EN
Shareholders privacy

Last update: July 2024

PRIVACY POLICY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

towards Members/Shareholders

The ‘Data Controller’

Tamburi Investment Partners S.p.A., pursuant to Article 4 of the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: “EU Regulation”), is the Data Controller and in implementation of Article 13 of the EU Regulation (“Information to be provided when personal data is collected from the data subject”) provides the following information.

The Data Controller therefore informs you that the personal data acquired, also with reference to existing legal relations, are subject to processing in compliance with the aforementioned regulation. In relation to the aforementioned processing, the Data Controller provides, inter alia, the following information.

‘Personal data’ (pursuant to Article 4 number 1 of EU Regulation 2016/679) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier or to one or more features of his or her physical, physiological, genetic, mental, economic, cultural or social identity;

“Processing” (ex-Article 4 number 2 of the EU Regulation 2016/679), means any operation or set of operations, performed with or without the help of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction.

Such processing must be based on the principles of fairness, lawfulness and transparency, protecting your confidentiality and your rights.

Personal data collected

The personal data collected are essentially inherent to:

  • Identification, personal and contact data (name and surname, address, telephone, e-mail, tax data, etc.);
  • Images and audio and video recordings of meetings, concerning the person concerned;
  • Other non-special categories of personal data relating to existing legal relations, limited to the ownership of shares.

These data are provided directly by the data subject.

Identity and contact details of the Data Controller

Company Name: Tamburi Investment Partners S.p.A.

Registered office: Via Pontaccio 10, 20121 Milan (MI)

Telephone contact details: + 39 02.8858801

Email contact details: TIP@tamburi.it

Contact details of the Data Protection Officer (DPO)

Name and Surname: Avv. Vera Cantoni

Domicile for the designation as DPO: Via Turati 26, 20121 Milan (MI)

Telephone contact details: +39 02.70039991

Email contact details: dpo@tamburi.it

Purpose of processing

The purposes of the processing of personal data are as follows:

  1. the fulfilment of obligations provided for by laws, regulations, EU legislation, or obligations provided for by regulations or instructions issued by Supervisory Authorities in connection with or otherwise related to the holding of shares (including the legislation in force concerning companies listed on regulated markets);
  2. performance of mandatory corporate obligations, including the preparation and maintenance of corporate books;
  3. statistical analysis in aggregate form;
  4. exercising shareholders’ rights and managing relations with them;
  5. sending information material relating to the Data Controller’s activities, by e-mail and other forms of electronic communication.

The following table specifies for each of the purposes identified above the legal basis, the categories of personal data, and the relevant retention period:

TABLE 1

Purposes of the processing for which personal data are intended

Legal basis for processing

Categories of personal data processed

Personal data retention period

Categories of recipients

Purpose 1

Legal obligation

  • Identification and contact details

  • Biographical data

  • Other non-special categories of personal data

Until the end of the holding of the shares and for a subsequent additional period of 10 years

*

Purpose 2

Legal obligation

  • Identification and contact details

  • Biographical data

  • Other non-special categories of personal data

Up to 10 years from the date of the individual shareholders’ meeting, except for any subsequent period connected with the obligation to preserve the company books

*

Purpose 3

Legitimate interest

ex-Recital 47:

Corporate relationship between the Data Controller and the data subject

  • Identification and contact details

  • Biographical data

  • Other non-special categories of personal data

Until the end of the holding of shares

*

Purpose 4

Contract (acquisition and holding of shares)

  • Identification and contact details

  • Biographical data

  • Other non-special categories of personal data

Until the end of the holding of the shares and for a subsequent additional period of 10 years

*

Purpose 5

Legitimate interest

ex-Recital 47:

Corporate relationship between Data Controller and the data subject

  • Identification and contact details

  • Biographical data

  • Other non-special categories of personal data

For the duration of the existing legal relationship

*

*Categories of recipients

The data may be communicated to the following recipients and/or categories of recipients indicated below, or they may be communicated to companies and/or persons, both in Italy and abroad, who provide services, including external services, on behalf of the Data Controller. Among these recipients** their different categories are indicated below:

  • Data Controller’s departments;
  • Accounting management consultants;
  • Computershare S.p.A. and, more generally, providers of services, software and consultancy for corporate and listed company secretariats;
  • Other shareholders attending meetings;
  • Notaries and law firms;
  • IT services company;
  • Data Controller’s control and supervisory bodies;
  • Public authorities, courts and public administrations in general.

(**) More information on the Recipients (ex-art. 4.9 of the GDPR) is available from the Data Controller at the above-mentioned addresses.

The data collected through the audio and video recording system, during the assembly, will not be communicated or disseminated, except at the request of public or judicial authorities in compliance with current legislation.

Transfer of data to non-EU third countries

Tamburi Investment Partners S.p.A. does not transfer personal data to non-EU territory.

Conservation period

Please refer to Table 1, column 4 (retention period).

Rights of the data subject

The data subject, in relation to the personal data covered by this information notice, is entitled to exercise the rights provided for in the EU Regulation below:

  • the data subject’s right of access (Art. 15 of the EU Regulation) (the possibility to be informed about the processing of one’s Personal Data and to receive a copy of it);
  • Right to rectification of one’s own Personal Data (Art. 16 of the EU Regulation) (the data subject has the right to rectification of inaccurate personal data concerning him/her);
  • right to the deletion of one’s own Personal Data without undue delay (‘right to be forgotten’) (Art. 17 of the EU Regulation) (the data subject has, as well as will have, the right to the deletion of his or her own data);
  • the right to limitation of the processing of one’s Personal Data in the cases provided for by Article 18 of the EU Regulation, including in the case of unlawful processing or contestation of the accuracy of Personal Data by the data subject (Article 18 of the EU Regulation);
  • right to data portability (Art. 20 of the EU Regulation), the data subject may request his or her Personal Data in a structured format in order to transmit it to another data controller, in the cases provided for in that Article;
  • the right to object to the processing of one’s own Personal Data (Art. 21 of the EU Regulation) (the data subject has, as he or she will have, the right to object to the processing of his or her own Personal Data);
  • right not to be subject to automated decision-making (Art. 22 of the EU Regulation) (the data subject has, as will have, the right not to be subject to a decision based solely on automated processing).

Further information on the rights of the data subject can be obtained on the company website or by asking the Data Controller for a full extract of the above-mentioned articles.

These rights may be exercised in accordance with the Rules by sending an email to TIP@tamburi.it and dpo@tamburi.it.

Tamburi Investment Partners S.p.A., in compliance with Art. 19 of the EU Regulation, shall inform the recipients to whom the personal data have been communicated, of any rectification, erasure or restriction of processing required, where possible.

If the processing purpose pursued by Tamburi Investment Partners S.p.A. has consent as its legal basis, the data subject has the right to withdraw it at any time by sending an email to TIP@tamburi.it and dpo@tamburi.it.

Pursuant to Article 7 of the EU Regulation, revocation of consent shall not affect the lawfulness of processing based on consent given before revocation.

Right to lodge a complaint

If the data subject considers that his or her rights have been compromised, he or she has the right to lodge a complaint with the Italian Data Protection Authority, in accordance with the procedures indicated by the Authority itself at http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.

Possible consequence of non-disclosure of data and Nature of conferment of personal data

Please note that if the processing purposes have a legal or contractual (or even pre-contractual) obligation as a legal basis, the data subject must necessarily provide the requested data.

Failure to do so will make it impossible for the Data Controller to pursue the specific processing purposes.

Similarly, with regard to the purposes based on a legitimate interest and which do not require consent, the data subject’s objection entails or will entail the impossibility of proceeding with the fulfilment of the respective purposes and any related activities (e.g. participation in the meetings, with non-admission to the same, in the case of objection to audio and video recordings for the purposes of the above-mentioned minutes), for which the data subject respectively objected, without prejudice to the Data Controller’s overriding legitimate reasons or for the purpose of protecting rights in court.

The Company does not use any automated decision-making process.

Processing modalities

Personal data shall be processed in hard copy and computerised form, as well as on audio and video supports, and shall be stored together with the documents produced during the Shareholders’ Meeting in order to document what is transcribed in the relevant minutes, which may be accessed by, and therefore become known to the employees expressly designated by the Data Controller as Persons in charge of and authorised to process personal data, who will be able to carry out any appropriate operation in compliance with the provisions of the law necessary to guarantee, inter alia, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes.

Changes and updates

This notice is valid from the date indicated in its heading.

Tamburi Investment Partners S.p.A. may also make amendments and/or additions to this disclosure as a consequence of any subsequent regulatory changes and/or additions.