RE: legal enactment no. 675 of 31st December 1996.

The Spal company wishes to inform you, pursuant to art.10 of the legal enactment in question, that ordinary personal data regarding your company or business and supplied verbally in the past, as well as information collected in the future in connection with offers and supply transactions, may be handled:

1. For management purposes connected with invoicing and other purposes envisaged by the law;
2. For marketing, promotional or statistical purposes, including the transmission of data abroad, even outside the European Union.

In both cases, the definition of handling of data shall be taken to cover consultation, processing, comparison, interconnection, communication, diffusion, cancellation or destruction of data and any other appropriate handling operation.
It is pointed out that data requested must be supplied in order, not only to comply with the law, but also to fulfil obligations stemming from existing contracts and to secure new agreements. Such data may be handled lawfully and correctly either manually using paper-based media or automatically through computerised systems.
Given the international nature of our organisation, data may be transferred abroad, even outside the European Union, and may be disseminated to our parent or subsidiary companies or companies in which we hold an interest.

The Data Controller is Spal, whose registered office is situated in 42015 Correggio (RE) - Italy - via per Carpi 26/B.

We inform you that your company is entitled, in relation to the handling of data concerning it, to receive the documents and information envisaged by art.13 of the above-mentioned legal enactment.

• Consent to handling referred to under point 1
• Consent to handling referred to under point 2
• Consent to transfer and dissemination of the data (pursuant to art. 20 legal enactment 675/1996).

ART. 13 (Rights of Data Subject/party concerned)

1. With regard to the handling of personal data, the Data Subject (party concerned) is entitled:
   1. to be made aware, through gratuitous access to the register referred to in art.31, par.1, letter a), of the handling of data which may concern him/her;
   2. to be informed of the matters referred to in art.7, par.4, letters a), b) and h);
   3. without delay, through the Data Controller or Processor:
      1. to obtain confirmation regarding the existence of personal data concerning him/her, even if such data are not yet registered, and to receive the said data in intelligible form, with notification of their origin, as well as information regarding the purposes for which they are being or to be handled; a further request may be made for the said information provided, in the absence of justifiable grounds, a period of at least ninety days has elapsed;
      2. to have any data handled in contravention of the law deleted, rendered anonymous or the circulation thereof restricted, including any information which is not required for the purposes for which the data was collected or subsequently handled;
      3. to have the information up-dated, altered or, as the case may be, supplemented;
      4. to obtain confirmation that the measures referred to in the foregoing paragraphs 2) and 3), including details thereof, have been brought to the attention of the parties to whom the data have been transferred or disseminated, unless such action proves impossible or would require means which are grossly disproportionate to the rights being protected;
   4. to oppose, either in whole or in part and upon legitimate grounds, the handling of personal data regarding self, even if such data are relevant, with regard to the purposes underlying the collection thereof;
   5. to oppose, either in whole or in part, the handling of personal data regarding self in connection with the dissemination of sales information or the distribution of advertising material, with direct sales, market research or interactive sales communications, and to be informed by the Data Controller, as soon as the data are disclosed or disseminated, of his/her gratuitous right to exercise such right.
2. In the event that the existence of data regarding him/her self is not confirmed, the Data Subject may be charged a sum in connection with each application made under the foregoing par.1, letter c), number 1), not exceeding the costs actually incurred, in accordance with the procedures and within the time limits established by the provisions contained in art.33, par.3.
3. The rights referred to in par.1 pertaining to personal data regarding deceased subjects may be exercised by any interested party.
4. The Data Subject may, in the exercise of his/her rights under the foregoing par.1, confer rights of attorney or proxy, in writing, upon individuals or associations.
5. 5. These provisions do not affect regulations governing professional confidentiality applying to the journalists' profession, exclusively with regard however, to the source of the news item.