DATA PROTECTION DECLARATION/INFORMATION FOR THE ASSIGNMENT GIVEN.

ON A PRELIMINARY BASIS

This Data Protection Declaration (hereinafter also referred to as ‘Declaration’) is submitted as an annex to the contract of employment.

In accordance with the provisions of the DPA, in particular: the processing of personal data by the employer is governed by the general principles (Art. 6-8 DPA), the provisions concerning the right of access (Art. 19, 25-26 DPA):

a) Personal data: personal data means all information relating to a natural person that enables him or her to be identified directly or indirectly (e.g. first name, surname, home address, nationality), contact details (e.g. telephone number, email address) that DOS Group SA collects on its own or is provided by a customer, a member of its staff or other contact persons as part of the assignment received.

b) Data controller/processor: the data controller is Stefano Doninelli, who can be contacted by post at the registered office of DOS Group SA, Via Rime 38,6850 Mendrisio or at the e-mail address privacy@dos-group.com

c) Purposes of data processing: personal data is processed by DOS Group SA for a specific purpose and personal data is processed in order to fulfil this purpose. In particular, personal data are processed, within the limits of the applicable law, for the following purposes: management and execution of the assignment given, including invoicing for services and possible debt collection. In addition, we process the contact data of the customer, his employees or other contact persons for marketing purposes, in order to provide information on publications, events, new services or products that may be of interest to the customer.

d) Legal basis of the processing: the processing of the Customer’s personal data is based on the Customer’s express and undersigned free consent, and is necessary for the performance of the assignment given, for the services or products requested, or to fulfil the contractual obligations undertaken.

e) Data retention: Personal data is retained for as long as is necessary to carry out the task assigned, but in any case for the period of retention or reporting required by law (10 years), or as long as there is an overriding public or private interest. DOS Group SA shall take all appropriate and proportionate measures according to the state of the art to protect personal data against loss, unauthorised modification or unlawful access by third parties. Insofar as the customer provides personal data to DOS Group SA via third parties (e.g. its employees or other contact persons), it is the customer’s responsibility to inform them fully about the processing of personal data carried out by DOS Group SA. The objectives mentioned above are based on a legitimate interest in the processing of personal data, and some processing is also necessary to fulfil the contractual obligations of DOS Group towards the customer.

f) Disclosure of personal data: the Client’s personal data will not be disclosed to third parties without the consent of the person concerned. However, consent is presumed in cases where the communication of personal data is closely related to the assignment or is necessary for the purposes prescribed in this Declaration. DOS Group SA informs the customer that it may possibly use external service providers or cloud service providers in Switzerland or abroad to carry out the assigned task. DOS Group SA only uses cloud service providers/suppliers based abroad if the foreign country guarantees adequate and equivalent protection of personal data.

g) Rights of the data subject: the customer has the right to obtain information on the personal data recorded and stored on him/her at DOS Group SA (in principle within 30 days of the request), to know the purpose of the processing, to delete it, to restrict its processing, to object to its processing and to appeal to a supervisory authority (DPA), unless exceptions are made by law (Art. 26 DPA). Insofar as the law authorises or requires it, certain requests may in fact be refused. Therefore, DOS Group SA reserves the right to retain personal data or continue to process them in another way, despite a request from the customer to delete or limit the processing of data. The customer can exercise his/her rights with a written request sent to the address of the registered office of DOS Group SA addressed to the attention of the data controller Stefano Doninelli. In any case, DOS Group SA undertakes to treat and guarantee the rights of the customer in accordance with the law.

Should you, your employees or other contact persons have any questions or assert any data protection rights or those of the persons concerned, you may contact DOS Group SA at the email address privacy@dos-group.com or at the registered office, Via Rime 38, 6850 Mendrisio.

Therefore, taking into account the information given to me in accordance with the mentioned articles of the DPA, I acknowledge the processing of my personal data for the purposes described in the aforementioned Declaration/Information.

*Document revised on 29/12/2023