PRIVACY POLICY

Advanced Solutions for Spine Interventional
and True Motion Imaging on Open MRI
April 21^st 2024, Catania, Italy

Owner of the Data Processing

The Owner of the Data Processing of your personal data is Esaote S.p.A, Via Enrico Melen 77, Genova (the “Company”).

Responsible for Data Protection

We inform you that the Company appointed a Responsible for Data Protection (or “Data Protection Officer” or “DPO”) in order to monitor and advise the Owner about the correct management of the data subjects personal data. The DPO's contacts are the following: dpo.esaote@esaote.com

Processing Legal Basis

Your personal data are processed exclusively under the following condition:

• consent for specific purposes.

The Processing is therefore carried out pursuant to UE Regulation 2016/679 (hereinafter the “Regulation”) and it is limited to what is necessary to carry out relevant activities.

Purposes of the Data Processing

The purposes of your data Processing are the following:

• to contact you to reply to requests for information;
• to create a user account;
• to ascertain your level of satisfaction on the product quality;
• to prepare market studies and researches;
• to carry out marketing activities on products and services of the companies in Esaote Group;
• profiling to promote products and services tailored on your needs and for all the activities listed in the Processing purposes;
• update on Esaote Group activities and news;
• to invite you to Esaote Group events;
• to send you institutional information.

Profiling Activities

Profiling for customization of services and/or products that we offer you contains personal data directly provided by you.

The profiling activities are carried out directly by Esaote S.p.A. and by other subjects in charge for and/or authorized to the data treatment.

Treatment of data for profiling purposes is carried out within the limits of your optional consent. You have the right to oppose at any time to the Processing of the your personal data for profiling purposes.

In the event that we receive your opposition, your personal data will not be processed anymore for profiling purposes. Profiling activities are not carried out automatically.

For this activity the Company identifies the addressees of the institutional and/or commercial communications through non-invasive criteria (e.g: age, residence, job, equipment about which information have been requested, reference organization, etc.). The Company makes a preventive evaluation on the impacts of profiling on the rights, interests and freedom to operate of the addresses. The Company also allows the addresses to suspend benefitting of the profiling service through the opt-out option (revocation of the consent to the Treatment) which is available for any data subject.

Providing personal data by the data subjects is free and optional.

Nevertheless, if you do not provide your personal data, we will not be allowed to address your requests and to create a web account.

Providing personal data for commercial purposes is not mandatory and the data subject is not obliged to give his/her consent to data Processing.

Processing Methods

The Processing activities may include, besides data collection, also data registration, storage, amendment, communication, cancellation, circulation, etc. and will be carried out both through hardcopies and through digital, informatic and telematic tools, and with suitable tools in order to guarantee the security and confidentiality of the data.

Within the limits of the above mentioned specific purposes, data Processing is carried out through manual, digital and telematic tools (e.g.: emails, text messages, telephone calls).

The Company adopts organization and technical procedures to guarantee personal data security and confidentiality.

Data Communication and Circulation

The Company, within the limits of the consent given by you, may have to communicate personal data to third parties:

• marketing and market research companies;
• Esaote Group subsidiary companies or associated companies pursuant to art. 2359 of the Italian Civil Code;
• Public relation companies;
• Service providers;
• Web agency;
• Subjects related to the sales network.

All third parties are appointed Responsible for Data Processing as needed under art. 28 of the UE Regulation on personal data protection.

Data retention

The Company archives personal data complying with proportionality and necessity principles for the necessary period to achieve specific purposes of the Processing, in compliance with contract and/or law requirements.

For more details on data retention, please e-mail to Esaote Privacy Department’s address: privacy.esaote@esaote.com

Rights of the data subjects

Please be informed that you, in your capacity as data subject, can exercise the following rights on data protection:

• Right of access: right to obtain from the Owner the confirmation if Processing of personal data is ongoing and, in the affirmative case, to obtain the access to personal data and to have detailed information on the origin, purposes and categories of the data, of the addressees of the communications, and/or transfer of data etc.;
• Right to amendment: right to obtain from the Owner the amendment of incorrect personal data without any unjustified delay as well as the integration of incomplete data, also providing an integration declaration;
• Right to cancellation (“oblivion”): right to obtain from the Owner the cancellation of personal data without any unjustified delay in the event that:
• Personal data are not necessary anymore for the Processing purposes;
• the consent based on which the Processing is based, is revoked or there is no other juridical basis for the Processing of the data;
• Personal data are illegally processed;
• The personal data must be cancelled pursuant to an obligation of law.
• Right to oppose the Processing: right to oppose in any moment to the Processing of the personal data having as a juridical basis a legitimate interest of the Owner;
• Right to limit the Processing: right to obtain from the Owner a limitation of the data Processing, in the event that the correctness of the personal data is contested (for the period needed by the Owner to check the correctness of personal data), if the Processing is unlawful and/or the data subject opposed to the Processing;
• Right to data portability: right to have the personal data saved in a structured, commonly used format readable through an automatic device and right to transfer the data to another Owner of the Processing only in the event that the Processing is based on the consent or on the contract and only for the data to be processed through informatic tools;
• Right to propose a complaint to a supervising Authority: except for any other administrative or jurisdictional action, the data subject who believes that the data Processing activity breaches the Regulation, has the right to propose a complaint to the supervising Authority of the Country where the subject lives or works or of the Country where the alleged violation occurred.

Please be also informed that you have also the right to revoke, in any moment, the consent that you may have given to specific optional activities and that the Processing carried out before such revocation is lawful.

In order to exercise your rights you may send your requests to: privacy.esaote@esaote.com

The Company provides you information on the activities carried out following your request without any unjustified delay and not later than one month after the request's receipt.

Processed data

Esaote processes the data you provided with the subscription form or when creating the account.

In particular Esaote processes the user's personal data and geographic data and requires information on the data subject profession and on the business sector of interest for the user.

Some data are compulsory in order to contact you and Esaote, with reference to the information provided, transfers the request to the competent resource in the relevant geographic area or business sector.

Filling in some blanks is mandatory (*) in order for Esaote to be able to address your request to the most competent resource in the relevant geographic area or business sector.