USER PRIVACY NOTICE PURSUANT TO THE EU REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016 N. 679 (THE “GDPR”)

PAREF GESTION , with registered office in Paris, 153 boulevard Haussmann, e-mail rgpd@paref.com, as the Data Controller (hereinafter, the "Company” or the “Controller”), provides this notice about the processing of the personal data collected from the users who browse the website, accessible online at the following address https://www.themedelan.com (the “Website”) and/or who make a request to the Controller about the lease or purchase of properties of the Italian alternative real estate investment fund reserved in closed form, named “Fondo Broggi” managed by the Company (hereinafter, the “Fund”).

The personal data of the Website user (hereinafter, the “User”) are collected directly from the site and are processed in compliance with the provisions of the GDPR, with applicable regulations, and with the present notice according to principles of correctness, lawfulness, transparency and the protection of confidentiality.

1. WHAT TYPES OF PERSONAL DATA ARE PROCESSED BY THE COMPANY?

1.1. Browsing data, technical cookies

Over the course of their normal operation, the procedures and IT systems set up for the website acquire some personal data, the transmission of which is implicit in the use of Internet communication protocols, to allow the User to browse the Website or provide a service requested by said user. The Company uses only technical cookies, without which the viewing of the Website and other operations could not be carried out or would be more complex and/or less secure.

Technical cookies are installed directly by the Controller; since they are used for purposes which are strictly necessary for browsing the Website, the prior consent of the User accessing the Website is not required for their use (storage in the device).

1.2. Data processed following a request for contact or for information made by the User

The User can, through the Website, request to be contacted by the Company in order to receive information about the lease and/or purchase of the of the properties of the Fund promoted through the Website. In this case, the personal data provided voluntarily by the User (also by filling in the specific form on the Website) and transmitted to the Data Controller concern: name and surname, telephone number, e-mail address (“Personal Identifiable Data”).

The personal data indicated in sections 1.1 and 1.2 above are collectively defined as "Personal Data”.

2. FOR WHAT PURPOSES ARE PERSONAL DATA PROCESSED? WHAT IS THE LEGAL BASIS FOR THE PROCESSING?

Personal data are processed for the following purposes.

Browsing data (section 1.1): to carry out the activities necessary to (i) ensure that the services offered are working properly and to allow the User to view the Website safely and efficiently; for these purposes, the consent of the User is not required;; (ii) collect information of a statistical nature in aggregate form to evaluate the effectiveness of the web services; for these purposes, the consent of the User is required. .
Personal Identifiable Data (section 1.2): (i) to meet specific User requests regarding the lease and/or purchase of properties owned by the Fund, promoted by the Website; the legal basis for the processing is the implementation of pre-contractual and contractual measures adopted at the request of the interested party (Article 6, letter b) of the GDPR);
Personal Data (section 1): the transfer of data to third parties for statistics services, as per letter a) above, and/or services of managing or administrating the properties promoted on the Website. Third party recipients of the User's Personal Data are indicated in section 3 below; the legal basis for the processing is the express consent given by the User (article 6, letter a) of the GDPR);
Personal Data (section 1): (i) fulfilment of obligations mandated by applicable law; (ii) the ascertainment of any crimes by the judicial authority; the legal basis for the processing is the fulfillment of a legal obligation to which the Controller is subject (article 6, letter c) of the GDPR);
Personal Data (section 1): (i) the exercise, where necessary, of the Controller’s rights, for example the right to defense in court; the legal basis for the processing is the pursuit of the Controller’s legitimate interest to protect their rights or their right to defense (article 6, letter (f) of the GDPR).

3. WHO HAS ACCESS TO THE PERSONAL DATA? RECIPIENTS OF THE DATA

In carrying out its activity and for the purposes set out in section 2 above, the User's Personal Data may be disclosed to:

• third parties who are involved with the management and administration of the properties promoted through the Website (for example, agents, property managers, facility managers, etc.);

• third parties who carry out statistical activities aimed at evaluating the effectiveness of web services;

• judicial and/or supervisory authorities, supervisory authorities, if they so request;

• companies which are part of the Controller’s group.

Personal data are processed by:

• the Controller’s employees and/or collaborators, who operate on the basis of the instructions provided by the Controller. The system administrator may also have access to the Personal Data during the performance of their duties. The name of the aforementioned subjects may be requested from the Controller, by contacting: rgpd@paref.com;

• the processors appointed for this purpose by the Controller. The list of processors appointed by the Company can be requested at the following e-mail address: rgpd@paref.com

4. WHERE DOES THE DATA PROCESSING TAKE PLACE? ARE PERSONAL DATA TRANSMITTED ABROAD?

The processing of Personal Data is carried out by the Controller mainly in Italy on the Controller’s servers and/or on those of the appointed third-party companies and/or those appointed as processors. With regards to the purposes set out in section 2 above, Personal Data may be transferred to third parties in Europe.

5. HOW LONG WILL THE DATA BE STORED?

Personal data will be stored according to the following criteria:

for the purposes referred to in letter a) of section 2 above, for a period of time not exceeding 365 days from the viewing of the Website by the User, unless a different period of time is required for regulatory compliance;
for the purposes referred to in letter b) of section 2 above, for a period of time not exceeding 365 days from the last request for information sent by the User to the Company regarding the properties promoted through the Website, unless a different period of time is required for regulatory compliance;
for the purposes referred to in letter c) of section 2 above, for a period of time not exceeding 365 days, from the collection of the Personal Data and the related acquiring of the User’s consent, unless a different period of time is required for regulatory compliance, without prejudice to the possibility of the User to exercise the rights referred to in paragraph 7 below in the manner referred to in paragraph 9 of this policy; the User in particular has the right to withdraw their consent at any time without prejudice to the lawfulness of the processing based on their consent prior to the withdrawal;
for the purposes referred to in letter d) of section 2 above, for a period of time not exceeding that required for the fulfillment of regulatory obligation and/or the ascertainment of an alleged crime;
for the purposes of legitimate interests as per letter e) of section 2 above, for the period of time necessary for the pursuit of the Controller’s legitimate interests to protect their rights or their right to defense by the collection of Personal Data.

6. HOW WILL THE DATA PROCESSING BE CARRIED OUT?

The processing of personal data will be carried out using electronic and/or telecommunications tools, with a logic strictly related to the purposes referred to in section 2 above, and in any case in such a way as to guarantee the security and confidentiality of said data.

7. WHAT RIGHTS DOES THE USER HAVE WITH REGARDS TO THEIR PERSONAL DATA?

With regards to their Personal Data, the User may, at any time, exercise the rights provided for in Articles 15 to 22 of the GDPR, in the manner and terms established therein. In particular, the User has the right to:

ask the Controller for access to, correction of, and erasure of browsing data (“right to be forgotten”) which pertain to said User or the limitation of the processing of such data;
oppose the processing of browsing data;
obtain the portability of the browsing data;
withdraw the consent requested by the Controller and potentially given by the user, at any time, and without compromising the lawfulness of the processing based on the consent given before its withdrawal.

8. LODGING COMPLAINTS

In regards to any type of data processed by the Controller, the User has the right — if they believe that the processing of their browsing data has occurred or is occurring in violation of the GDPR and of the applicable regulations at the time, and with no prejudice to their right to file an appeal to any other court — to lodge a complaint with the Supervisory Authority for personal data protection, in the manner indicated on the site www.garanteprivacy.it.

9. HOW TO EXERCISE THE RIGHTS. HOW TO CONTACT THE CONTROLLER

The user can exercise their rights at any time, as per section 7 above, by sending a message to the following address: rgpd@paref.com, or to the Company’s registered office, 153 boulevard Haussmann, 75008 Paris, France.‍

The Data Controller
PAREF GESTION