Pursuant to article 13 of Decree Law no. 196, dated 30th June 2003, Scaglia Indeva S.p.A. hereby states that all the personal data received upon and following registration with www.indevagroup.co.uk will be handled, with your consent, only to inform you of our activities, initiatives and events, special offers and sales promotions, and registered user services to which you are entitled, to send you newsletters, to process internal statistics, and to carry on business by means of, but not limited to, the collection of orders. Disclosure of your personal data is optional; partial or total refusal to provide data will make it impossible for some or all of the aims as per point 1) of this notice to be achieved. Notwithstanding your rights under articles 7, 8, 9 and 10 of Decree Law no. 196 of 30th June 2003, it is hereby stated that your personal details will be kept on computer in full compliance with current rules and regulations; they may only be handled by persons authorised by Scaglia Indeva S.p.A. (the list is kept up to date and can be viewed in the archives of DRU at its registered offices) and will not be disclosed or communicated to third parties. Scaglia Indeva S.p.A. takes all the security measures required by law to ensure the protection of personal details received. The collection of sensitive data is excluded from this website. You are entitled to exercise the rights under article 7 of Decree Law no. 196 of 30th June 2003, the complete text of which is given in the enclosure. The holder of the data is Scaglia Indeva S.p.A., 25 Via Marconi 42, Brembilla (BG), represented by the Legal Representative and Managing Director. The principal person responsible for data processing is the Information System Manager; an up-to-date list of the names of the other persons in charge is kept in the Privacy File in the Human Resources Department at Scaglia Indeva S.p.A.

Enclosure: Article 7 Decree Law no. 196 of 30th June 2003 Article 7. Right of access to personal data and other rights 1. The interested party is entitled to demand confirmation of the existence or otherwise of personal data concerning him or her, even if not yet registered, and communication thereof in intelligible form. 2. The interested party is entitled to know: a) the source of the personal data; b) the purpose and processing method; c) the logic applied when the data is processed using electronic tools; d) the identification of the owner, the person in charge and the designated representative pursuant to article 5, sub-section 2; e) the subjects and categories of subjects to whom the personal data may be disclosed or otherwise revealed, being designated representatives in the country in question, or responsible for or in charge of data handling. 3. The interested party is entitled to demand the following: a) updating, correction, or integration of the data if necessary; b) cancellation, conversion into anonymous form or the blocking of data handled in breach of the law, including those which are not required to be kept in relation to the purposes for which they were collected or subsequently processed. c) a statement that the operations as per letters a) and b) and their contents have been made known to those to whom the data were communicated or disclosed, except when this is impossible or requires a clearly disproportionate use of means in relation to the right being safeguarded. 4. The interested party may also totally or partially refuse permission: a) for the processing of his/her personal data for legitimate reasons, even if relevant to the purpose of collection; b) for the processing of his/her personal data, for the purpose of sending advertising or direct sales material or of performing market or business communication surveys.