Dear User,

Fincantieri Infrastructure S.p.A., in its capacity as data controller, provides you with the information regarding the processing of personal data of users who consult the reporting site (the "Site") pursuant to Article 13 of EU Regulation No. 679/2016 (the "Regulation").

This information is provided only for the Site and not also for other websites that may be consulted by the user through links.

1. Personal data controller

The data controller of the personal data requested from you (such as your name, surname, e-mail, password and identity document) is Fincantieri Infrastructure S.p.A., P. Iva 01249560329, based in Trieste Via Genova 1, (hereinafter also only the "Data Controller"), pec: fi-operemarittime@pec.fincantieri.it

2 Types of data, purposes and legal basis of data processing

Through the Site, registration data will be collected, if the user intends to register, reporting data and browsing data, and the same will be processed, with the support of computer means, limited to the purposes of technical management of the Site, management of registered users and reports submitted through the Site.

Registration data: the Site requires users who wish to register to enter their data (such as first name, last name, e-mail, password and ID) with the aim of creating access credentials for users. This data is processed on the basis of consent given by users.

Reporting data: users, both registered and unregistered, have the opportunity to enter reports through the Site. In connection with this activity, in addition to the personal data contained in the text of the reports, the Site uses the information already present in relation to registered users while, for non-registered users, it allows the entry of first and last name. In addition, this category includes all personal data referring to individuals who are the subject of the contents of the report itself. These data are processed on the basis of the legitimate interest of the Owner aimed at ensuring proper management of reports under Legislative Decree No. 24/2023, the internal control system implemented under Legislative Decree 231/01 and the management system implemented under the SA8000 ethics certification.

Browsing data: the computer systems and software procedures responsible for the operation of the Site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols. These data are processed on the basis of the legitimate interest of the Owner in order to ensure the proper management and delivery of the Site

This is information that is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data may include the IP addresses or domain names of the computers used by users who connect to the Site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment.

3. Cookies

The Site makes use of cookies as further specified in the relevant cookie policy available on the Site.

4. Recipients of personal data

Your personal data will not be disclosed to third parties, with the exception of third party companies carrying out outsourced activities on behalf of the Data Controller, in their capacity as data processors and in any case always in strict relation to and compatible with the purposes set out above.

5. Transfer of personal data to a third country or international organization

The Data Controller does not intend to transfer your personal data to countries outside the European Union.

6. Period of storage of personal data

Your data will be stored:

- in relation to the purpose of managing the restricted area, for 24 months from the last update or report you made;

- in relation to the purpose of the reporting, for 10 years from the date of first filing of the report.

7. Nature of data provision and consequence in case of failure to provide data

Registration data are optional and processed on the basis of users' consent; a failure to provide them does not allow users to complete registration activities.

The reporting data collected is necessary to enable proper management of the reports themselves.

Browsing data collected are necessary to allow the data subject to navigate the Site.

The navigation data collected is necessary to enable the data subject to navigate the Site.

8. Rights of the data subject

We inform you that as a data subject you have the right to obtain from the Data Controller:

Right of access:

(art. 15 of the Regulations)

i.e. confirmation as to whether or not personal data concerning you are being processed and, if so, the right to obtain, inter alia, access to your personal data and information concerning the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed.

Right of rectification:

(Article 16 of the Regulation)

(i) rectification of inaccurate personal data concerning you without undue delay and (ii) integration of your personal data, if incomplete.

Right to erasure ("right to be forgotten"):

(Article 17 of the Regulation)

erasure of personal data concerning you without undue delay (the Data Controller has the 'obligation to erase without undue delay personal data in the cases provided for in Article 17 of the Regulation).

Right to limitation of processing:

(Article 18 of the Regulation)

Limitation of processing in the cases referred to in Article 18 of the Regulation.

Right to data portability:

(Art. 20 of the Regulation)

receipt in a structured, commonly used and machine-readable format of personal data concerning you and held by us; right to transmit such data to another data controller without hindrance by the controller to whom you have provided them in the cases referred to in Article 20 of the Regulation.

Right to object to processing carried out pursuant to Article 6(1)(e) or (f):

(Article 21 of the Regulation)

Opposition, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you pursuant to Article 6(1)(e) or (f) including profiling on the basis of these provisions.

You will have the possibility at any time to avail yourself of the rights as well as to revoke the consent provided during registration by means of a formal request sent to the pec address privacy@pec.fincantieri.it accompanied by an identity document.

You also have the right to lodge a complaint with the Guarantor for the Protection of Personal Data if you believe that the processing concerning you violates the requirements of EU Regulation No. 679/2016.

The Data Controller is planning to appoint a Data Protection Officer (DPO) who can be contacted at the following pec address: fincantieri-infrastructue@pec.infrastructure.it