Dear Customer, pursuant to Art. 13 of EU Regulation No. 2016/679 (hereinafter "GDPR") on the protection of personal data, the processing of personal data by CFS PRODOTTI MEDICALI will be based on principles of fairness, lawfulness, and transparency, as well as the protection of confidentiality and the rights of the data subjects. In relation to this, we inform you of the following.

The Data Controller is CFS PRODOTTI MEDICALI S.r.l., with registered office at Via G.B. Guarini 58 – 57121 Livorno (LI), VAT no.: 01883060491, email address privacy@cfs.it.

The information processed concerns your personal, identification, and contact data, such as, by way of example, name, surname, tax code/VAT number, telephone number, email address, bank and payment details, and any other data you communicate at the time of concluding the contract with the Controller. In the context of B2B relationships, personal data may relate to the owner(s), partners, directors, employees, and collaborators of the company or firm requesting the services offered by CFS.

Personal data will be processed for the following purposes:

- Performance of the contract and pre-contractual measures in place with you

Legal basis for processing: performance of the contract: Art. 6, lett. b) GDPR

- Invoicing and obligations required by law in tax and accounting matters, as well as fulfilling obligations generally imposed on the Controller by laws or regulations, EU legislation, or requests from judicial authorities

Legal basis for processing: legal obligations: Art. 6, lett. c) GDPR.

- Customer management and commercial relations

Legal basis for processing: performance of the contract, pre-contractual measures, and legitimate interest of the controller: Art. 6, lett. b) and f) GDPR.

- Measuring customer satisfaction

Legal basis for processing: legitimate interest of the controller: Art. 6, lett. f) GDPR.

- Sending, exclusively to the email address provided by you during the purchase of a product or service, promotional messages regarding goods or services similar to those you have purchased, provided you do not object to such processing using the methods indicated below (so-called "soft spam")

Legal basis for processing: legitimate interest of the controller: Art. 6, lett. f) GDPR.

- In the event that you have voluntarily requested to subscribe to the newsletter service via the appropriate section of the website, your data may be processed to keep you updated on products and services offered by CFS.

Legal basis for processing: express consent: Art. 6, lett. a) GDPR. You may request to stop the service or revoke your consent at any time by clicking on the unsubscribe link found in the emails, and/or by writing to the email address privacy@cfs.it, and/or by accessing the restricted area of the website.

The provision of personal data is mandatory; any refusal, in whole or in part, to transmit the information may result in the total or partial inability of the Controller to execute the contract.

The provision of your data for newsletter subscription is optional.

The personal data collected may be communicated to:

those within the Controller's organization who need them due to their job position. These individuals are persons authorized to process data under the direct authority of the Controller;

third parties to whom the Controller may outsource certain activities and who consequently provide the company with specific instrumental services related to the processing and purposes described above, such as administrative, accounting, tax, and consulting services. These third parties, in accordance with Art. 28 GDPR, carry out processing on behalf of the Controller and are authorized to process them as Data Processors. The updated list of external Data Processors is available upon request at the Controller's registered office;

third parties to fulfill legal obligations, to comply with orders from public authorities, or to follow up on requests from judicial authorities.

Personal data is not transferred abroad to EU or non-EU countries. In the event that this becomes necessary, the transfer will take place only on the basis of standard contractual clauses and adequacy decisions in compliance with the provisions of Art. 44 et seq. of the GDPR.

Data is stored, in compliance with the principles of necessity and proportionality, for the entire duration of the existing contractual or pre-contractual relationship, and potentially for longer periods if required by current regulations in accounting, tax, civil, and procedural matters. Data used for newsletter purposes is stored until you request to stop the service.

The processing of personal data for the purposes indicated above takes place at the Controller's operational headquarters using paper and/or electronic media and tools, and is carried out by internal personnel specifically appointed as persons authorized to process data.

In any case, we guarantee the adoption of appropriate security and confidentiality measures to reduce the risk of destruction, loss, alteration, unauthorized disclosure, or access to the data, or processing that is not permitted or not in accordance with the purposes of collection.

At any time, you may exercise, pursuant to Articles 15 et seq. of EU Regulation 2016/679, the right to:

access the data processed by the Controller, obtain information on certain aspects of the processing, and receive a copy of the processed data (Art. 15 GDPR, Right of access);

verify the accuracy of your data and request its updating or rectification (Art. 16 GDPR, Right to rectification);

obtain the deletion or removal of your personal data by the Controller (Art. 17 GDPR, Right to erasure);

obtain the restriction of the processing of your data when certain conditions apply (Art. 18 GDPR, Right to restriction of processing);

receive your data in a structured, commonly used, and machine-readable format and, where technically feasible, obtain its transfer without hindrance to another controller (Art. 20 GDPR, Right to data portability);

object to the processing of your data when it is based on a legal basis other than consent (Art. 21 GDPR, Right to object). When personal data is processed in the public interest, in the exercise of official authority vested in the Controller, or to pursue a legitimate interest of the Controller, the User has the right to object to the processing for reasons related to their particular situation;

lodge a complaint with the competent supervisory authority for personal data protection (for Italy, the Garante per la protezione dei dati personali, www.garanteprivacy.it) or take legal action if you believe that the processing of your personal data is contrary to the regulations in force.

To exercise the aforementioned rights, you may send a request to the Controller's contact details indicated in this document.