INFORMATION ON THE PROCESSING OF PERSONAL DATA

DATA CONTROLLERArticle 13(1)(a)

In compliance with the provisions of theEuropeanGeneral Data Protection Regulation, Capri Boats Srl(hereinafter referred to as “the controller”), located in Capri, viaLargo Fontana, n. 53, tel. +39 081 6125630, e-mail info@capriboats.com,as Data Controller, provide information in relation to your personal data or those of the subject you exercise legal representation, as well as the rights you may exercise at any time.

Your data will be processed according to the principles of lawfulness, fairness, transparency, security and confidentiality.The data processing will be carried out in an automated and/or manual form, in compliance with the provisions of article 32 of the GDPR 2016/679, by persons specifically appointedand in compliance with the provisions of art. 29 GDPR 2016/679.

PURPOSES OF THE PROCESSINGArticle 13(1)(c)

The personal data you provideare necessary for the following specific purposes:

1. conclusion of the contract to access the service offered by the Data Controller;
2. fulfillment of the pre-contractual, contractual and tax obligations deriving from the relationship with you in place;
3. fulfillment of legal obligations, regulations and Community legislation related to the contract concluded and the services provided;
4. exercise of the rights of the Data Controller, for example the right of defence of legal claims.

LEGAL BASIS FOR THE PROCESSING Article 13(1)(d)

The processing of your personal data, provided for the purposes indicated in points a) to d), is based on the legal basisprovided for in the EU Regulation 679/2016 in art. 6, par. 1, lett. b(“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”).

CATEGORIES OF PERSONAL DATA PROCESSED

The following categories of personal data, concerning the performance or provision of the requested service, are processed: personal and contact detailsandpayment data.

FAILURE TO PROVIDE DATA AND CONSEQUENCES Article 13(2)(e)

Any communication of your personal data, related to the purposes indicated abovein points a) to d), is obligatory, as essential for the execution of the contract; without it, the Data Controller cannot give rise to the execution of the contractual obligations specified therein.

DATA RECIPIENTS Article 13(1)(e)

Your personal data will not be disclosed. They may be processed only by joint data controllers, data processors or by employees, collaborators and consultants who have received specific and adequate instructions and appropriate authorizations.The categories of recipientsare the following:

• banks and lending institutions
• insurance companies
• external professionaldesignated as Data Controller

Furthermore, your personal data may be transferred to other subjects under legal obligations.

DURATION OF THE PROCESSING - PERIOD FOR WHICH THE PERSONAL DATA WILL BE STORED Article 13(2)(a)

In compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to article 5 GDPR 2016/679, your personal data will be kept for no longer than is necessary for the purposes for which the personal data are processed, quantified in ten years.

The period of retention and storage of your personal data, in relation to the purposes a) to d),therefore,is equal to ten years, after which, it will be evaluated the possibility to further use the data, only in cases where the processing is necessary and proportionate to the objectives pursued.

DATA SUBJECTS' RIGHTS

We inform you that you will be able to exercise the rights referred to in the EU Reg. 2016/679, hereinafter described in detail:

• Right of access(article 15)

You have the right to obtain from the Data Controller the confirmation of the existence or otherwise of a processing relating to your data, to know its content and origin, verify its accuracy and, if so, to obtain the accessto these data.

• Right to rectification(article 16)

You have the right to obtain, from the Data Controller, the integration, updating and correction of your personal data without undue delay.

• Right to erasure(article 17)

You have the right to obtain, from the Data Controller, the deletion of your personal data, without unjustified delay,in one of the cases provided for by art. 17(the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, the data subject withdraws consentand where there is no other legal ground for the processing, the personal data have been unlawfully processed, exercise of the right of object, etc.).

• Right to restriction of processing(article 18)

You have the right to obtain, from the Data Controller, the limitation of the processing of personal data in cases expressly provided for by the Regulation: the accuracy of the data is contested, the processing is unlawful and isrequested that its use is limited,the personadataare required for the establishment, exercise or defence of legal claims;opposition to the treatment was proposed for legitimate reasons.

Where processing has been restricted, personal datashallonly be processed with your consent.The Data Controller is required to inform youbefore the restriction of processing is lifted.

• Right to data portability(article 20)

If the processing is done by automated means, you have the right to the portability of your personal data, if the treatment is based on consent or on a contract, as well as the direct transmission of the same to another data controller, where technically feasible.

• Diritto di opposizione(article21)

You have the right to object,on grounds relating to yourparticular situation,at any time to processing of your personal data.

In any case, the Data Controller will make a balance between your interests and the binding legitimate reasons to proceed with processing (including, for example, assessment, exercise or defence of legal claims, etc.).

Requests for exercising the data subject's rights shall be addressed to:

• Capri Boats Srl,
• e-mail: info@capriboats.com,
• by ordinary mail, addressed to:Via Cristoforo Colombo, no. 27,Capri

If a data subject considers that the processing of personal data relating to him or her as performed via this website infringes the Regulation, he or she has the right to lodge a complaint with the Garante:

• e-mail: garante@gpdp.it / urp@gdpd.it
• or by ordinary mail, addressed to: Garante per la Protezione dei Dati Personali, located in Roma (Italy), Piazza Venezia, 11, 00187.