1. Identity and contact information of the data controller

The entity that determines the purposes and means of the processing of personal data is FMA SA, a company under Swiss law with registered office at Centro Galleria 3, Via Cantonale 6928 Manno - Svizzera (hereinafter also referred to as "Data Controller" or "Company").

You can contact the Data Controller at the following e-mail: privacy@resortcollinadoro.com

2. Categories of personal data subject to processing

Personal data collected - or otherwise acquired in accordance with applicable legislative and contractual provisions, will be processed in accordance with Art. 5 of the nLPD and confidentiality obligations.

The personal data that are collected and processed through the Video surveillance system are the images of customers, visitors, employees, and any other persons (hereinafter referred to as "data subjects") captured in real time and recorded by the cameras placed at the premises of the Data Controller (hereinafter referred to as "premises").

It excludes the capturing and recording of voices, sounds and any other "noise."

Specifically, we will process personal data and sensitive data as outlined below:

• Personal data: any information about an identified or identifiable person.
• Personal data worthy of special attention: ossia, riguardanti:
  - opinions or activities of a religious, ideological, political or trade union nature;
  - physical health, intimate sphere or ethnic origin;
  - social welfare measures;
  - criminal or administrative proceedings and penalties.
  In addition, the Data Controller may become aware of data concerning:
  - health status (e.g., absence due to illness, maternity, accident, etc.);
  - membership in trade unions and political parties
  - the performance of public office (use of leave, expectations, ...);
  - religious beliefs (public holidays permitted by law).
• Personal data of third parties: in addition to your own personal data, you may also provide the Company with personal data of third parties, particularly other family members, for the purposes of human resources management and administration, including benefits and emergency contacts. Before providing such data, you must inform the persons concerned about the contents of this Privacy Policy.
• Data subjects: natural or legal persons whose data are being processed.
• Processing: means any operation concerning personal data, regardless of the means and procedures adopted, namely the collection, storage, use, review, communication, archiving or destruction of data.
• Communication: i.e., making personal data accessible, such as by allowing access, transmission or publication.

3. Data Protection - Recipients of Personal Data

According to Art. 6 of the nLPD to ensure that your data are processed as fairly and transparently as possible, you should be aware that:

• Your personal data are processed and stored by the Data Controller or the Data Processors on behalf of the Data Controller; the processing and storage of the processed data is done in electronic mode with archives located at the company headquarters;
• At the Data Controller, your personal data may be processed by individuals expressly authorized by the Data Controller according to the organizational needs of the Data Controller and in full compliance with the principles of the LPD;
• All processing shall be carried out in accordance with the methods set forth in Articles 6 and 8 of the nLPD and through the adoption of the appropriate security and organizational measures of OPDa Chapter 1;
• The duration of processing, in accordance with the principles of lawfulness, purpose limitation, and data minimization, is determined for a period of time not exceeding the achievement of the purposes for which the data are collected and processed, in compliance with the mandatory time limits prescribed by law.

Specifically, access to personal data "video images" is allowed exclusively:

• To internal data processors designated, appointed and duly instructed by the Owner;
• to the authorized and appointed external persons responsible for surveillance or/and maintenance of the systems installed on the premises;
• Competent authorities for compliance with legal obligations and/or provisions of public bodies.

4. Purposes and purposes of processing and data retention period

Video images recorded through Video Surveillance systems are processed in full compliance with the current Privacy Law with the following purposes, legal bases and data retention period:

	PURPOSE OF PROCESSING | JUSTIFYING REASON	DATA RETENTION PERIOD
1	Data will be processed exclusively for the purpose of heritage protection of movable and immovable property. Persuasive prevention of possible vandalism, damage and theft and related event reconstruction. Legal Basis: Overriding Interest of the owner. Category of Data Processed: Images- Video.	Seven days from the filming (unless further preservation, for example, by request of the Judicial Authority or Judicial Police). Only in the case of suspected or obvious news of damage or crime, the images extracted at the express request of the person who filed the complaint/complaint, may be protracted for a maximum of 15 days while waiting for the proceeding Authority to request them. Once the retention period has expired, the images are automatically and irreversibly deleted.
2	The data will be processed for the purpose of promoting the safety and security of employees, customers, frequent visitors in various capacities of the spaces. Legal Basis: Overriding interest of the owner. Category of Data Processed: Images-Videos
3	Data will be processed in order to prevent and detect illicit and unauthorized access to relevant spaces (high-risk locations, IT infrastructures). Legal Basis: Overriding Interest of the owner. Category of Data Processed: Images- Video
4	Data may be processed for the investigative needs of the Judicial Authority or Police forces according to current federal law. The Legal Basis: execution of a law. Category of Data Processed: Images- Video

The employer shall protect the health and personality of the employee (Art. 328 CO and Art. 30 of the DPA). It is emphasized that all systems used are in no way employed as a means of remote control of the work activities of employees, technical-administrative staff and all those working in various capacities in the business structure.

5. Transfer of personal data outside the federal government

Personal data are not transferred outside the territory of the Swiss Confederation.

It should be noted that, where the communication of data outside Switzerland is envisaged, this will take place in accordance with the provisions of the DPA, in particular on the following bases:

• appropriate safeguards, in this case contractual measures, are in place to ensure adequate protection abroad;
• the processing is directly related to the conclusion or performance of a contract and the processed data concern the other party;
• the communication takes place within the same legal entity or company or between legal entities or companies under a single management, provided that the issuer and the recipient comply with rules aimed at ensuring adequate data protection.

6. Data retention terms

Video images are retained on computer and electronic media for the period of time strictly necessary to achieve the purposes described in point 4, which is normally 7 calendar days, it being understood that based on specific needs, the retention period may be extended for a period not exceeding 15 days, unless further retention is required under the law or measures of competent authorities or to ascertain, exercise or defend a right in court. At the end of the prescribed retention period, the data are deleted by automatic overwriting.

7. Rights of the data subject

The data subject is guaranteed the following rights, which can be exercised at any time by means of a request made in writing to the contacts of the Data Controller listed below in case they believe they have been subjected to filming by the Video Surveillance system, necessary for the achievement of the purposes described above, exercise:

• you can ask for confirmation of whether or not any data processing is being carried out on you and access to the same, receiving clarification about the purposes pursued by the owner, the categories of data involved, the recipients to whom the same may be communicated, the period of storage, the existence of automated decision-making processes;
• if your personal data is incomplete or inaccurate, you can at any time have it rectified and be informed about the rectification process if necessary. If it does not involve disproportionate effort, recipients will also be informed of the rectification of personal data;
• you have the right to ask the Data Controller for the deletion of the personal data processed, as well as to ask for its limitation to what is necessary for the purpose of processing;
• you have the right to file a complaint with the federal appointee;
• you can object in part or in whole, for legitimate reasons, to the processing.

You may exercise your rights under the nLPD by contacting the Data Controller at privacy@resortcollinadoro.com

8. Current version, changes and updates

In order to ensure that our Policy always complies with applicable legal requirements, we reserve the right to make changes at any time and keep it up to date.

It will also be the responsibility of the owner to make the updated information public through the website www.resortcollinadoro.com and to make it available upon specific request.

Date of last update: 19/12/2023