Information Note on Data Processing

according to the Italian privacy law

Pursuant to article 13 of L.D. 196/03 'Personal data protection code', Reepack Group informs that personal data will be processed according to principles of correctness, lawfulness and transparency in full observance of the right to confidentiality.

The purpose of this document is to make our privacy policy known and to explain how personal information is processed by our organisation when:

A) a contractual relationship is established with our company for the supply of goods or services; B) our on-line services, available on the company web site are used, i.e., by registering for access to the area reserved to customers or by sending a contact request to our operators. Data will be treated exclusively within the sphere of implementing our institutional activities, for administrative, accounting and/or commercial ends; in particular: -in the case mentioned in point A) 1.for requirements in preparation for and preliminary to the stipulation of sale contracts and/or contracts for the supply of services, in order to execute the same and for protection of the credit positions resulting from them;

2.to fulfil any type of obligation contemplated and prescribed by current co-related laws, regulations or provisions and commercial uses, in particular, relating to tax/fiscal matters;

3.for requirements of an operating, logistic and management nature;

4.for requirements relating to monitoring the trend of relations with customers/suppliers and/or for the supply of technical-commercial assistance;

5.for strategic, operating marketing actions and actions always relating to our activity, including the status and availability of products and services, commercial and/or promotional communications on products and services similar to those provided (also by registering to receive our news letter), and analysis of the customer satisfaction level. -in the case mentioned in point B);

6.to allow the provision of the services requested by the customer with registration and creation of the customer’s own account in the reserved area of the company web site;

7.to execute any requests for information or contact that may be sent to us through the special data collection form available on the company web site;

8.for sending information and promotional material relating to the Reepack Group (also by registering to receive our news letter) as a result of the precise request for such material sent through the special data collection form available on the company web site and only where the applicant has given his/her own specific consent regarding this. The procedures adopted to process data shall be used only by explicitly authorised operators, using manual paper-based supports or electronic instruments designed to facilitate achievement of the indicated ends. By the processing of personal data we mean any operation or series of operations, including those carried out without the aid of electronic instruments, concerning the collection, registration, organisation, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blockage, communication, circulation, cancellation and destruction of data, including data not registered in a database. The personal data undergoing processing shall be (art. 11 L. D. 196/03): - processed in a lawful manner and according to correctness;gathered and registered for specific,explicit and legitimate purposes,and used in other processing operations in terms compatible with such purposes; exact and, if necessary, updated; - pertinent, complete and not redundant with respect to the purposes for which the data was gathered or subsequently processed; - kept in a form that allows the subject concerned to be identified for a period of time only strictly necessary for the purposes for which the data has been gathered or subsequently processed.

Personal data is processed using suitable and preventive security measures, pursuant to art. 31 and subsequent articles of L.D. 196/03, in such a way as to reduce to the minimum any risks of destruction or loss, of unauthorised access or processing that does not comply with the purposes of gathering. With regard to acquired and/or potential customers, suppliers and third parties in general, within the sphere of our organisation the processing mainly of common personal data is envisaged. In such a context, no processing of sensitive and/or medical personal data is envisaged; on the contrary, you are invited not to notify any data of this type. The supply of data for achieving the ends mentioned above, from point 1 to point 4, point 6 and point 7, is to be considered as mandatory; failure to supply them will not allow us to successfully establish the relationship, supply products and services, execute any requests for information and, in relation to our suppliers, receive their goods and services. We must specify that, pursuant to art. 24 of L.D. 196/03, processing operations carried out in order to fulfil an obligation prescribed by the law, by a rule or by community provisions, in order to fulfil obligations deriving from a contract to which the subject concerned is party or in order to fulfil specific requests of the subject concerned are not subject to the obligation to obtain consent. The supply of data in order to achieve the ends mentioned above, in point 5 and point 8, is to be considered as optional and would not entail any limitation to the establishment of the contractual relationship or to our response to any requests received via the internet site, unless it is impossible to keep the subjects concerned directly informed about our activity and/or to involve them in any of our special initiatives. Pursuant to art. 130 of L.D. 196/03, the specific consent for processing, at the very time the first formal relationship or the first contact is established is prescribed for sending information and promotional material; such consent may be exercised via the formula found at the bottom of our contractual forms or by flagging the special button at the bottom of the contact form available on the company web site. In observance of the privacy Code and the applicable provisions concerning the rights of the consumer, it will, in any case, be possible to object at any time to such processing when each of our promotional communications are sent, by requesting Reepack Group to do so, at the references at the foot of the page, and also obtaining immediate acknowledgement confirming the interruption of such processing.
In pursuing the illustrated ends, the sphere of communication of the personal data may involve the following subjects: - subjects whose right of access to such data is recognised in virtue of regulatory provisions; - our agents and suppliers, within the sphere of their relevant

Reepack S.r.l. Soc. Unip. Via dell' Artigianato, 19-Italy -24068 Seriate (BG)- T +39 035.2924911-F +39 035.2924931-P.iva 02680950165 Mail: reepack@reepack.com www.reepack.com duties and/or any contractual obligations with them, concerning commercial relations with those concerned; - factoring companies, credit recovery companies, credit insurance companies, private risks centres; - post offices, shipment agents and couriers for sending documents and/or material; - all those individuals and/or corporate bodies, public bodes and/or private bodies (corporate, legal, administration and fiscal consultancy firms, Legal Jurisdictions, Chambers of Commerce, etc.), when the communication is necessary or functional to carrying out our activity; - bank institutes for managing collections and payments deriving from the execution of contracts; - subjects delegated and/or appointed to carrying out activities strictly co-related to the provision of services available on the company web site and to the technical maintenance of the same site (including maintenance of web apparatus and electronic communications networks. Moreover, further categories of individuals to whom personal data may be communicated or who may be made aware of such data, in the capacity of Person in charge of processing (if appointed) or Processing Operators, are: Italian and foreign companies of the Group, employees appointed to internal administration and/or technical management, administrators of the information system through which the data are processed. Under no circumstances may the conferred personal data be subject to circulation.

Reepack Group guarantees all the rights specified in art. 7 of L.D. 196/03, including that of asking for and obtaining updating, correction or, when required, integration of data, cancellation, transformation into anonymous form or blockage of data treated in breach of the law, and the right to totally or partially object, on legitimate grounds, to the processing of the personal data that concern the party involved, even if pertinent to the purpose of the collection. The Data Controller is Reepack S.r.l., in the person of its current legal representative. The Person Responsible for all processing operations, to which any request concerning the information provided herein must be made, is Mr. Valli Livio, who may be reached by post, telephone, fax and e-mail at the addresses and numbers indicated at the foot of this information note.

Date of the last update of the document: 25-07-20016