Video surveillance system notice

Pursuant to Article 14 of EU Regulation 679/2016 (the "Regulation on the protection of personal data") and in accordance with the General Provision on video surveillance of 8 April 2010 adopted by the Italian Data Protection Authority, as well as Guidelines 3/2019 on the processing of personal data through video devices adopted by the European Data Protection Board, the following information is provided.

Categories of data processed and purposes of processing

WISH IT SRL (hereinafter the "Company") has installed a video surveillance system at its registered office located in Rome, Via G. Botero 15, postal code 00179, in compliance with the above-mentioned regulations, with particular reference to the measures adopted by the supervisory authorities. Specifically, the Company has adopted an intrusion alarm and video surveillance (CCTV) system for the following purposes:

• Protection of company assets, in order to prevent vandalism, damage, theft and assault, and also to facilitate investigative activities by public security authorities.
• Workplace safety requirements, to ensure safety in the work environment for the protection of employees and any persons who access the company premises for various reasons.

Legal basis

The legal basis for processing data through the above-mentioned video surveillance system is the legitimate interest pursued by WISH IT SRL (the Data Controller) pursuant to Art. 6(f) GDPR, in ensuring the safety of assets and people.

Processing methods

Personal data (video footage captured by the cameras) collected through the video surveillance system will be processed solely and exclusively for the purposes indicated, in compliance with the principles of necessity, lawfulness, transparency and fairness, as well as the principles of storage limitation, in accordance with personal data protection regulations.

Processing will take place using a system made up of professional-grade hardware and software components, active 24 hours a day, with logic strictly related to the security purposes indicated and designed to ensure the confidentiality of the data.

Data retention period

Recorded personal data will be retained for a period set at 24 hours, after which it will be automatically deleted from the system, except in cases expressly provided for by law and/or business needs related to holidays or office opening/closing hours (for example, from Friday evening to Monday evening, recorded data will be kept for a maximum of 72 hours), in compliance with the Italian Data Protection Authority's Provision on video surveillance.

Recorded data will not be associated or interconnected with other IT systems; remote access to recordings is prohibited for everyone, except in cases provided for by law regarding criminal offenses. Authorized personnel may hand over the storage media containing the recordings only upon request by public security authorities.

The media on which data is recorded and stored are located in protected premises accessible only to duly authorized personnel in charge of processing. Wish IT has appointed and authorized, in writing, internal staff in charge of data processing pursuant to Art. 29 of EU Regulation 679/2016, providing the relevant instructions and recommendations. Such staff are authorized only to view images in real time, exclusively for carrying out duties related to security purposes or the technical management/maintenance of the systems, and are bound to strict confidentiality.

Disclosure

The data collected and recorded will not be disclosed or disseminated, except where specifically requested by public security authorities and/or judicial police bodies.

Data subject rights

Data subjects — Wish IT employees, external consultants, collaborators, visitors to company premises and anyone who, for any reason, accesses the premises where the cameras are installed — may exercise the rights set out in Articles 15 et seq. of EU Regulation 679/2016, to the extent compatible with the nature and type of data processed.

To exercise their rights, data subjects may submit a specific request by contacting Wish IT's Data Protection Officer (DPO) by email at info@wishsrl.it or dpo@wishsrl.it.

Data subjects who believe that the processing of their personal data violates the Regulation have the right to lodge a complaint with the Italian Data Protection Authority (pursuant to Art. 77 of the Regulation), located in Rome, Piazza Venezia 11, postal code 00187, or to seek appropriate judicial remedy (Art. 79 of the Regulation).

Data controller and processing manager

Data processing operations take place at the Data Controller's premises and are carried out only by personnel authorized and tasked with processing.

The Data Controller is Wish IT Srl, headquartered in Rome, Via G. Botero 15, postal code 00179 — email address info@wishsrl.it, postal address Via G. Botero 15, 00179 Rome, switchboard +39 06/7806570.

The contact details of the Data Protection Officer, appointed pursuant to Art. 37 of EU Regulation 679/2016, are: email dpo@wishsrl.it.

This notice is published on the Company's official website, www.wishsrl.it.