Personal data processing privacy policy

1. PERSONAL DATA CONTROLLERS

With this privacy policy (the “Privacy Policy“) we wish to inform you, pursuant to article 13 of EU Regulation 2016/679 (hereinafter, the “GDPR”) and the European and Italian laws that supplement it (“Privacy Legislation“), including the rules on the protection of personal data under Legislative Decree 196/2003 (“Privacy Code“), about the processing of your personal data..

Your personal data will be processed by Hausmann & C. srl, with registered office in Rome, via del Corso no. 406, email: corso@hausmann-co.com, in the person of its legal representatives Benedetto Mauro and Francesco Hausmann, by Hausmann Kron srl, with registered office in Rome, via dei Condotti 35/A, email kron@hausmann-co.com, in the person of its legal representatives Benedetto Mauro and Francesco Hausmann, by Hausmann Cross srl, with registered office in Rome, via dei Condotti 28, email: patek@hausmann-co.com, in the person of its legal representatives Benedetto Mauro and Francesco Hausmann, by Hausmann Trident srl, with registered office in Rome, via del Babuino 63, email: babuino@hausmann-co.com, in the person of its legal representatives Benedetto Mauro and Francesco Hausmann (hereinafter, the “Companies”), each understood to be independent and separate and an independent controller of the processing of personal data, as well as by Hausmann Service Srl (hereinafter Hausmann Service, which carries out direct marketing processing for the Hausmann & Co. Group) with registered office in Rome, Piazza di S. Lorenzo in Lucina, 4, email: service@hausmann-co.com, in the person of its legal representatives Benedetto Mauro and Francesco Hausmann, also as an independent data controller.

The Companies and Hausmann Service, hereinafter jointly referred to as “the Data Controllers“, therefore, inform you of the following.

2. CATEGORIES OF DATA SUBJECTS AND PERSONAL DATA PROCESSED

2.1 We inform you that personal data means any information which the Data controllers have acquired in relation to the Data subjects for the pursuit of the purposes referred to in paragraph 3 below (“Personal Data“). The processing is envisaged of common personal data not belonging to special categories (hereinafter “Common Personal Data“) as well as the processing of special data as per art. 9 of the GDPR where such information has been provided by the Data Subjects in the context of the invitation to events sponsored by the Companies (hereinafter “Special Personal Data“).

2.2 Data Subjects involved in the processing of Personal Data by the Data Controllers are natural persons who are already customers or potential customers who come into contact with the Companies and/or Hausmann Service (hereinafter, the “Data Subjects“).

2.3 The processing of Personal Data relating to criminal convictions and offences is not envisaged.

3. PURPOSE AND LEGAL BASIS OF THE PROCESSING OF PERSONAL DATA

Processing carried out by the Companies

3.1 The Companies shall process the Common Personal Data of the Data Subjects in an independent way, within the scope of their business activity, for the purposes indicated below:

• a) on the basis of contractual obligations, without the express consent of the Data Subjects, pursuant to and for the purposes of article 6, sub-section 1, letter b) of the GDPR to provide sales and assistance services as regards the purchased products and the carrying out of any activity related to such services; such legal basis also applies to the processing required for the organisation and management of events in which the Data Subjects have registered;

• b) on the basis of obligations deriving from national laws and regulations, Community legislation, provisions issued by authorities legitimated by law or by other supervisory and control bodies, without the express consent of the Data Subjects pursuant to and for the purposes of article 6, sub-section 1, letter c) of the GDPR;

• c) for any defensive activity necessary to assert the Data Controller’s rights in court or at a preliminary stage of the proceedings, in accordance with article 6, sub-section 1, letter f or article 9, sub-section 2, letter f) of the GDPR.

• d) the Special Personal Data of the Data Subjects will be processed, following the specific prior consent of the Data Subjects, pursuant to art. 6, sub-section 1, letter a) and art. 9, sub-section 2, letter a) for the processing and communication of Personal Data to catering companies and to companies which organise events sponsored by the Companies or their partner watch manufacturers, in order to meet the specific needs and/or dietary tastes of the Data Subjects;

• e) on the basis of the legitimate interest of the Companies and watch manufacturers in preventing the sale of watches on parallel markets.

Processing performed by Hausmann Service

3.2 Hausmann Service, as an independent data controller, will process the Common Personal Data of the Data Subjects for the purposes indicated below:

• a) with the prior express consent of the Data Subjects, collected in accordance with the Privacy Legislation, to send advertising or direct sales material or to perform market research or commercial communication on latest products, activities and organised events, carried out using any automated contact tool, including automated call systems without operator (so-called pre-recorded phone calls) or in a manner similar to the former (such as: email, SMS, push notifications) pursuant to article 130, sub-sections 1 and 2 of Legislative Decree no. 196/2003 (hereinafter, “Privacy Code”). The consent given for the sending of commercial and promotional communications, on the basis of art. 130, sub-sections 1 and 2 of the Privacy Code, also extends to the traditional methods of contact, such as paper mail and/or calls through the operator. Hausmann Service will ensure that direct marketing initiatives are carried out in a proportionate and non-invasive manner, ensuring that only communications which, based on the information in its possession, are deemed to be of interest or relevant (direct marketing) are sent.

• b) subject to the specific express consent of the Data Subjects, collected in accordance with the Privacy Legislation, to analyse, including with automated tools, the preferences and habits of each in order to promote and/or offer customised goods and services; (profiling).

4. METHODS OF PROCESSING PERSONAL DATA

4.1 In relation to the purposes indicated in paragraph 3 above, the processing of Personal Data is carried out by the Data Controllers in accordance with the Privacy Legislation, in particular:

• i. it is carried out using manual media and also with the aid of electronic or automated media, in any case, capable of ensuring the security and confidentiality of the data, and preventing unauthorised access to the Personal Data by third parties;

• ii. t is carried out directly by the Data Controllers’ organisation and/or by data processors appointed by them.

4.2 All the Personal Data will be kept by the Data Controllers for the time strictly necessary for the pursuit of the purposes for which they were collected, as referred to in paragraph 3 above, respecting the principle of minimization under article 5, sub-section 1, letter c) of the GDPR, without prejudice to any specific legal obligations, including those on the storage of accounting documents. The Special Personal Data will be erased by the Data Controller once the organisation of the event for which they were collected has been completed. In relation to the purposes indicated in section 3.1 letter b) and 3.2 letters a) and b), and in consideration of the fact that the sale concerns goods of considerable value the purchase of which is made on average about every decade, in view of the life cycle of the products sold and the value of the same, the storage of Common Personal Data, without prejudice to any objection to processing, any revocation of consent to processing or any invalidation of the legal basis, is 10 years from the collection of the personal data, or from the last event in which the Data Subjects participated or from the last update of the personal data made or requested by them. At the end of such period, the Common Personal Data will be erased or irreversibly anonymised.

5. COMMUNICATION OF DATA

5.1 In the pursuit of the purposes referred to in paragraph 3 above, the Common Personal Data may be communicated and/or in any case shared with third parties and consultants or suppliers, for the purpose of organising events and providing services requested by the Data Subjects or for administrative, financial and accounting purposes, as well as with other entities which provide services to the Data Controllers and, on a mediation basis, to the Data Subjects. The Common Personal Data will be communicated to watch manufacturers for the purpose of monitoring any sales of watches on the parallel market. The Special Personal Data may be communicated, with the specific prior consent of the Data Subjects, only to the catering companies and to the companies organising events sponsored by the Companies or their partner watch manufacturers, in order to satisfy the specific needs and/or food tastes of the Data Subjects.

5.2 Some of the entities indicated in paragraph 5.1 above will process the Personal Data in their capacity as data processors of the Data Controllers, by virtue of an appointment as external data processor made by them pursuant to and for the purposes of art. 28 of the GDPR. The list of names of the data processors, pursuant to art. 28 of the GDPR, will be made available to the Data Subjects by the Data Controllers upon request.

5.3 Other entities (such as lawful authorities or other supervisory and control bodies) may process the Personal Data received from the Data Controllers as independent data controllers.

5.4 The natural persons, employees and collaborators of the Data Controllers, authorised to process the Personal Data provided by the Data Subjects, act under the instructions of the Data Controllers and subject to confidentiality constraints.

5.5 Personal Data may be communicated, pursuant to art. 6, sub-section 1, letter f) and Recitals 47 and 48 of the GDPR, to companies belonging to the Hausmann Group for administrative and accounting purposes, meaning those related to organisational, administrative, financial and accounting activities, regardless of the nature of the data processed.

6. DISSEMINATION AND TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

Personal Data are not subject to dissemination or transfer to countries outside the European Union or international organisations. If such transfer should become necessary and/or inevitable for organisational reasons, it should be noted that it will only be made to countries considered safe by the European Commission or, in any case, in one of the ways permitted by applicable law and in particular in compliance with the appropriate guarantees under article 46 of the GDPR, for example by signing the Standard Clauses approved by the Commission or on the basis of one of the exceptions provided for in article 49, such as the consent of the Data Subjects.

7. RIGHTS OF DATA SUBJECTS

7.1 The Data Subjects, in relation to the Personal Data held by the Data Controllers, may exercise all the rights provided for by the Privacy Legislation (articles 15-22 of the GDPR) by writing to the email addresses listed in paragraph 1. The Data Subject may, at any time, request access to his/her data, the rectification of inaccurate Personal Data, the erasure of data no longer necessary for the purpose for which they were collected, the restriction of processing of his/her data. Moreover, the Data Subjects may, at any time, object to the processing of their data for the purposes of direct marketing and profiling, request data portability and obtain information regarding profiling. Furthermore, Data Subjects have the right to object to the processing of their Personal Data for the purposes referred to in par. 3.1 letter b) and par. 3.2 letters a) and b) of this privacy policy. With specific reference to the purposes referred to in par. 3.2 letter a), the Data Subjects may exercise this right in a selective manner, i.e., in this case, by objecting, for example, only to the sending of promotional communications using automated media. In relation to the purposes the legal basis of which resides in the consent of the Data Subjects, the latter may revoke their consent at any time without prejudice to the lawfulness of the processing based on the consent given before revocation.

7.2 The Data Subjects may also lodge a complaint with the Supervisory Authority for the Protection of Personal Data, following the procedures and indications published on the official website of the aforementioned authority (www.garanteprivacy.it).

7.3 In order to exercise the rights indicated in this paragraph, as well as for any possible clarification, the Data Subjects may contact the Data Controllers directly by sending an email message or a letter by ordinary mail to the addresses indicated above.

Last update: October 2019