Samsung Electronics Italia Privacy Policy

1. Data Controller and Data Protection Officer

SEI, as identified at the beginning of this Information, is the Data Controller for personal data processed within the Operation. You can contact the Data Protection Officer (DPO) for all SEI affiliates established in the European Union at the following address: Samsung Electronics (UK) Limited, Samsung House, 1000 Hillswood Drive, Chertsey, Surrey KT16 0PS, or by writing to: dataprotection.sei@samsung.com.

2. Personal Data Subject to Processing

For the Operation, SEI will process information that may include your name, identification number, online identifier, or elements characteristic of your physical, physiological, psychological, economic, cultural, or social identity that can identify you (hereinafter referred to as "Personal Data").

Your Personal Data may be collected voluntarily (e.g., when you register for the Operation) or by analyzing your behavior on the Site.

The Personal Data processed includes:

• Name, contact details, and other Personal Data: When you fill out the relevant form on the Site to participate in the Operation, you will be asked to provide information such as name, surname, phone number, fiscal code, email address, full residential address, the serial code of the Promoted Product purchased, and the purchase date.
• Special categories of personal data: When filling out the forms for the Operation (the "Forms"), you may have the option to send SEI image files, such as proof of purchase of the Promoted Product or the label containing the serial code. These submissions may inadvertently contain Personal Data. SEI will not process any information that could contain Special Categories of Personal Data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data relating to sex life or sexual orientation) and advises users not to communicate such data.
• Third-party data provided by the Data Subject: When submitting information via the Invio or the Form, you may also provide information containing third-party Personal Data. In such cases, you act as the independent data controller and assume all legal obligations and responsibilities. You agree to indemnify SEI against any claims arising from the processing of third-party data in violation of applicable data protection laws. You warrant that any such processing of third-party data is based on the third party's consent or another valid legal basis.

3. Purposes of Processing

SEI will use your Personal Data collected during your registration and participation in the Operation for the following purposes:

• Operation Participation: To allow you to participate in the Operation, manage related activities, and provide necessary assistance.
• Compliance: To comply with legal obligations that require SEI to collect and/or process certain types of Personal Data. This may include retention and communication of data to authorities for accounting, tax, or other purposes.
• Abuse/Fraud Prevention: To prevent and/or identify fraudulent activities or abuses within the Operation that may have criminal relevance. Information collected for this purpose will be used exclusively for these aims.

4. Legal Basis and Nature of Processing

The legal bases used by SEI for processing your Personal Data for the purposes indicated in Paragraph 3 are:

• Operation Participation: This processing is necessary to allow your participation in the Operation and to execute the contract or pre-contractual measures. Providing Personal Data for this purpose is not mandatory, but failure to do so will prevent participation.
• Compliance: This processing is necessary for SEI to fulfill legal obligations. Personal Data provided to SEI will be processed according to applicable regulations, which may include retention and communication to authorities for accounting, tax, or other purposes.
• Abuse/Fraud: Information collected for this purpose will be used exclusively to prevent and/or identify fraudulent activities or abuses within the Operation (with criminal relevance).

5. Recipients of Personal Data

Your Personal Data may be shared with the following entities (the "Recipients"):

• Data processors, such as professional firms providing assistance and consultancy to SEI in accounting, administrative, legal, tax, financial, and debt collection matters related to the Operation.
• Entities with whom SEI needs to interact for its business activities (e.g., hosting providers, email service providers).
• Entities engaged for technical maintenance activities, including network and electronic communication systems.
• Individuals authorized by SEI to process Personal Data necessary for business activities related to the Operation, who have undertaken confidentiality obligations or have a legal duty of confidentiality (e.g., SEI employees).
• Samsung Group companies for internal administrative purposes.
• Entities, bodies, or authorities to whom your Personal Data must be communicated for Compliance, Abuse, or Fraud purposes, or by order of authorities.

6. Transfer of Personal Data

Given SEI's international presence, some of your Personal Data may be shared with Recipients located outside the European Economic Area. SEI ensures that the processing of your Personal Data by these Recipients complies with applicable regulations. Transfers are carried out through adequate guarantees, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other appropriate guarantees. For more information, you can write to dataprotection.sei@samsung.com.

7. Retention of Personal Data

Personal Data processed for Operation Participation will be retained by SEI for the time strictly necessary to achieve this purpose. However, SEI may retain this data for a longer period if necessary to protect SEI's interests from potential liabilities related to the Operation.

Personal Data processed for Compliance purposes will be retained by SEI for the period required by specific legal obligations or applicable regulations.

Personal Data processed to prevent Abuse/Fraud will be retained by SEI for the time strictly necessary for this purpose, until SEI is required to retain it for legal protection or to communicate it to competent authorities.

At the end of the retention period, Personal Data will be deleted in a way that ensures it cannot be reconstructed or read.

8. Data Subject Rights

You have the right to ask SEI, at any time:

• For access to your Personal Data (and/or a copy of such Personal Data), as well as further information on the processing activities concerning them.
• To rectify or update your Personal Data processed by SEI, if it is incomplete or not updated.
• To erase your Personal Data from SEI's databases, if you believe the processing is not necessary or is unlawful.
• To restrict the processing of your Personal Data by SEI, if you believe your Personal Data is incorrect, not necessary, unlawfully processed, or if you have objected to their processing.
• To exercise your right to data portability, i.e., to obtain a structured, commonly used, and machine-readable copy of the Personal Data provided to SEI that concerns you, or to request its transmission to another Controller.
• To object to the processing of your Personal Data, based on your particular situation, which you believe should prevent SEI from processing your Personal Data.

You can exercise your rights by writing to dataprotection.sei@samsung.com or through the GDPR portal at www.samsung.com/request-desk.

In any case, you always have the right to lodge a complaint with a Supervisory Authority or to seek judicial remedy before the competent judicial authority if you believe that the processing of your Personal Data is contrary to the applicable regulations. Contact details for all EU Supervisory Authorities are available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.