Statement pursuant to Articles 13 and 14 of EU Regulation 2016/679 Relating to processing carried out for communication and marketing activities

Our work philosophy is always to approach the customer with information deemed to be of actual interest, avoiding invasive or insistent actions that would conflict with our goal of informing and supporting our customers in making the best choices for their own purposes. This document provides information on the processing carried out for communication and marketing activities by the HUMAN COMPANY Group.

Index

1. Data Controller

2. Data processed and its origin

3. Purpose of the processing and legal basis(*) of the processing

4. Methods of data processing and storage

5. Data processors and appointees

6. Who the data may be communicated to

7. Provision of data and consent

8. Rights of the data subject - Contacts

1. Data Controller

The Data Controllers in question are the companies of the HUMAN COMPANY Group, in particular:
> HUMAN COMPANY srl registered office: Via Generale C. A. Dalla Chiesa 13 - 50136 Florence, Italy - Contact details of the Data Protection Officer: rpd@humancompany.com
> Elite Vacanze Gestioni Srl with registered office in Figline e Incisa Valdarno (FI), Via Norcenni 7, tax code/VAT no. 06196120486 - Contact details of the Data Protection Officer: rpd@humancompany.com
and its subsidiaries:
- Figline Agriturismo Srl (Via Spadini 31 - Prato - VAT no. 01681640973) management of Norcenni Girasole Village and Villa La Palagina
- Roma Camping Srl (Via Aurelia 831 - Rome - VAT no. 00954081006) management of I Pini Family Park and Roma Camping in Town
- Elite Livorno Gestioni Srl - (Via Norcenni 7 - Figline e Incisa Valdarno (FI) - VAT no. 05813780482) management of Park Albatros Village and Montescudaio Village
- Delta Srl (Via G. Leopardi 31 - Montevarchi (AR) - VAT no. 01954310510) management of Jolly Camping in Town
- Società Agricola Le Driadi Srl (Via Norcenni 21 - Figline e Incisa Valdarno VAT no. 05627800484) management of Agriturismo Le Corti
- Plus Prague Sro (Privozni 1562/1 - Prague - VAT no. CZ699003294) management of Plus Prague
- Adakitalia Srl (Via Norcenni 7 - Figline e Incisa Valdarno (FI) VAT no. 04719560486) management of Norcenni Tour and Human Travel
- Plus Berlin Gmbh (Warschauer Platz 68 - Berlin - VAT no. DE270699817) management of Plus Berlin
- Elite Veneto Gestioni Srl (Via Norcenni 7 - Figline e Incisa Valdarno - FI - VAT no. 05813690483) management of Altomincio Family Park
- Roma Gestioni Srl (Via Aurelia 831 - Rome - VAT no. 08219321000) management of Fabulous Village
- Elite Firenze Gestioni Srl (Figline e Incisa Valdarno (FI) VAT no. 05813700480) for Plus Florence and Firenze Camping in Town
- La Quarta Srl (Via Generale C. A. Dalla Chiesa 13 - 50136 Florence) VAT no. and tax code 06441820484, Management of restaurant and bar activities
- ECV Shops Srl (Via Generale C. A. Dalla Chiesa 13 - 50136 Florence) VAT no. and tax code 06441810485 Management of markets and bazaars
- O'Tel Srl (Via Generale C. A. Dalla Chiesa 9 - 50136 Florence) [VAT no. 05467430483] | Real estate ownership – business lease
- Holding Terza Srl (Via Generale C. A. Dalla Chiesa 13 - 50136 Florence) tax code 06438440486, holding company for restaurant and market branch
- La Terra dei Sensi Srl (Via Generale C. A. Dalla Chiesa 13 - 50136 Florence) tax code 06717970484, management of the ANTS programme
- Camping International SA (Um Birkelt 1, Larochette, Luxembourg) VAT no.: LU13005324, Management of Camping Birkelt
hereinafter all jointly defined as HUMAN COMPANY

2. Data processed and its origin

The contact details used to send this communication were acquired directly from the data subject themselves, or from parties authorised by them, at the time of the data subject's previous contact with one of the Human Company facilities.

Furthermore, any information acquired during subsequent contact with the data subject and interviews/market surveys carried out by any means (paper questionnaires, phone interviews, completion of online forms, etc.) may be processed.

3. Purpose of the processing and legal basis(*) of the processing

(*) the "legal bases" are the conditions of lawfulness indicated by EU Regulation 2016/679, Articles 6 and 9, in other words the categories of purposes recognised as lawful

The purposes of the processing referred to in this statement are:
a. making first contact in order to request an expression of interest from data subjects and to comply with the obligations imposed by the legislation on the protection of personal data - legal basis(*): -legal- fulfilment [Article 6, paragraph 1, letter c, EU Regulation 2016/679]
b. commercial activity: marketing, advertising, promotional activities. In particular, contact details, postal and email addresses may be used to send courtesy communications and/or promotional/information material about HUMAN COMPANY's products and commercial initiatives - legal basis: legitimate interest consisting in processing, for direct marketing purposes, the email address used by the data subject to purchase a product or service from HUMAN COMPANY [Article 6, paragraph 1, letter f - Italian Legislative Decree 196/2003, Article 130, paragraph 4] – with regard to other addresses: consent of the data subject [Article 6, paragraph 1, letter a, EU Regulation 2016/679].
d. conducting market surveys to improve our products/services - legal basis: legitimate interest coinciding with the purpose [Article 6, paragraph 1, letter f, EU Regulation 2016/679]
f. satisfying requests for information from data subjects - legal basis: legitimate interest of the data subject coinciding with the subject of the request [Article 6, paragraph 1, letter f, EU Regulation 2016/679].

4. Methods of data processing and storage

In relation to the aforementioned purposes, the personal data may be processed, including when managed on behalf of other data controllers by HUMAN COMPANY SRL, with paper, IT and telematic tools. This will always be done ensuring utter confidentiality and relevance, and not exceeding the purposes described above in terms of data recording and retention periods.

The email addresses and other contact details for which the data subject has granted use, including for commercial purposes, will be processed and stored for 12 months following the last sending/contact vis-à-vis the data subject or the revocation of consent; in the latter case, for data subjects with no contractual relationship with the Data Controller, in order to satisfy the data subject's request and not repeat unwanted communications even incidentally.

5. Data processors and appointees

For the same purposes, the data may be processed by the following categories of appointees and/or data processors:
- commercial and IT systems management staff
- our external consultants or suppliers involved in the above activities, appointed as data processors (Article 28, EU Regulation 2016/679) or designated appointees (Article 28, EU Regulation 2016/679)

6. Who the data may be communicated to

The personal data in question may always be communicated within the European Union:
- to our consultants, within the limits necessary to carry out their assignment at our Company, subject to our letter of appointment which imposes the duty of confidentiality and security
- to other entities who need to access the data for purposes related to organising events or conducting market surveys
who will have full control of the processing carried out at their own facilities.
Naturally, all the communication described above is limited only to the data necessary for the recipient to carry out their duties and/or to achieve the purposes connected to the communication itself.

7. Provision of data and consent

Communicating and updating your data, as well as consenting to its processing, are obviously optional.
Not doing so will have no consequence except that the data subject will not be involved in the initiatives promoted by HUMAN COMPANY. It should be noted that any consent given may be revoked at any time without prejudice to the lawfulness of the processing carried out before the revocation.

8. Rights of the data subject - Contacts

The data subject has the right:
> to ask the Data Controller to access and rectify or erase personal data (where no longer necessary; incomplete, incorrect or collected in breach of the law) or limit the processing of personal data concerning them and oppose its processing
> where the processing is carried out by automated (computer) means and to the extent technically possible, to receive any information concerning it in a structured format or have it sent to them or to third parties indicated by them
> to withdraw consent at any time (without prejudice to the lawfulness of the processing based on consent prior to withdrawal), obviously for processing performed on this basis
> if the response to their requests is unsatisfactory or if they deem it necessary, to lodge a complaint with the Italian Personal Data Protection Authority (http://www.garanteprivacy.it/) To exercise their rights, data subjects may send a communication to privacy@humancompany.com, bearing in mind that it will not be possible to respond to requests received by phone if there is uncertainty about the applicant's identity.