Samsung Galaxy Book Promotion Privacy Information

Samsung Electronics Italia S.p.A. (SEI), located at via Mike Bongiorno 9 - 20124 Milan, is committed to protecting the online privacy of users of the site https://members.samsung.it/promozioni/book5book4regalanowatch7 ("Samsung Members") as part of the "Samsung Galaxy Book regalano Galaxy Watch7 - Samsung Shop Online e Samsung Experience Store" prize operation (the "Operation"). This document (the "Information") has been prepared to help you understand how your personal data will be processed in the context of participating in the Operation. This Information aims to provide you with the necessary details to participate consciously and informedly.

In general, any information or personal data you provide to SEI within the scope of the Operation will be processed according to internationally recognized principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimization, accuracy, integrity, and confidentiality. This Information relates exclusively to the Operation. Further information regarding the processing of your Personal Data during the potential use of Samsung Members can be found here: https://www.samsung.com/it/info/privacy/.

If you register for the Operation by accessing through your Samsung Account, the processing of your Personal Data will also occur according to the relevant privacy policy. Any communication of Personal Data between SEI and Samsung Electronics Co. Ltd., the data controller for Samsung Accounts, will occur solely and exclusively in execution of your request to participate in the Operation, without prejudice to any further purpose pursued by Samsung Electronics Co. Ltd. and indicated in the relevant policy.

1. Data Controller and Data Protection Officer

SEI, as identified at the beginning of this Information, is the Data Controller for all personal data processed through Samsung Members.

You can contact the Data Protection Officer ("DPO"), unique for all SEI affiliates established in the European Union, at the following address: Samsung Electronics (UK) Limited, Samsung House, 2000 Hillswood Drive, Chertsey, Surrey KT16 0PS, or by writing to: dataprotection.sei@samsung.com.

2. Personal Data Subject to Processing

If you decide to participate in the Operation, SEI will process information that identifies or makes you identifiable (hereinafter "Personal Data"), which may consist of an identifier (such as name, email address, physical address) or one or more characteristics of your identity.

Your Personal Data will be collected when voluntarily provided by you in occasion of your participation in the Operation. The Personal Data processed are as follows:

a. Name, Contact Details, and Other Personal Data

To participate in the Operation, you will be asked to complete the relevant form by entering various information, such as, for example: name, surname, email address, full physical address of residence, phone number, IMEI of the Promoted Product you purchased, and the purchase date of the Promoted Product.

b. Special Categories of Personal Data

When you fill out the forms to participate in the Operation (the "Forms"), you have the option to send SEI image files, such as a photo of proof of purchase of the Promoted Product, or a photo of the label containing the IMEI, located on the lower part of the Promoted Product, through which you participate in the Operation (the "Submission"). However, you may also (voluntarily or not) provide SEI with information that may contain Personal Data.

Through the Submission, you may also, more or less voluntarily, provide SEI with information that may contain Personal Data or special categories of Personal Data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning health or sex life or sexual orientation of a person ("Special Personal Data").

SEI will not process any information that may contain Special Personal Data and therefore invites you not to communicate such Special Personal Data.

c. Third-Party Data Provided by the Data Subject

As mentioned above, through the Submission or the Form, you may send SEI, more or less voluntarily, information that may contain Personal Data of other persons.

In such cases, you act as an independent data controller, assuming all legal obligations and responsibilities. In this regard, you provide the broadest indemnity concerning any dispute, claim, request for damages from processing, etc., that SEI may receive from third parties whose Personal Data have been processed through your use of Samsung Members' functions in violation of applicable personal data protection regulations.

In any case, should you provide or otherwise process third-party Personal Data within Samsung Members or for the Operation, you guarantee from now on – assuming all related responsibility – that this particular processing is based on the consent of the data subject or on another appropriate legal basis that legitimizes the processing of the information in question.

3. Purposes of Processing

SEI will use your Personal Data, collected through Samsung Members, for the following purposes:

• To allow you to participate in the Operation, for the management of activities related to the Operation, and to provide you with any further assistance you may require ("Participation in the Operation");
• To comply with legal obligations that require SEI to collect and/or further process certain types of Personal Data ("Compliance");
• To protect the rights, property, or safety of SEI, its affiliates, business partners, employees, or customers, for example, in the context of legal proceedings, internal investigations, and investigations by competent authorities, as well as to prevent or detect any abuse in participation in the Operation or any fraudulent activity, for instance, by recording the Personal Data of those who have attempted to commit fraud against SEI within the Operation to protect SEI from further attempts, possibly through random checks of participation requirements via video call. Video calls made for this purpose will not be recorded ("Abuse/Fraud").

4. Legal Basis and Mandatory or Optional Nature of Processing

The legal bases used by SEI to process your Personal Data, according to the purposes indicated in the previous Paragraph 3, are the following:

• Participation in the Operation: Processing for this purpose is necessary to allow you to participate in the Operation and, therefore, to follow up on your request and as necessary for the execution of the contract in place with you. Providing your Personal Data to SEI for this purpose is not mandatory, but failure to do so will prevent participation in the Operation.
• Compliance: Processing for this purpose is necessary for SEI to fulfill any legal obligations. When you provide Personal Data to SEI, it will be processed according to applicable regulations, which may involve its retention and communication to Authorities for accounting, tax, or other obligations.
• Abuse/Fraud: Information collected for this purpose will be used exclusively to prevent and/or detect any fraudulent activities or abuses in the use of Samsung Members or participation in the Operation (of criminal relevance).

5. Recipients of Personal Data

Your Personal Data may be shared with the subjects listed below (the "Recipients"):

• Subjects who typically act as data processors, such as individuals, companies, or professional firms providing assistance and consultancy services to SEI in accounting, administrative, legal, tax, financial, and debt collection matters related to the management of the Operation, including those delegated to carry out certain activities related to it;
• Subjects with whom interaction is necessary for the management of SEI's activities (e.g., hosting providers or email sending platform providers);
• Subjects delegated to perform technical maintenance activities (including maintenance of network equipment and electronic communication networks);
• Persons authorized by SEI to process Personal Data necessary to carry out activities strictly related to its business, including in relation to the Operation, who have undertaken confidentiality or have an adequate legal obligation of confidentiality (e.g., SEI employees);
• Samsung Group companies for internal administrative purposes;
• Subjects, entities, or authorities to whom your Personal Data must be communicated for Compliance, Abuse, or Fraud purposes, or by order of the authorities.

6. Transfers of Personal Data

Given SEI's international presence, some of your Personal Data are shared with Recipients who may be located outside the European Economic Area. SEI ensures that the processing of your Personal Data by these Recipients complies with applicable regulations. Indeed, transfers are carried out through adequate guarantees, such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, or other considered adequate guarantees. More information is available from SEI by writing to: dataprotection.sei@samsung.com.

7. Retention of Personal Data

Personal Data processed for the purpose of Participation in the Operation will be retained by SEI for the time strictly necessary to pursue the aforementioned purpose and according to the regulations. In any case, as this Personal Data is processed to allow you to participate in the Operation, SEI may retain it for a longer period, particularly as may be necessary to protect SEI's interests from potential liabilities related to the Operation.

Personal Data processed for Compliance purposes will be retained by SEI for the period required by specific legal obligations or applicable regulations.

Personal Data processed to prevent Abuse/Fraud will be retained by SEI for the time strictly necessary for the aforementioned purpose and therefore until SEI is required to retain it for legal defense or to communicate said data to the competent Authorities.

At the end of the retention period, we delete Personal Data in a way that ensures they cannot be reconstructed or read.

8. Data Subject Rights

You have the right to ask SEI, at any time:

• For access to your Personal Data (and/or a copy of such Personal Data), as well as further information on the processing activities carried out on them;
• For rectification or updating of your Personal Data processed by SEI, should they be incomplete or outdated;
• For the erasure of your Personal Data from SEI's databases, should you consider the processing unnecessary or unlawful;
• For the restriction of processing of your Personal Data by SEI, should you consider your Personal Data to be incorrect, unnecessary, or unlawfully processed, or should you have objected to their processing;
• To exercise your right to data portability, i.e., to obtain in a structured, commonly used, and machine-readable format a copy of the Personal Data provided to SEI concerning you, or to request its transmission to another Controller;
• To object to the processing of your Personal Data, using a legal basis related to your particular situation, which you believe should prevent SEI from processing your Personal Data.

You can exercise your rights by writing to the following address: dataprotection.sei@samsung.com or through our GDPR portal at www.samsung.com/request-desk.

In any case, you always have the right to lodge a complaint with the Supervisory Authority or to appeal to the competent Judicial Authority, should you believe that the processing of your Personal Data is contrary to current regulations. The contact details of all EU Supervisory Authorities are available here: (http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080).