitimate reasons pursuant to the RGPD to continue processing (eg fulfillment of a legal obligation and / or the ascertainment, exercise or defense of a right in court)

Right to data portability: in certain circumstances, you have the right to receive the personal data concerning you and that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit such data to another entity.

Automated decision making: You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you unless, such decision:

• is authorized by Union or Member State law to which MOTTURA is subject
• is necessary for the conclusion or performance of a contract between you and MOTTURA;
• is based on your explicit consent.

In the latter two cases, you will still have the right to obtain human intervention from MOTTURA as well as to express your opinion and contest the decision.

Furthermore, you have the right to lodge a complaint with the competent supervisory authority which in Italy is the Guarantor for the protection of personal data (the "Guarantor").

Please take into consideration that in certain cases provided for in art. 2-undecies of the Privacy Code, the exercise of the aforementioned privacy rights could be limited, delayed or excluded. In such circumstances, MOTTURA will promptly provide you with a reasoned communication in relation to the aforementioned limitation, delay or exclusion. In any case, you can contact the Guarantor in order to request a verification that the limitation, delay or exclusion of the exercise of your privacy rights are based on legitimate reasons.

In any case, you have the right to revoke your consent, possibly given for one of the purposes of the processing indicated in this information, by sending an e-mail to the address privacy@mottura.it for the attention of: MOTTURA, the Data Protection Manager, or where relevant by accessing the area reserved for you on the "My Profile" website, changing your consent preferences. The withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal.

Send an e-mail to the DPM, at the address privacy@mottura.it for the attention of: MOTTURA, the Data Protection Manager as specified in Annex B, if you wish to make a request in relation to the processing of your personal data. Please note that we may contact you to verify your identity to avoid disclosing your personal data to an unauthorized person, and we may ask you to further specify your request before proceeding. Once your identity has been verified, we will be able to handle the request as required by the law in force. Please note that even if you object to certain processing of personal data, we may continue such processing if permitted or required by law, for example to be able to comply with legal or contractual requirements.

Once your identity has been verified, your request will be handled according to the law in force. Please note that, even if you object to certain processing of personal data, we may continue such processing if permitted or required by law, for example to be able to administer the employment relationship or fulfill contractual obligations towards you.

In the event of complaints about the methods of processing personal data or for further information, please contact the DPM (at the address privacy@mottura.it for the attention of: MOTTURA, the Data Protection Manager). You can also lodge a complaint about the data processing with the competent public authority, for example based on your place of residence, work or where an alleged violation of applicable data protection law has occurred; see Annex B for more information.