Data protection

The controller is: CMP EUROCOSTRUZIONI SA Via Lugano 13 · World Trade Center 6982 Agno · Canton Ticino · Switzerland UID: CHE-113.264.477 E-mail for privacy matters: info@cmp-eurocostruzioni.ch No Data Protection Officer under Art. 37 GDPR and no data protection adviser under the revFADP have been appointed, as the legal conditions do not apply. Please address any request to the e-mail above.

• Data you provide through the contact form: first name, last name, company, e-mail address, telephone, location, type of request, subject and message. • Data you provide to request a meeting: full name, e-mail, telephone, preferred date and time slot, topic of the meeting. • Browsing data: page visited, date and time, browser language, device and browser type, referring site, truncated IP address (the last block is replaced with 0 before storage) and the country/city estimated from that truncated address. • Client data: identification, contact, contractual and invoicing data, processed outside the website within the engagement. Please do not enter special category or particularly sensitive data in free-text fields (for example health, political or religious views) unless strictly necessary for your request.

• Replying to requests sent through the contact form or the meeting request — data: name, e-mail, telephone, message — legal basis: Art. 6(1)(b) GDPR (pre-contractual measures taken at your request) and, for Switzerland, lawful and proportionate processing connected with your request (Arts. 6 and 31 revFADP) — retention: as long as needed to reply and, if no engagement follows, 12 months. • Performing the engagement and managing the client relationship, including invoicing — legal basis: Art. 6(1)(b) and (c) GDPR; contract performance and legal obligations under Swiss law — retention: duration of the relationship and 10 years for accounting and tax records (Art. 958f CO). • Website security, abuse prevention and anonymous visit statistics — data: truncated IP address, browsing data — legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and proper operation of the site); overriding interest of the controller under the revFADP — retention: 12 months in anonymised form. • Complying with legal obligations and defending our rights, including in court — legal basis: Art. 6(1)(c) and (f) GDPR — retention: statutory and limitation periods. We do not send newsletters and we do not carry out direct marketing through the website. Where processing relies on legitimate interest we have assessed that our interest does not override your rights and freedoms; you may object at any time (section 8).

Providing the fields marked * is necessary to answer your request: without them we cannot reply. All other data is optional and withholding it has no consequence. Submitting the form does not require your consent to processing, because the processing is necessary to deal with the request you send us.

Data is processed by authorised people within our organisation. The following providers may receive it as processors under Art. 28 GDPR and Art. 9 revFADP: • Emergent Labs, Inc. (United States) — hosting and infrastructure of the website and database; • Resend, Inc. (United States) — sending the notification and confirmation e-mails for the forms; • Telegram FZ-LLC (United Arab Emirates) — forwarding notifications of new contact and meeting requests to the administrator (they contain the data you entered in the form); • ipwho.is — geolocation service that receives only the already truncated IP address to estimate the country and city of the visit; • technical, legal, tax and IT advisers bound by confidentiality. Data may be disclosed to public authorities where the law requires it. We do not sell your data and do not disclose it to third parties for marketing purposes. An up-to-date list of recipients is available at info@cmp-eurocostruzioni.ch.

Data is processed in Switzerland and in the European Union and may be processed by the providers listed in section 5 also in the United States and, limited to administrator notifications, in the United Arab Emirates. Switzerland benefits from an adequacy decision of the European Commission. For countries without adequate protection, transfers rely on the standard contractual clauses approved by the European Commission and recognised by the FDPIC, or on the statutory derogations. You may request a copy of the safeguards at info@cmp-eurocostruzioni.ch.

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR, Art. 21 revFADP).

You may exercise the following rights at any time: • access to your data and a copy of it (Art. 15 GDPR, Art. 25 revFADP); • rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR, Art. 32 revFADP); • erasure or destruction of data, in the cases provided by law (Art. 17 GDPR); • restriction of processing (Art. 18 GDPR); • portability of the data you provided, in a structured, commonly used format (Art. 20 GDPR, Art. 28 revFADP); • objection to processing based on legitimate interest (Art. 21 GDPR); • withdrawal of consent for non-technical cookies, at any time and as easily as it was given, via the "Manage cookies" link in the footer. Write to info@cmp-eurocostruzioni.ch to exercise them. We reply within one month (GDPR; extendable by two months in complex cases, with reasons given) and, under Swiss law, normally within 30 days. To protect your data we may ask you to verify your identity. You also have the right to lodge a complaint: • with the Italian Data Protection Authority, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the EU country where you live, work or where the alleged infringement occurred; • with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, and to assert your rights before the civil courts.

The website only uses technical cookies and local storage necessary for it to work. We do not use analytics, profiling or marketing cookies, nor third-party tools such as Google Analytics, social network pixels or session recording. Fonts are served from our own server and generate no requests to external services. The Google map on the contact page is loaded only if you explicitly choose to display it or give consent in the banner. You can change or withdraw your choices at any time through the "Manage cookies" link available on every page. Further details are in the Cookie policy.

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR, Art. 8 revFADP): encrypted HTTPS across the whole site, access to the reserved area protected by authentication with passwords stored only as hashes, role-based access control, temporary lockout after repeated failed login attempts, backups and regular system updates. In the event of a personal data breach we contain, assess and record the incident and, where the conditions are met, notify the competent authority (Art. 33 GDPR, within 72 hours; Art. 24 revFADP) and inform the individuals concerned (Art. 34 GDPR).

The website is not directed at minors and we do not knowingly collect their personal data. If you believe a minor has provided us with data, write to info@cmp-eurocostruzioni.ch and we will delete it.

We may update this notice, for example in case of new processing activities or legal changes. The version in force is always the one published on this page, with the last update date shown at the top.