DATA PROTECTION
Information for APP IBSAGO

Pursuant to the applicable data protection legislation, in particular Article 19 of the Federal Data Protection Law (nLPD) as well as Article 13 of the EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation c."GDPR") (hereinafter the "Privacy Regulations"), IBSA Institut Biochimique SA (hereinafter "IBSA") as the "Controller" of the processing, whose identifying elements are set out below, is required to provide certain information regarding the use of your personal data.

1. Subject and purpose of processing

The processing of your personal data is necessary for the following purposes:
a) Registration to the IBSAGO APP and use of the services provided by the IBSAGO APP.b ) Analysis activities in aggregate and anonymous form for statistical purposes in order to analyze the demand, supply and use of mobility infrastructure.

During the registration phase, the following data will be collected:
e-mail address, domicile/residence, address place of work, hours worked, means of transportation habitually used, usual route of the home-work commute, first and last name, pseudonyms or avatars, date of birth and gender.

Automatically collected data: make and model of mobile phone, operating system and version of the app, IP address and user name.

For the purpose of activating specific modules, the data listed below will also be processed.

2. Nature of data provision and consent

We would like to inform you that the processing of your personal data for the purposes mentioned in point 1a and 1b of this information is carried out in accordance with Article 6.1 letter b) of the EU Regulation 2016/679, thus in execution of a contractual agreement. The provision of data is optional but necessary for the use of the IBSAGO App. Any refusal will result in the impossibility of being able to use the IBSAGO App.

3. Methods of data processing

Data are processed by means of computer procedures or otherwise by automated means or in paper format by persons, internal or external, specifically appointed and held with logic strictly related to the purposes for which the data were collected and in any case suitable to ensure security and confidentiality. The data are protected by the security measures provided for in the regulations, designed to prevent unauthorized access, loss or destruction.

4. Data Retention.

The Data will be kept for the period strictly necessary to achieve the purposes for which it was collected. In any case, the criterion used to determine this period is based on compliance with the terms allowed by applicable laws and the principles of minimization of processing and rational management of archives. In particular, personal data for the purposes referred to in points 1a and 1b will be anonymized within 90 days of deletion from the IBSAGO App.

5. Scope of data circulation

The data may be used by Company personnel who have been given appropriate operating instructions with confidentiality constraints, as well as by third parties performing instrumental and ancillary activities on behalf of the Data Controller, the latter acting as external data processors and under the direction and control of the Data Controller.
The updated list of Data Processors is available by submitting a request to privacy@ibsa.ch.

6. Disclosure of data

Pursuant to the laws and regulations to which we are subject, we may have to disclose data to legitimate recipients under the law and regulation. These parties will act as autonomous Data Controllers.

7. Transfer of data abroad

In accordance with the laws and regulations to which we are subject, your personal data may also be disclosed and/or transferred to organizations located in other countries, both in EU countries and outside the EU, including countries that may not provide the same level of protection under applicable law, in which case the transfer of data abroad is subject to specific safeguards for the protection of personal data through the adoption of standard contractual clauses.

8. Rights of the data subject

You have the right to know, at any time, what your data are with the Data Controller and how they are used; you also have the right to have them updated, supplemented, corrected or deleted, to request their portability or restriction of processing, in the cases provided for by law, and to object to their processing. In order to exercise your rights, as well as for more detailed information about the subjects or categories of subjects to whom the data are communicated or who become aware of them in their capacity as managers or appointees, you may contact us at: - email privacy@ibsa.ch;
- IBSA Institut Biochimique SA, Privacy Office, via del Piano 29, 6926 Collina d'Oro, Switzerland.

Finally, we remind you that limited to the cases in which the GDPR applies, you have the right to lodge a complaint with the competent Data Protection Authorities if you believe that your rights have not been respected or that you have not received a response to your requests according to law.

9. Data controller

The controller of personal data is IBSA Institut Biochimique SA with registered office at Via Pian Scairolo 49, 6912 Pazzallo, Switzerland.

10. Data Protection Officer.

The Owner employs a data protection advisor/data protection officer (also known as Data Protection Officer "DPO"). The DPO can be contacted through the following communication channel: dpo@ibsa.it