Customer Privacy Notice

Notice on the processing of customers’ personal data pursuant to Articles 13 and 14 of Regulation (EU) 679/2016 on the protection of personal data

Last updated: 9 July 2026

Herholdt Controls S.r.l., with its registered office at Via Mestre 13, 20132 Milan (MI), Italy, VAT number and Tax Code 07482370157 (hereinafter also referred to as “Herholdt Controls”, the “Company” or the “Data Controller”), recognises the importance of protecting personal data and proactively undertakes to process them responsibly and in accordance with the applicable principles and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) and/or the national legislation in force.

For this purpose, our Company, as Data Controller, is required to provide you, in your capacity as a “data subject” — that is, the person to whom the data being processed relate — with specific information about our processing of your personal data, which we collect, organise, use, store or otherwise process to establish, manage and/or perform our relationship with you as a customer of Herholdt Controls (the “Customer”).

Accordingly, in compliance with the Regulation, we provide you with the following information through this privacy notice (the “Notice”).

A. Data controller and privacy delegate

The Data Controller is HERHOLDT CONTROLS S.r.l., with its registered office at Via Mestre 13, 20132 Milan (MI), Italy, VAT number and Tax Code 07482370157.

The person appointed by the Data Controller as its delegate for personal data protection, whom you may contact at any time for clarification and to exercise the rights under Articles 15–22 of the Regulation specified below (see Section I of this Notice), is Mr Matteo Maggi.

The Delegate may be contacted by post at the registered office of Herholdt Controls S.r.l., Via Mestre 13, 20132 Milan, Italy, or by email at privacy@hhcontrols.com

B. Categories of personal data processed

Your personal data (the “Personal Data” or “Data”) which are or may be processed by the Company are set out below:

Ordinary personal data

This means information directly or indirectly relating to the Customer that identifies them or makes them identifiable.

This type of data includes, for example: personal details (first name, surname, date of birth, residential address or other contact details, etc.) or email addresses; data enabling indirect identification (such as user ID, landline or mobile telephone number, etc.); tax data (such as tax code, VAT number, etc.); information on professional training; details of the company or organisation to which the Customer belongs; and income/financial data.

Ordinary Personal Data also include “metadata” and technical information associated with the management of the contractual relationship and communications with the Data Controller. For example, the Data collected and processed may include the date and time when requests, communications, orders or reports are sent, received or handled; identifiers associated with the Customer, the contract, orders or open cases; information on the progress of requests and activities performed; and any other technical, administrative or organisational information generated in connection with establishing, managing, performing and monitoring the contractual or pre-contractual relationship with the Customer.

These Data will be processed only to the extent strictly necessary to fulfil the purposes set out in Section C of this Notice.

To ensure that the contractual relationship with its Customers is properly established, managed and performed, Herholdt Controls may also obtain certain Personal Data through its business partners and third-party service providers, who may supply specific information about your purchases of Herholdt Controls products (including, for example, your name, address and the products/services purchased).

C. Purposes and legal bases for processing personal data

Information relating to you will be processed in accordance with the principles of fairness, lawfulness and transparency, while protecting your privacy and your rights.

Your Personal Data are collected and processed for the purposes and on the legal bases specifically indicated below. You may always ask the Data Controller to clarify the specific legal basis for each processing activity and, in particular, to specify whether the processing is based on the law, on a contractual obligation to which you are a party, or on a legitimate interest of the Data Controller.

1. Purposes preparatory to establishing the relationship and entering into the contract, and legal bases

To enable any requests made by the Customer at the pre-contractual stage to be handled (for example, requests to be contacted and/or to receive information about the Data Controller’s products and/or services), or to allow the Company to carry out the steps preparatory to establishing a relationship with you and entering into the relevant contract for the supply of Herholdt Controls products and/or services.

Legal bases

Processing for the above purposes is carried out on specific legal bases: taking pre-contractual steps for the purpose of entering into a contract — see Article 6(1)(b) of the Regulation.

2. Purposes relating to the proper performance of a contract, and legal bases

For the purposes of: (i) enabling Herholdt Controls to properly fulfil its contractual obligations towards you and, therefore, to supply the Company’s products and services; (ii) enabling you to use services connected with the performance of that contract (such as technical support and after-sales services, and customer instruction and technical training services); (iii) sending communications relating to the performance of the contract (including, for example, information and notifications concerning the technical specifications of products or services purchased by the Customer and/or the status and quality of those Herholdt Controls products and/or services); (iv) handling any further requests concerning the products and/or services offered by the Company, or any Customer complaints concerning those products or services; (v) managing the Customer account (order management, invoicing, debt collection, etc.).

Legal bases

Processing for the above purposes is carried out on specific legal bases: performance of a contract to which you are a party — see Article 6(1)(b) of the Regulation.

3. Purposes relating to compliance with legal requirements and/or obligations, or to the exercise of the Data Controller’s rights of defence, and legal bases

Your Data may be processed: (i) for administrative, accounting and management purposes and to fulfil and comply with obligations imposed by law (such as accounting, tax or anti-money laundering obligations), regulations, EU legislation or an order issued by an authority to which Herholdt Controls is subject; (ii) to establish, exercise or defend legal claims.

Legal bases

Processing for these purposes is carried out on specific legal bases: compliance with legal obligations to which the Data Controller is subject — see Article 6(1)(c) of the Regulation — and/or the Data Controller’s legitimate interest in protecting its rights in legal proceedings, with full respect for your rights and freedoms as a data subject — see Article 6(1)(f) of the Regulation.

4. Marketing purposes and legal bases

Where the legal requirements are met, Herholdt Controls may use your Personal Data for: (i) direct marketing activities or the sending of commercial, advertising or promotional communications (by email, fax, post, SMS or MMS), including advertising material and promotional initiatives (also through invitations to events or webinars) relating to the activities, products and services offered by Herholdt Controls; (ii) market research and surveys (by email, fax, post, SMS or MMS) to assess Customer satisfaction and, more generally, to conduct analyses and statistical studies on Herholdt Controls products and services, in order to help us operate more effectively and efficiently, improve the quality of our products and/or services and assess their performance.

Legal bases

Processing for the purposes referred to in point (i) above is carried out on a specific legal basis: the Customer’s express, freely given and independent consent as a data subject — see Article 6(1)(a) of the Regulation.

Processing for the purposes referred to in point (ii) above is carried out on a specific legal basis: the Data Controller’s legitimate interest, with full respect for the data subject’s rights and freedoms — see Article 6(1)(f) of the Regulation.

D. Methods of processing

Your Personal Data, as necessary to achieve the purposes set out in Section C of this Notice, are and will be processed both on paper and using electronic or telematic tools equipped with appropriate security measures to safeguard the data subject’s rights and freedoms and the confidentiality, integrity and availability of the information processed, in accordance with the Regulation, the law and the Company’s internal rules.

E. Whether the provision of data is mandatory or optional

Providing the Company with the Personal Data requested for the purposes set out in points 1, 2 and 3 of Section C of this Notice is optional but necessary: if you refuse to provide the Data, the Company may be unable to carry out activities strictly connected with and/or instrumental to achieving the stated purposes. For example, this may prevent Herholdt Controls from fulfilling your requests, establishing a relationship or entering into a contract with you, or may prevent the Company from performing its obligations under an existing contract with you.

Providing the Company with the Personal Data requested for the purposes set out in point 4(ii) of Section C of this Notice is optional: refusing to provide the Data does not affect the establishment of the relationship and/or the conclusion or performance of a contract with you. It only prevents the Company from conducting market research and surveys to assess Customer satisfaction and, more generally, analyses and statistical studies on its products and services.

Providing the Company with the Personal Data requested for the direct marketing purposes set out in point 4(i) of Section C of this Notice is optional. Direct marketing activities will therefore be carried out only with your express, freely given and independent consent.

If you have any doubts about whether providing your Personal Data is mandatory or optional, we encourage you to contact the Company.

F. Categories of recipients of personal data

Your Personal Data will not be disseminated, meaning that they will not be disclosed to unidentified persons in any manner, including by making them available or accessible for consultation.

Personal Data, or at least some of them, will be disclosed solely and exclusively for the purposes set out in Section C of this Notice to employees and other personnel of the Data Controller within Herholdt Controls’ business functions who are entrusted with processing Personal Data. These persons act under the Data Controller’s authority or delegation, respectively, as Authorised Persons or Delegates for processing, and need to process the Data to perform their duties or delegated tasks, or by virtue of their position. Their number will be kept to a minimum, and they will have access only to the Data relevant to their assigned activities, acting on the instructions provided by the Data Controller or its delegate.

Customers’ Personal Data may also be disclosed, where necessary, to the following categories of recipients:

A. Other companies in the Group to which Herholdt Controls belongs (associated companies, subsidiaries or parent companies) or business partners

Herholdt Controls may share Personal Data with, or make them accessible to, the parent company, Hager Italia Partecipazioni S.r.l., other Italian or foreign companies in its Group (associated companies, subsidiaries or parent companies), or business partners, to facilitate the management and administration of our Customers’ accounts or to enable certain customer support services to be provided.

B. Third-party service providers

Personal Data may be disclosed to third parties providing specific services on behalf of the Data Controller (for example, third-party providers of IT or web system management, maintenance and support services, freight forwarders, marketing services, data analysis services, etc.).

Herholdt Controls may also disclose Personal Data to external consultants, lawyers and advisers, in compliance with applicable personal data protection laws.

C. Other third parties

Herholdt Controls may disclose your Personal Data to other third parties (including any competent judicial or administrative authority): (i) to comply with obligations imposed on our Company by law or regulations, or with an order issued by a judicial or other public authority; (ii) where necessary, to establish, exercise or defend the Data Controller’s rights in potential, threatened or actual litigation with the Customer; or (iii) in the event of a sale or other transfer of all or part of the business conducted by Herholdt Controls.

Where such recipients process Data on behalf of Herholdt Controls, they will be appointed as external Data Processors under a specific contract (or other legal act) binding them to the Company and providing the safeguards required by Article 28 of the Regulation to protect the data subject’s rights and freedoms.

A full list of the Data Processors appointed under Article 28 of the Regulation is available at Herholdt Controls’ offices.

Lastly, please note that any information relating to you may be accessible, directly or indirectly, to the professionals whom the Company has individually identified and expressly appointed as System Administrators. These are technical personnel whose activities involve managing and maintaining the data processing system or its components (for example, overseeing the resources of a computer’s operating system or a database and enabling their use, managing system access credentials, organising network traffic, performing backups, implementing protection measures, etc.).

G. Place of processing and data transfers

Your Personal Data are processed, for the purposes set out in Section C of this Notice, on servers located at the registered office at Via Mestre 13, Milan (MI), Italy, or at the premises of other Hager Group companies within the European Union/European Economic Area.

As Herholdt Controls operates worldwide, your Personal Data may, for the purposes set out in Section C of this Notice, be transferred to companies in the Hager Group, to which Herholdt Controls belongs, located both within and outside the European Union/European Economic Area.

In such cases, any transfer of Personal Data by the Data Controller to countries outside the EU/EEA will take place subject to the appropriate safeguards for the transfer, as provided for in Articles 45 and 46 of the Regulation, or under the derogations set out in Article 49(1) of the Regulation, with appropriate confidentiality and security safeguards in place.

H. Personal data retention period or criteria used to determine that period

Your Personal Data will be retained and processed by the Company for as long as necessary to fulfil the purposes set out in Section C, or for a different period required by applicable law.

In any event, to ensure compliance with the principles of necessity and proportionality of processing, and without prejudice to any additional legal obligations, the Data Controller has established different retention periods for your Data according to the individual purposes pursued:

• For the purposes set out in point 1 of Section C above (requests for information and/or contact — pre-contractual stage), your Data will be retained only for as long as strictly necessary to deal with your requests and/or establish the business relationship;
• For the purposes set out in points 2 and 3 of Section C above (performance of the contract and compliance with legal obligations), your Data will be retained for the entire duration of the business relationship with you, or for a different period required by applicable law. For example, accounting and tax Data will be retained for a maximum of ten years after the business relationship ends;
• For the purposes set out in point 4 of Section C above (marketing), your Data will be retained, as applicable, until you exercise your right to withdraw consent and/or obtain the cessation of processing and, in any event, for no longer than 48 months from collection, depending on the type of product and its degree of obsolescence.

The Data Controller may be required to retain the Data for a longer period, corresponding to the limitation period for the relevant right, in order to comply with legal or contractual obligations or to exercise or defend a legal claim (for example, obligations to retain accounting records, management of any litigation, etc.).

At the end of the retention period, the Personal Data will be deleted. For this reason, once that period has expired, the rights of access, erasure, rectification and portability of Personal Data can no longer be exercised.

I. Data subject’s rights

You may exercise the rights recognised by the Regulation at any time. In particular, in addition to the right to withdraw at any time, under Article 7 of the Regulation, any consent you may have given to processing for specific purposes, you have the following rights:

• Right of access (Article 15 of the Regulation): the right to obtain confirmation as to whether or not your personal data are being processed and, where that is the case, to access your Personal Data and information about:

  1. the purposes of processing;
  2. the categories of Personal Data being processed;
  3. the recipients or categories of recipients to whom your Personal Data have been or will be disclosed;
  4. the Data retention period or, if this is not possible, the criteria used to determine that period;
  5. the existence of your rights, as a data subject, to ask the Data Controller to rectify or erase your Personal Data, to restrict the processing of those Data, and to object to their processing;
  6. the existence of the right to lodge a complaint with the supervisory authority;
  7. the existence of your right, where your Data are not collected from you, to access all available information about their source;
  8. the existence of automated decision-making.
• Right to rectification (Article 16 of the Regulation): the right to obtain the rectification of inaccurate Personal Data concerning you and/or the completion of incomplete Personal Data without undue delay.

• Right to erasure (Article 17 of the Regulation): the right to obtain the erasure of your Personal Data without undue delay, where the limitations laid down in the Regulation do not apply, if:

  • the Data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • consent is withdrawn and there is no other legal basis for the processing;
  • you object to the processing and there are no overriding legitimate grounds for it;
  • the Personal Data have been unlawfully processed;
  • the Personal Data must be erased to comply with a legal obligation;
  • the Personal Data have been collected in relation to the offer of information society services;

• Right to restriction of processing (Article 18 of the Regulation): the right to obtain restriction of processing:

  • where you contest the accuracy of the Personal Data, for a period enabling the Data Controller to verify their accuracy;
  • where the processing is unlawful and you oppose erasure of the Personal Data and request restriction of their use instead;
  • where you need the Personal Data to establish, exercise or defend legal claims, although the Data Controller no longer needs them for processing purposes;
  • where you object to processing by exercising your right to object;
• Right to receive notification (Article 20 of the Regulation): in the event of rectification or erasure of Personal Data or restriction of processing;

• Right to Data portability (Article 21 of the Regulation): the right to receive Personal Data concerning you in a structured, commonly used and machine-readable format, and the right to transmit those Data to another controller, where:

  • processing is based on your express consent for one or more specific purposes or on a contract entered into with you;
  • and processing is carried out by automated means;

  and/or the right to request transmission of that information to another service provider, where technically feasible;

• Right to object (Article 22 of the Regulation): the right to object at any time, on grounds relating to your particular situation, to the processing of Personal Data concerning you;
• Right to lodge a complaint (Article 77 of the Regulation): the right to lodge a complaint about the Company’s processing of your Personal Data with the Italian Data Protection Authority or an equivalent supervisory authority with territorial jurisdiction.

J. Updates to this notice

The Data Controller reserves the right to amend and update this Notice in response to regulatory, technical and/or commercial changes.

You are therefore advised to check it regularly and periodically and to refer to the latest version available in the relevant section of our website: https://www.hhcontrols.com/privacy-and-cookie-policy/

The date of the latest update to this Notice will be indicated at the top of the document.

This Notice cancels and fully replaces all previous notices, which must therefore be regarded as superseded.

Thank you for your attention.