Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

The undersigned professional association informs you that for the establishment and management of the professional relationship with you, it is the Data Controller of your personal data.

1. OBJECT OF THE PROCESSING
   The Data Controller processes personal identification data (such as: name, surname, company name, address, phone number, email address, bank details, and payment information) — hereinafter also referred to as “personal data” or “data” — provided by you upon entering into a professional mandate contract or during any negotiations aimed at concluding the contract.

2. PURPOSE OF THE PROCESSING
   The collection and processing of data are carried out for the following purposes: a) Compliance with all operations required by legal obligations, fiscal and tax provisions related to business activities, and regulations on anti-money laundering; b) Establishing and executing ongoing professional relationships; c) Operations strictly connected and instrumental to the initiation of a professional relationship, including the acquisition of preliminary information for the conclusion of the professional mandate contract; d) Management of relationships with you for administrative, accounting, invoicing, ancillary services, and handling any disputes; e) Sending informational material for further study of legal topics.

The processing will be carried out in accordance with principles of fairness, legality, transparency, and protection of your privacy and rights. Your personal data will be processed throughout the duration of the contractual relationships established and also subsequently, for the fulfillment of all legal obligations.

In relation to the professional mandate relationship, the Data Controller may process data defined as "sensitive" (Article 9 GDPR), which may include, for example: racial or ethnic origin, general health status, sexual life, suitability for certain work tasks, membership in a union, political party affiliation, or holding public office, religious beliefs.

1. ANTI-MONEY LAUNDERING
   The provision of data required by anti-money laundering laws is mandatory. Refusing to provide this data would prevent the requested professional service from being rendered and could lead to the reporting of the operation to the relevant supervisory authority. Specifically, the processing of data related to anti-money laundering obligations will occur following the execution procedures imposed on non-financial operators by the regulations on identification and retention of information under Article 3, Paragraph 2 of Legislative Decree no. 56/2004 and adopted with Ministerial Decree no. 143/2006. Additional information may also be obtained from public sources to comply with the obligations set out in Legislative Decree no. 231/2007.

2. PROCESSING METHODS
   Data processing for the above purposes is carried out through operations of collection, recording, organization, storage, consultation, processing, modification, selection, extraction, use, blocking, communication, and cancellation. These operations may be automated, using electronic or magnetic support, or non-automated, on paper. The tools used for data processing will ensure, as far as reasonable and according to the state of the art, the security and confidentiality of the data through the use of appropriate procedures to prevent the risk of loss, unauthorized access, illegal use, or dissemination.

3. LOCATION OF PROCESSING
   Data will be processed and stored at the registered office of the professional association “Studio Legale Vial Dolcetta & Associati,” the data controller, in Fonte (TV), Via Gaidola, No. 28. The data may also be processed, on behalf of the Data Controller, by professionals and/or companies hired to carry out technical, development, managerial, and administrative-accounting activities.

4. OBLIGATORY OR OPTIONAL NATURE OF DATA PROVISION
   Some data are essential for the establishment or execution of the contractual relationship, while others are considered supplementary for such purposes. The provision of data is mandatory only for data required by law or contract.

5. CONSEQUENCES OF REFUSAL TO PROVIDE DATA
   In cases where the provision of data is required by law or contract, refusal would put the Data Controller in a position where it cannot execute or continue the contract, as it would constitute illegal processing. In cases where no legal obligation exists, refusal to provide data would not have the above consequences but would prevent the execution of accessory operations.

6. COMMUNICATION OF DATA
   Subject to communications necessary for compliance with legal and contractual obligations, all collected and processed data may be communicated in Italy or abroad to:

• Professionals and consultants, consulting companies, credit institutions, credit insurance companies;

• Public and private entities, following checks or inspections, such as: tax authorities, police, judiciary, Italian Foreign Exchange Office, labor inspection, local health units, pension institutions, chambers of commerce, etc.;

• Other subjects authorized by law to access your data.

Additionally, during the control and maintenance of the company’s IT network, the following categories of internal and external personnel may become aware of the data:

• System administrators of the company’s IT network.

Sensitive data, even when processed anonymously, will not be disseminated or transferred unless strictly related to collaboration with entities involved in the development, implementation, and assistance for software we develop and/or market, exclusively for the stated purposes and with your specific authorization.

1. DATA STORAGE TIME
   The data provided will be stored in our archives according to the following parameters:

• For administrative, accounting, assistance, invoicing, ancillary services, and management of potential disputes: 10 years, as established by law under Article 2220 of the Civil Code.

1. RIGHTS OF THE DATA SUBJECT
   With regard to personal data processed, the data subject can, at any time:

• Request confirmation of the existence of their personal data;

• Obtain the correction or deletion of the data;

• Request the restriction of processing;

• Obtain data portability, i.e., receive the data from the Data Controller in a structured, commonly used, and machine-readable format, and transmit it to another Data Controller without hindrance;

• Object to automated decision-making processes, including profiling;

• Lodge a complaint with a supervisory authority.

It is understood that the mandatory obligations specified in the applicable law at the time of the request for revocation and as outlined in points 6 and 7 of this information will remain in place. In any case, the right to withdraw consent at any time does not affect the legality of processing based on consent before the withdrawal.

1. DATA CONTROLLER AND PROCESSING MANAGER
   The Data Controller to whom the data subject can address requests to exercise their rights is Ludena S.n.c. of E. Novara and M. Raviolo. The internal processing managers are Elisabetta Novara and Melissa Raviolo. The system administrators are Elisabetta Novara and Melissa Raviolo. Rights may be exercised by the data subject by sending a written request to Ludena S.n.c., at the registered office address or by email at info@lumierebeautycare.it.

Date: _______________

DECLARATION OF CONSENT
The data subject declares that they have received complete information and gives consent to the processing of personal data and the communication of their personal data as specified in the information. All authorizations provided by the data subject may be revoked at any time through a registered letter with return receipt or certified email (PEC), and such revocation will take effect only from the day following receipt of the registered letter or PEC, subject to compliance with treatments imposed by current regulations.

DATE
CUSTOMER NAME
STAMP AND SIGNATURE