Information pursuant to Article 13 of Regulation (EU) 2016/679 – Website https://www.italymachinery.com Version No. 1 of 14-10-2025 With this document ("Information"), the Data Controller intends to provide you with information regarding the purposes and methods of processing your personal data, as well as your rights under Regulation (EU) 2016/679 ("GDPR") on the protection of natural persons, with regard to the processing of personal data and the free movement of such data. This Information may be updated or supplemented by the Data Controller if any additional services requested by you involve additional processing.

Data Controller

Gupta Impex of Akash Gupta, with registered office at Via Giuseppe Maria Bernini, 31, 25123 Brescia (BS), Italy; Phone: +39 030 5031427; Email: industrialmachinery@gmail.com; VAT No.: 02904960982;

Types of data processed

The processing activities carried out are aimed at acquiring the following personal data:

• Common data: Personal data;
• Financial data: Banking data.

Categories of data subjects

The processing activities carried out are aimed at the following categories of data subjects: Natural persons, legal persons, public and private organizations.

Purpose of processing and condition that makes the processing lawful

1. CUSTOMERS – Purchase and sale of used machine tools, used mechanical workshop equipment

The processing of your personal data is necessary for the acquisition of preliminary information for the conclusion of the contracts you will enter into with the Data Controller, for the completion and performance of the contract that involves the purchase and sale of used machine tools, used mechanical workshop equipment.

Condition of Lawfulness of Processing: Performance of Contract - Art. 6, paragraph 1, letter b). GDPR

Purpose of processing: Contractual agreements aimed at finalizing and executing the contract for the purchase and sale of used machine tools and used mechanical workshop equipment.

Nature of provision: Mandatory - Failure to provide data will make it impossible for the company to follow up on your pre-contractual/contractual requests and execute the contract.

Period of personal data retention: Your personal data will be actively processed for the time necessary to manage the existing relationship and/or execute the contract. The information collected for the evaluation of the conclusion of the contract, in the event of failure to complete it, will be deleted within 3 years of the request of the data subject.

Method of processing: The processing is carried out primarily using computer and paper-based tools.

2. CUSTOMERS - Legal Obligations

The processing of personal data is necessary to fulfill obligations established by laws, EU regulations and/or standards, by supervisory/control bodies, or by other legitimate authorities.

Legal Processing Conditions: Legal Obligation - Art. 6, paragraph 1, letter c. GDPR
Purpose of processing:

• Storage of accounting and administrative documents in paper form;
• Storage of accounting and administrative documents in digital form;
• Digital storage of invoices issued/received (electronic invoicing).

Nature of provision: Mandatory - Failure to provide the data will make it impossible for the Data Controller to perform the contract.

Personal data retention period:
Personal data will be processed for this purpose for the time necessary to fulfill the legal obligations established by applicable legislation. In this regard, personal data will be retained for 10 years from the termination of the contract or, if later, from a binding decision issued by a competent authority, without prejudice to any retention obligations relating to special categories of data, for longer periods, as prescribed by law.

Processing Methods: The processing is mainly carried out using IT tools.

3. Defense in and out of court

Your personal data may be processed to ascertain, exercise, or defend the Data Controller's rights in and out of court.

Conditions for Lawfulness of Processing: Legitimate Interest - Art. 6, paragraph 1, letter f. GDPR
Purpose of processing:

• Ascertain, exercise, or defend the Data Controller's rights in court;
• Out-of-court debt collection.

Nature of provision: Mandatory - Providing data to the Data Controller is strictly necessary for the possible defense in court and out-of-court proceedings for a period of time longer than that required by law and, in any case, until the conclusion of the trial.

Personal data retention period: Personal data will be retained for a period of time longer than that required by law and, in any case, until the legal requirements are exhausted.

Processing methods:

Processing is primarily carried out using electronic and paper-based tools.

Data Subject Rights - Complaint to the Supervisory Authority

In relation to the processing described in this Policy, as a data subject, you may, under the conditions set forth in the GDPR, exercise the rights set forth in Articles 15 to 22 of the GDPR, and, in particular, the following rights:

• Right of access: the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data;
• Right to rectification: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
• Right to erasure (right to be forgotten): the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defense of legal claims;

Right to restriction of processing – Article 18 GDPR: right to obtain restriction of processing when: a) the accuracy of the personal data is contested by the data subject; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the personal data are required by the data subject for the establishment, exercise or defense of legal claims; d) the data subject has objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject.

• Right to restriction of processing: right to obtain restriction of processing;
• Right to data portability: right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you and to provide that data to another controller;
• Right to object: the right to object to the processing of your personal data for reasons related to your particular situation and, in any case, to the use of your data for marketing purposes.

If processing is based on consent, you may withdraw it. You may also withdraw your consent at any time and with the same ease with which it was provided, without affecting the lawfulness of processing based on consent before its withdrawal.

You also have the right not to be subject to a decision based solely on automated processing, including profiling, which has a legal effect or significantly affects you. However, we may adopt an automated decision if it is necessary for the entry into or performance of a contract with us, if it is authorized by an Italian or European Union law, or if you have given your consent.

In any case, you have the right to challenge the decision, express opinions on it, and request the intervention of a person who can review it.

You may lodge a complaint at any time with the Italian Data Protection Authority : http://www.garanteprivacy.it. The above rights may be exercised against the Data Controller by contacting the contact details described above.