Pie Medical Imaging B.V.

INFORMATION ON PERSONAL DATA PROCESSING (EU REGULATION 2016/679)

This document contains information on the processing of your personal data carried out by the companies in Esaote Group. Pie Medical Imaging is a fully owned subsidiary of the Esaote Group. In particular, please find here below the information on the requirements of the EU Regulation on data processing.

Data Controller

Your personal Data Controller is Pie Medical Imaging B.V., Philipsweg 1, 6227 AJ Maastricht, The Netherlands (hereinafter, “Company”).

Data Subject

An identifiable natural person who can be identified, directly or indirectly by reference to physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Responsible for Data Protection

We inform you that the Company appointed a Data Protection Officer (hereinafter, “DPO”) in orderto monitor and advise the Data Controller about the correct management of data subjects’ personaldata. The DPO’s contact details are the following: dpo.pmi-nl@esaote.com.

Processing Legal Grounds

Your personal data, meaning any information relating to an identified or identifiable natural person(‘Data Subject’), are processed exclusively under the following condition:

1. consent for specific purposes.

The Processing is therefore carried out pursuant to EU Regulation 2016/679 (hereinafter the“Regulation” or “GDPR”) and it is limited to what is necessary to carry out relevant activities.

Purposes of the Data Processing

The purposes of your Data Processing are the following:

• to contact you to reply to requests for information;

• to create a user account;

• to ascertain your level of satisfaction on the product quality;

• to prepare market studies and researches;

• to carry out marketing activities on products and services delivered by Company;

• profiling to promote products and services tailored on your needs and for all the activities

  listed in the Data Processing purposes;

• update on Company activities and news;

• to invite you to Company events;

• to send you institutional information.

Profiling Activities

Profiling for customization of services and/or products that we offer to you involves the processing of personal data directly provided by you.

The profiling activities are carried out directly by Company and by other subjects in charge for and/or authorized to the Data Processing activity.

Data Processing activities for profiling purposes are carried out within the limits of your consent. You have the right to oppose at any time to the Data Processing of your personal data for profiling purposes.

In the event that we receive your opposition request, your personal data will not be processed anymore for profiling purposes. Profiling activities are not carried out automatically.

Through this activity, the Company identifies the recipients of the institutional and/or commercial communications using non-invasive criteria (i.e. age, residence, job, equipment about which information have been requested, reference organization, etc.). The Company makes a preventive evaluation on the impacts of profiling on the rights, interests and freedom of the data subjects. The Company also allows the data subjects to suspend the profiling activity through the opt-out option (withdrawal of the consent previously given).

Providing personal data is free and optional.

Nevertheless, if you do not provide your personal data, we will not be allowed to address your requests and to create a web account.

Providing personal data for commercial purposes is not mandatory and the Data Subject is not obliged to give his/her consent to Data Processing.

Processing Methods

The Data Processing activities may include, besides data collection, also data registration, storage, amendment, communication, erasure, communication, etc. and will be carried out both through manual digital, informatic and telematic tools (i.e. emails, sms, telephone calls), and with suitable tools in order to ensure the security and confidentiality of the data.

The Company adopts organization and technical procedures to ensure personal data security and confidentiality.

Data Communication and Circulation

The Company, within the limits of the consent given by you, may have to communicate personal data to third parties:

• marketing and market research companies;

• Esaote Group or associated companies;

• Pie Medical Imaging B.V. 

• Public relations companies;

• Service providers;

• Web agencies;

• Subjects related to the sales network.

All third parties are appointed Processor for Data Processing as required by art. 28 of the EU Regulation on personal data protection.

Data retention

The Company archives personal data complying with proportionality and necessity principles for the necessary period to achieve specific purposes of the Data Processing, in compliance with contract and/or law requirements.

For more details on data retention, please e-mail to PMI Privacy Department’s address:

privacy.pmi-nl@esaote.com

Rights of the Data Subjects

Please be informed that you, in your capacity as Data Subject, can exercise the following rights about data protection:

1. Right to access: right to obtain from the Controller the confirmation if Data Processing of personal data is ongoing and, in the affirmative case, to obtain the access to personal data and to have detailed information on the origin, purposes and categories of the data, of the recipients of communications, and/or transfer of data etc.;

2. Right to amendment: right to obtain from the Controller the amendment of incorrect personal data without any unjustified delay as well as the integration of incomplete data, also providing an integration declaration;

3. Right to erasure (“right to be forgotten”): right to obtain from the Controller the erasure of personal data without any unjustified delay in the event that:

   • Personal data are not necessary anymore for the Processing purposes;

   • the consent on which the Processing is based, is withdrawn or there is no other legal

     ground for the Data Processing;

   • Personal data are illegally processed;

   • Personal data must be erased pursuant to an obligation of law.

4. Right to objection: right to object in any moment to the Data Processing of the personal data having as a legal ground a legitimate interest of the Controller;

5. Right to limitation: right to obtain from the Controller a limitation of the Data Processing, in the event that the correctness of the personal data is contested (for the period needed by the Controller to check the correctness of personal data), if the Data Processing is unlawful and/or the data subject opposed to the Data Processing;

6. Right to data portability: right to have the personal data saved in a structured, commonly used format readable through an automatic device and right to transfer the data to another Data Controller only in the event that the Data Processing is based on the consent or on the contract and only for the data processed through informatic tools;

   Pie Medical Imaging B.V., Philipsweg 1, 6227 AJ Maastricht, The Netherlands Tel: +31433281328, Fax: +31433281329
   E-mail: pmi@pie.nl , Website: www.piemedicalimaging.com

7.  Right to lodge a complaint to a supervising Authority: except for any other administrative or jurisdictional action, the data subject who believes that the data Data Processing activity breaches the Regulation, has the right to lodge a complaint to the supervising Authority of the Country where the subject lives or works or of the Country where the alleged violation occurred.

Please be also informed that you have also the right to withdraw, in any moment, the consent that you may have given to specific optional activities and that the Data Processing carried out before such withdrawal is lawful.

In order to exercise your rights you may send your requests to: privacy.pmi-nl@esaote.com.
The Company provides you information on the activities carried out following your request without any unjustified delay and not later than one month after the request’s receipt.

Processed data

Company processes the data you provided with the subscription form or when creating the account.

In particular, Company processes the user’s personal data and geographic data and requiresinformation on the data subject profession and on the business sector of interest for the user.

Some data are necessary to contact you and Company, with reference to the information provided, may communicate the request to the competent resource in the relevant geographic area or business sector.

Filling in some blanks is mandatory (*) in order for Company to be able to address your request to the most competent resource in the relevant geographic area or business sector.