WEBSITE PRIVACY POLICY

Indena S.p.A. ("Company") provides you, pursuant to article 13 of the European Regulation n.2016/679, concerning the protection of natural persons with regard to the processing of personal data (hereinafter referred to as "GDPR"), some information relating to the processing of your personal data when you visit the website www.indena.com (“website”)

Data controller and Data Protection Officer (DPO)

The Data Controller is Indena S.p.A., having its registered office in Milan, Viale Ortles, n. 12, VAT Number 04411780150, e-mail privacy@idbholding.com (“Company” or “Data Controller”).

The Data Protection Officer is Partners4Innovation S.r.l., Via Copernico 35, 20125 Milano (tel. 02/92852779) and can be reached at the e-mail address: dpo@idbholding.com

Data processing purposes, legal basis for data processing and data retention period

Navigation data

The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature, could, through processing and association with data held by third parties, allow users to be identified.

This data category includes IP addresses or the domain names of computers used by users who connect to the website, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc..) and other parameters relating to the operating system and computer environment of the user.

This data is used for the following purposes:

· to obtain anonymous statistical information on the use of the website and to check its correct functioning;

· for technical administration of the website;

· to ascertain any liability in the event of hypothetical computer crimes to the detriment of the website.

This data is deleted immediately after processing.

Data provided voluntarily by the user

In some sections of the website, you will be asked to provide personal information. According to art. 13 of the GDPR relating to the processing of personal data, in relation to the specific purposes pursued you shall find the following information notices in the "privacy" section of the website:

· To apply for open job positions by Indena or to apply spontaneously;

· To subscribe to the newsletter;

· To contact the Data Controller.

Cookieless Tracking Solution

The Company has implemented the Web Site with a tracking solution that proposes pseudoanonymous and cookieless data collection. The Cookie Policy exposes the related functionality.

Cookies

Information regarding the cookies used on this Site can be found at the “privacy” section, in a specific procedure.

Data Provision

With the exception of what has been specified for navigation data, the provision of data for further processing purposes is optional. Failure to provide such data may make it impossible to pursue such further purposes.

Methods of data processing

Your Personal Data will be processed using automated tools and in compliance with the principle of necessity and proportionality, avoiding processing Personal Data if the operations can be carried out through the use of anonymous data or by other means.

Specific security measures are observed to prevent the loss of data, unlawful or incorrect use and unauthorized access.

Data Recipients

Pursuant to art. 28 of GDPR, the Data Controller must appoint the third party companies that process Personal Data on its behalf as External Data Processors to whom appropriate operating instructions are given (hereinafter collectively referred to as "Data Processors"). These subjects are essentially included in the following categories:

· other companies, part of the corporate Group IdB Holding;

· companies that carry out computer systems maintenance services;

Your data may also be processed by third parties, as independent data controllers, namely:

· persons, companies, associations or professional firms that provide assistance and advice (lawyers, accountants, auditors ...).

Your personal data will in no case be disseminated.

Parties authorised to process data

Your Personal Data will be processed by employees and/or collaborators of the Data Controller/Data Processor who have received adequate operating instructions and who have been expressly authorized to process it by the Data Controller/Data Processor.

Any further indications regarding the scope of communication and dissemination of your Personal Data will be provided in the individual sections of the website.

Personal data transfers outside the EU

Without prejudice to the provisions in relation to cookies, your data will not be transferred abroad to non-European countries.

Your rights

In relation to the processing of personal data carried out by the Data Controller, you may ask the data controller for access to the data concerning you, their cancellation, rectification of inaccurate data, integration of incomplete data, limitation of processing in the cases provided for by art. 18 GDPR, as well as opposition to processing in cases of legitimate interest of the data controller.

In the event that the processing is based on consent or contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit them to another data controller without hindrance.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority in the Member State where you are habitually resident or in the State where the alleged infringement has occurred.

In order to exercise your rights, you may contact the Data Controller by sending a written communication to the above address or an e-mail to privacy@idbholding.com

WEBSITE COOKIE POLICY

PRIVACY NOTICE ON THE USE OF THE COOKIELESS TRACKING SOLUTION AND THE PROCESSING OF PERSONAL DATA OF ONLINE USERS - COOKIE POLICY PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”)

DATA CONTROLLER AND DATA PROTECTION OFFICER (DPO)

The Data Controller is Indena S.p.A., having its registered office in Milan, Viale Ortles, n. 12, VAT Number 04411780150, e-mail privacy@idbholding.com (“Company” o “Data Controller”).

The Data Protection Officer can be reached at the e-mail address: dpo@idbholding.com

COOKIELESS TRACKING SOLUTION AND FEATURES

The Data Controller has developed the Web Site by means of a tracking solution, which proposes pseudoanonymous and cookieless data collection.

The solution allows for statistics to develop and improve the Web Site, as well as the user experience of data subjects (e.g., monitoring of the most viewed pages or those with the “404” error, monitoring of the most viewed videos, etc.).

Such a solution does not:

· allow for the creation of unified user profiles because interactions - i.e., the browsing session - have an expiration time of 30 minutes of inactivity by the user;

· involve the use of cookies or other information storage technologies within the users' browsers.

The solution is implemented by default and - unlike cookies, the feature and placement of which is specified below - there is no need to obtain the consent of data subjects browsing the Web Site.

PERSONAL DATA PROCESSED

Navigation data.

WHAT ARE COOKIES

Cookies are data created by a server that are stored in text files on your computer's hard disk or on any device you use to access the Internet (smartphone, tablet) and allow us to collect information about your navigation on the website.

Cookies can be permanently stored on your computer and have a variable duration (so-called persistent cookies), but they can also disappear when you close your browser or have a limited duration (so-called session cookies).

Cookies may be installed by the website you are visiting (so-called first-party cookies) or may be installed by other websites (so-called third-party cookies).

HOW WE USE COOKIES

1.Essential Cookies

a) session/navigation: the use of so-called session cookies (which are not permanently stored on the user's computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to enable the safe and efficient exploration of the site and its applications. The so-called session cookies used in the site avoid the use of other computer techniques potentially prejudicial to the confidentiality of user navigation and do not allow the acquisition of personal identification data of the user. They do not require your consent.

b) persistent cookies: persistent cookies remain on your device even after you leave the website, until you delete them or until they expire. The site creates these cookies and stores them on your device so that they can be read when you visit the site again. This allows, for example, to find, even on subsequent visits to the site, the preferences set (e.g. wish list, shopping cart...). They do not require your consent.

2.Analytics and Functionality Cookie: cookies installed to collect aggregate information of a mainly statistical nature (how long you stay on a web page, number of visitors to the site, etc.).

a) First party analytical cookies: similar to technical cookies as they are installed directly from the website you are visiting to improve their usability. They do not require your consent.

b) Third-Party Analytical Cookies: analytical cookies created and installed by third parties in order to analyze users' browsing in order to generate statistics on visits or to improve the offer of content, to show similar products and to place, if necessary, targeted advertising on web pages. The system used is Google Analytics, which is a web analysis service provided by Google LLC ("Google"). Google Analytics, like other systems, uses "cookies" to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. The user may refuse the use of cookies by selecting the proper settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. Since the IP address is clear, the use of such cookies requires your consent. By clicking on the “ACCEPT SELECTED” button in the banner, the user consents to the placement of selected analytics or functionality cookies; whereas, by clicking on the “ACCEPT ALL” button the user consents to the processing data by Google in the manner and for the purposes stated above.

COOKIE PREFERENCES MANAGEMENT

The consent to the use of cookies is given in one of the following ways:

- by clicking on the “ACCEPT SELECTED” button in the banner containing the brief information, which appears at the moment the user, on first access to the Site, consents to the placement of selected cookies (analytics, functionality or profiling);

- by clicking on the “ACCEPT ALL” button in the banner, the user consents to the placement of all cookies used by the Site;

- by clicking on the “X” button, located at the top right of the banner, the user agrees to continue browsing with the default settings (essential cookies).

HOW TO CHANGE COOKIE SETTINGS

Most Internet browsers are initially set to accept cookies automatically. This means that the user has the possibility, at any time, to set his browser to accept all cookies, only some of them, or to reject them all, disabling their use by the sites. In addition, the user can normally set his browser preferences so that he is notified whenever a cookie is stored on his computer. Finally, at the end of each browsing session, the user can delete the cookies collected from the hard disk of his device. If you wish to delete the cookies installed in the cookies folder of your browser, please note that each browser has different procedures for managing the settings.
By selecting the links below the user can get specific instructions for some of the major browsers:
Microsoft Edge: https://support.microsoft.com/it-it/help/4027947/microsoft-edge-delete-cookies

Google Chrome: https://support.google.com/chrome/bin/answer.py?hl=en&answer=95647&p=cpn_cookies
Mozilla Firefox: http://support.mozilla.org/en-US/kb/Enabling%20and%20disabling%20cookies
Apple Safari: http://docs.info.apple.com/article.html?path=Safari/5.0/en/9277.html
If you do not want to receive Google Analytics cookies, you can do so by logging on to the page: https://tools.google.com/dlpage/gaoptout/
If you want to know more about cookies in general you can visit the page http://www.allaboutcookies.org
If the user wants to know more about online behavioral advertising and privacy, he can visit the page http://www.youronlinechoices.com
If you want to learn more about Google Analytics cookies you can visit http://www.google.com/intl/it/analytics/privacyoverview.html

MANDATORY DATA PROVISION

The personal data processed through the installation of technical cookies and first party analytical cookies are necessary to ensure correct navigation within the website.

It is optional to give your consent to the installation of third-party analytical cookies and profiling cookies. Your personal data will be processed by these cookies only with your express consent, as indicated above.

DATA RECIPIENTS

The data may be processed by external parties operating as independent data controllers such as, for example, supervisory and control authorities and bodies.

The data may also be processed, on behalf of the Company, by external subjects designated as data processors, to whom adequate operating instructions are given. These subjects are essentially included in the following categories:

- companies offering e-mail services;

- companies that offer services instrumental to the pursuit of the purposes indicated in this statement (IT suppliers, companies that deal with the management and maintenance of the site ...)

PARTIES AUTHORISED TO PROCESS DATA

Data may be processed by employees and/or collaborators of the Data Controller/Data Processor who have received adequate operating instructions and who have been expressly authorized to process it by the Data Controller/Data Processor.

PERSONAL DATA TRANSFERS OUTSIDE THE EU

Data may be processed by Data Processors located in extra-EU Countries, whose level of data protection has been deemed adequate by the European Commission under Article 45 of the GDPR.

Your personal data may also be transferred as a result of signing the Standard Contractual Clauses (Standard Contractual Clauses) provided for in Article 46(2)(c) of the GDPR.

DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORY AUTHORITY

With regard to the Tracking Cookieless solution, by contacting the Data Controller via e-mail at privacy@idbholding, data subjects may request access to the Data concerning them, as well as object and/or restriction of processing where applicable. It should be noted that the rights to update, rectify or supplement may in practice only be exercisable during the duration of the session.

Data subjects have the right to lodge a complaint with the competent supervisory authority, pursuant to Article 77 of the GDPR, if they believe that the processing is contrary to applicable law.

With regard to the cookies used by the Web Site, by contacting, via e-mail at privacy@idbholding.com, data subjects can ask the data controller for access to the data concerning them, their cancellation, correction of inaccurate data, integration of incomplete data, limitation of processing in the cases provided for by art. 18 GDPR, as well as opposition to processing in the case of legitimate interest of the data controller.

Furthermore, if the processing is based on consent or contract and is carried out by automated means, the data subjects have the right to receive the data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit them to another data controller without hindrance.

Data subjects have the right to withdraw the consent given at any time for marketing and/or profiling purposes, as well as to object to the processing of data for marketing purposes, including profiling related to direct marketing. Withdraw the consent does not affect the lawfulness of processing based on consent, prior to withdraw.

The data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement has occurred.