Art La Rosa

---

18.4 PRIVACY | INFORMATIVE EX ART 13 of the G.D.P.R. Pursuant to and for the effects of art. 13 of the new Data Protection Regulation (GDPR 2016/679), we inform the Customer (interested party) that:
1. Owner and other designated persons The Data Controller is Art Gallery-Auction house La Rosa S.r.l., with registered office in Catania, Viale Africa n. 12, in the person of the Sole Director, Giacomo La Rosa mail: [email protected].
Treatments made on legal basis Data of a personal nature, freely provided by the Customer to the company based on the activity carried out by virtue of a specific contractual regulation will be processed in a lawful manner, according to correctness, as well as in accordance with the provisions of the regulation, for the purpose of:
- fulfillment of the mandate to sell and/or of participation in the scheduled auctions;
- for the purposes established by the current anti- money laundering legislation (Legislative Decree 231/07 and subsequent amendments).

The provision of the data indicated above is mandatory for the controller to carry out the task assigned to him. In case of refusal to provide the requested data, the controller will find it impossible to perform the contractually provided services, for misconduct of the interested Customer. Data of a personal nature such as the e- mail address, provided optionally by the Customer to the company with specific consent given by the same, will be processed in a lawful and correct manner, as well as in accordance with the provisions from the Regulations for the purpose of forwarding information, updates and news regarding new auctions and/or future events. For such treatment, the company will collect consent with electronic and/or paper modalities.

3. Processing tools and data retention methods
The processed data (which can be classed as: common and identifying) are up to date, complete, relevant and not excessive compared to the aforementioned purposes of the processing. The same data will be processed, in compliance with the security and confidentiality required through the following methods: collection of data from the interested party, registration and storage of the same for the predetermined purposes, explicit and legitimate. The same data will be processed using both paper and electronic and automated means. The personal data will be processed by the Data Controller as well as by employees and collaborators authorized to process them. The data may be communicated, as well as to public bodies’ recipients of the communications/declarations object of this contract, also to the appointed inspection bodies, where required in the phases of verification and control, related to the regularity of the fulfillments. The same data, subject of this information, can be communicated to professionals and/or collaborators controller for the performance of the entrusted assignment and for the same purposes. On the other hand, the data in question will not be disseminated, beyond the limits specified therein, unless otherwise specified by the interested party, provided in writing. It is not the intention of the Controller to transfer the data object of this letter to a third country or to an international organization. It is specified that the external backup is performed by an Italian company too, therefore it is also comply with the privacy law in question, through the use of servers based in the Italian territory. There is no automated decision making process. Finally, we inform the interested party that the controller has put in place a variety of security measures to protect data against the risk of loss, misuse or alteration.

4. Data retention period
The data, subject of this statement, will be kept:
- for 10 years (ten years) from the conclusion of the contractual relationship, for processing operations with a contractual legal basis;
- 5 years from the revocation of consent for treatments with a consensual basis
- no later than 72 hours, regarding the treatment of video surveillance images.

5. Rights of the interested party
The interested party has the right:
- to ask the Controller of the treatment the confirmation or not of the holding of personal data concerning himself, even if not yet registered, and their communication in an intelligible form, as well as the access to personal data, their possible update or integration, correction or cancellation of the same, the transformation of the same into an anonymous form or those processed in violation of the law, the limitation of the treatment that regards them or oppose the treatment itself, in addition to the right to data portability. Moreover, he has the right to obtain an indication of the origin of personal data, their purpose and the modalities of treatment, as well as the logic applied in case of treatment carried out with the aid of electronic devices;
- he may also object in whole or in part to the processing of data concerning himself for the purpose of sending advertising material, direct sale or market research or commercial communication;
- he has the right to withdraw consent at any time, without any prejudice to the lawfulness of the processing carried out in reason to the consent given prior to the revocation, as well as the right to claim a complaint to supervisory authority.