The following information notice is intended for all individuals who make purchases on the following e-commerce website: www.segafredo.it. The website is owned by SEGAFREDO ZANETTI S.P.A. ("SEGAFREDO ZANETTI"). The Website is managed, on behalf of SEGAFREDO ZANETTI, by T-DATA S.R.L. ("T-DATA"), which sells products bearing the "SEGAFREDO ZANETTI" brand marketed on the website. T-DATA S.R.L. is responsible for managing sales and transactions carried out through the Website (e.g., order management, sale and delivery of products, management of returns and legal warranty, and other activities necessary for selling products through the website). SEGAFREDO ZANETTI provides the services that allow access, navigation, and registration to the website. SEGAFREDO ZANETTI S.P.A. and T-DATA S.R.L. will process the personal data you provide for website registration and, respectively, for the conclusion of the purchase contract through the Website as independent data controllers (each, an "Independent Controller" and jointly "Independent Controllers"), in compliance with the provisions of EU Regulation 679/2016 (the "Regulation") and Legislative Decree 30 June 2003, n. 196 (the "Privacy Code"). In particular: - SEGAFREDO ZANETTI will process your personal data, as an Independent Controller, in order to manage access to the Website's services and facilitate the online purchase of products, as well as to enable your registration to the Website and the possible conclusion of the purchase contract through the Website and, with your consent, for marketing purposes; - T-DATA S.R.L. will process your personal data, as an Independent Controller, to enable the conclusion of the purchase contract, to execute the obligations arising from that contract, to fulfill all legal obligations, including tax and administrative ones, related to it, as well as for other purposes related to that contract and/or the execution of pre-contractual measures, as described in this information notice; The processing carried out by SEGAFREDO ZANETTI, as an Independent Controller, is described in SEGAFREDO ZANETTI's Privacy Policy, to which reference is made in its entirety, available in the footer of the website at the link "SEGAFREDO ZANETTI Privacy policy". This information notice is therefore provided solely with reference to the processing carried out by T-DATA S.R.L. as an Independent Controller.

2. Identity and contact details of T-DATA S.R.L. as an independent data controller

T-DATA S.R.L. is the Independent Data Controller for the data you provide when concluding a purchase contract through the Website, for the purposes set out in sections 4, 5, 6, 7, 8 and 9 of this information notice. The identification details and contact information of T-DATA S.R.L. are as follows: T-DATA S.R.L. with registered office at Via Strasburgo 31, 41011 Campogalliano (MO), tax code and VAT number IT03854490368 and registration number with the Modena Companies Register 03854490368; - telephone number: 0331 1090043 - email address: supporto@t-data.it

3. Processing of data by T-DATA S.R.L. for the purpose of concluding and executing the purchase contract

T-DATA S.R.L., as an Independent Data Controller, will process your personal data: - to enable the conclusion of the purchase contract through the Website (e.g., adding products to the cart and choosing the payment method); - to fulfill the obligations arising from this contract for T-DATA S.R.L., such as, for example, the delivery of the products sold; - to enable you to fulfill your obligations arising from the purchase contract concluded through the Website, such as, for example, the online payment for purchased products; - to execute pre-contractual measures requested by you (e.g., notification of product availability). The legal basis for this processing is the performance of the contract (Article 6.1.b) of the Regulation). For this purpose, T-DATA S.R.L. will process your data for the time strictly necessary to carry out the individual processing activities (e.g., data necessary for the execution of the purchase contract, until the delivery of the product or, in case of non-delivery, until the termination of the contract), it being understood that, once this period has expired, T-DATA S.R.L. may store the data for the purposes and for the maximum retention periods referred to in sections 4, 5, 6, 7, 8 and 9 of this information notice and/or, in any case, in the cases established by the Regulation and/or by law.

Further information

The provision of data for the purpose in question is optional: there is no legal or contractual obligation to communicate the data; however, it is a necessary requirement for the conclusion of the purchase contract through the Website. Failure to communicate the data will therefore make it impossible for the user to conclude such a contract and therefore to make purchases through the Website.

4. Data processing by T-DATA S.R.L. for assistance/customer care purposes

T-DATA S.R.L., as an Independent Controller, will process user data for general assistance and customer care activities, and therefore to respond to information requests from users or to respond to complaints, reports, and disputes concerning online orders only. The legal basis for this processing is the execution of pre-contractual measures adopted at the request of the data subject (Article 6.1.b, last paragraph, of the Regulation) or, depending on the case, the legitimate interest of T-DATA S.R.L. (Article 6.1.f) of the Regulation). It is a legitimate interest of T-DATA S.R.L. to respond to requests for information and/or reports and/or disputes and/or complaints from website users (to whom, moreover, T-DATA S.R.L. is obliged to respond, also based on the provisions of the Consumer Code). This legitimate interest of T-DATA S.R.L. also coincides with the legitimate interest of the Website users themselves who make the requests and/or reports and/or disputes and/or complaints in question and who, therefore, within the framework of their relationship with T-DATA S.R.L., can reasonably expect their personal data to be used by T-DATA S.R.L. to provide them with a response. The legitimate interest of T-DATA S.R.L., thus identified, can therefore be considered to prevail over the fundamental rights and freedoms of the data subject, also in consideration of these reasonable expectations and the existing relationship between the data subject and T-DATA S.R.L. as well as the nature of the data processed and the coinciding interest of the data subjects themselves. You have, in any case, the right to object, at any time, for reasons related to your personal situation, to the processing of personal data concerning you for the purpose in question (i.e. assistance and customer care). To exercise this right, you can contact T-DATA S.R.L. at the following addresses: Via email at supporto@t-data.it or at the operational headquarters of T-DATA S.R.L. Srl Via Strasburgo 31, 41011 Campogalliano (MO).

Further information

In the event of exercising the right to object to the processing of data for assistance/customer care purposes, T-DATA S.R.L. will refrain from further processing the users' personal data for this purpose, unless it demonstrates the existence of compelling legitimate grounds for the processing that override the interests and rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. The provision of personal data for the purpose in question is optional: there is no legal and/or contractual obligation to communicate the data; however, given the purpose of the processing, failure to communicate the data and/or the exercise of the right to object may make it impossible to respond to users' requests and/or reports and/or complaints and/or disputes, if the response to such requests involves the processing of the user's personal data. For this purpose, T-DATA S.R.L. will process user data for the time necessary to carry out the requested activities and, therefore, specifically, for the time necessary to provide the information requested by the user or to respond to the complaints and/or reports and/or disputes submitted by the user.

5. Data processing by T-DATA S.R.L. for fraud prevention purposes in case of credit card payment

T-DATA S.R.L., as an Independent Controller, will process users' personal data in order to manage and possibly block payment transactions related to fraudulent orders, in the case of payment by credit card for purchases made on the Website. The data subject to the processing in question are the order data and the data of the credit card holder used for payment, in the event that T-DATA S.R.L., in order to ensure payment security, requests a copy of it from the user, as indicated in the general terms and conditions of sale governing the purchase. The processing in question does not concern the confidential data of the credit card (card number, expiration date, and security code) which, together with the cardholder's name, are acquired directly by the payment service provider. The legal basis for this processing is the legitimate interest of T-DATA S.R.L. (Article 6.1.f) of the Regulation). You have, in any case, the right to object, at any time, for reasons related to your personal situation, to the processing of personal data concerning you for the purpose in question (i.e., fraud prevention in case of credit card payment). To exercise this right, you can contact T-DATA S.R.L. at the following addresses: Via email at supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO). For the purpose in question, T-DATA S.R.L. will process users' personal data for 24 months from collection.

Further information

Regarding the legitimate interest of T-DATA S.R.L., please note the following: - it is a legitimate interest of T-DATA S.R.L. to carry out activities, for fraud prevention purposes, in the case of online payment by credit card, to protect its business interest, including the purpose of complying with the parameters defined by international circuits regarding the number of fraudulent payment attempts detected on the e-commerce Website. This legitimate interest of T-DATA S.R.L. also coincides with the legitimate interest of Website users, as potential victims of fraud, who, like the entire community, in turn have a legitimate interest in ensuring that fraudulent activities are discouraged and identified when they occur; it can, therefore, be assumed that, within the framework of their relationship with T-DATA S.R.L., they can reasonably expect their data to be processed also for fraud prevention purposes, for their own protection and guarantee. - the provision of data for the purpose in question (i.e., credit card fraud prevention purposes) is optional: there is no legal or contractual obligation to provide such data for this purpose; however, failure to send a copy of the identity card of the credit card holder with whom the payment was made, if requested, will result in the termination of the purchase contract concluded through the Website. - for the purpose in question, T-DATA S.R.L. also uses data initially collected for different purposes (and, specifically, to enable the conclusion of the purchase contract and its execution) whose further processing for credit card fraud prevention purposes is permitted, as it is based on the legitimate interest of T-DATA S.R.L., given the compatibility of the purpose in question with the purpose for which the data were initially collected; - in the event of exercising the right to object, T-DATA S.R.L. will refrain from further processing users' personal data for this purpose, unless it demonstrates the existence of compelling legitimate grounds for the processing that override the interests and rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

6. Processing of data by T-DATA S.R.L. for ADMINISTRATIVE, ACCOUNTING and tax purposes

T-DATA S.R.L., as an Independent Controller, will process user data for the purpose of fulfilling administrative and/or accounting and/or tax obligations related to the purchase contract concluded through the Website, such as, for example, keeping accounting records and issuing sales invoices. The legal basis for this processing is the fulfillment of legal obligations to which T-DATA S.R.L. is subject (Article 6.1.c) of the Regulation). The provision of data for the purpose in question is mandatory, because their processing is necessary to allow T-DATA S.R.L. to fulfill legal obligations incumbent on it. Any refusal to provide data for this purpose will make it impossible for the user to conclude the purchase contract through the Website. For this purpose, T-DATA S.R.L. will process user data until the expiration of the legal terms provided for the fulfillment of each administrative-accounting and tax obligation and/or for the retention periods provided by law for the retention of relevant documentation.

7. Data processing by T-DATA S.R.L. to allow the user to exercise rights

T-DATA S.R.L., as an Independent Controller, will process user data in order to: - respond to requests to exercise the right of withdrawal and/or requests to exercise the legal warranty of conformity and/or other rights arising from the purchase contract concluded through the Website and/or provided by law in relation to such contract; - carry out activities that prove necessary as a consequence of the exercise of such rights and to proceed, if applicable, to related refunds; - receive and respond to requests to exercise rights regarding personal data protection provided by the Regulation and carry out all consequent activities. The legal basis for this processing is the fulfillment of legal obligations to which T-DATA S.R.L. is subject (Article 6.1.c) of the Regulation).

Further information

The provision of data for the purpose in question is mandatory, because their processing is necessary to enable T-DATA S.R.L. to comply with legal obligations and to allow the user to exercise the rights granted to them by law or contract. Any refusal to provide the data for this purpose will make it impossible for the user to exercise such rights. For this purpose, T-DATA S.R.L. will process the data until the expiry of the legal terms provided for the exercise of the right (statutory limitation and/or forfeiture period) or, in the case of exercising such rights, for the time necessary for the management and closing of the case; in the case of exercising the rights provided for by the Regulation, the data will be processed until the Data Controller certifies that the request has been fulfilled or until the fulfillment itself, whichever event occurs last.

8. Processing of data by T-DATA S.R.L. for the purpose of establishing, exercising or defending a right

T-DATA S.R.L., as an Independent Controller, will process user data for the establishment, exercise or defence of a right in all competent forums. The legal basis for this processing is legitimate interest (Article 6.1.f) of the Regulation). It is a legitimate interest of the data controller to pursue remedies to ensure compliance with its contractual rights or to demonstrate that it has fulfilled the obligations arising from the contract with the data subject or imposed on the data controller by law. This legitimate interest is, in turn, based on the constitutionally protected right to defence. It can therefore be considered to prevail over the fundamental rights and freedoms of the data subject, also due to the latter's reasonable expectations. The user has, in any case, the right to object, at any time, for reasons related to their personal situation, to the processing of personal data concerning them for the purpose in question (i.e., defence of a right/justice purposes). To exercise this right, the user can contact T-DATA S.R.L. at the following addresses: Via email at supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Srl Via Strasburgo 31, 41011 Campogalliano (MO).

Further information

Users are informed that, in particular, T-DATA S.R.L. will store and potentially use data: a) for evidentiary purposes regarding the fulfillment of the purchase contract and/or to initiate or respond to actions related to such contract before any administrative and/or judicial authority and/or to protect its rights in the preparatory stages of the judgment and/or proceeding; for this purpose, the data will be stored for 10 years from the delivery of the product or from the termination of the contract, in case of non-delivery of the product; b) to prove that the exercise of rights provided for by the Regulation and/or by law (e.g., right of withdrawal; legal guarantee) and/or by the purchase contract has been allowed and that what is required by law and/or by the contract regarding it has been carried out (e.g., refund, in case of exercise of the right of withdrawal); c) to prove that complaints and/or reports and/or objections from users have been responded to; d) in case of exercise of rights provided for by the Regulation, the data will be stored for [5 years from the confirmation of having responded to the data subject's request or from such response, if later]; e) in case of exercise of rights provided for by the purchase contract or by law, the data will be stored for [10 years, starting from the closure of the case or from the execution of the action that defines it] (e.g., refund, in case of withdrawal; or delivery of the replacement product, in case of legal guarantee); closure of the case means the last correspondence related to the exercise of the rights in question); f) in case of complaints and/or reports and/or objections, the data will be stored for [three years from the closure of the case], meaning the last correspondence on the matter. It should also be noted that: - the provision of data for this purpose is optional: there is no legal or contractual obligation that requires the data subject to provide data for this purpose; - for the purpose in question, data initially collected for a different purpose are used, the further processing of which is allowed as it is based on the legitimate interest of the data controller, given the compatibility of this further purpose with the initial purpose of collection, also taking into account the fact that, to the extent that processing is necessary for the establishment, exercise, and defense of a right, the data controller is also exempt from the obligation of erasure, by express provision of the Regulation; - in case of exercise of the right to object, the data controller refrains from further processing personal data, unless they demonstrate compelling legitimate grounds for the processing which override the interests, rights, and fundamental freedoms of the data subject or for the establishment, exercise, or defense of legal claims. - to providers of web traffic analysis services, technical cookie management, and analytics tools used by the Site to improve performance and user browsing experience (e.g., web analytics services and e-commerce platforms like Shopify Inc.), as well as to third parties used by such providers;

9. Categories of subjects to whom T-DATA S.R.L. communicates user personal data (recipients)

Personal data provided by the user may be communicated by T-DATA S.R.L. to the categories of recipients indicated below. The subjects to whom T-DATA S.R.L. communicates the data act as external data processors designated by T-DATA S.R.L. through a specific contract ("Processors") or as persons authorized to process personal data under the direct authority of T-DATA S.R.L. ("Authorized Persons") or, in the case of third parties used by the Processor, as "Sub-Processors", pursuant to art. 28.4 of the Regulation, except in cases where the recipient acts as an independent data controller, such as, for example, in the case of the Payment Service Provider, or even as an independent data controller, as in the case of couriers.

Further information

User personal data may be communicated by T-DATA S.R.L. to the following categories of recipients: - companies of the group to which T-DATA S.R.L. belongs and/or employees and/or collaborators of T-DATA S.R.L., for administrative, accounting, and IT and logistical support activities; - to companies, consultants, or professionals possibly appointed for the installation, maintenance, updating and, in general, the management of T-DATA S.R.L.'s hardware and software, including cloud computing and chat service providers, and to third parties they use; - to companies that carry out logistical support and/or warehousing and/or packaging and/or shipping and delivery or collection of products purchased on the Site and to third parties they use; - to the Payment Service Provider and/or the acquirer and/or banks in order to allow payment for purchases made on the Site or their refund, if applicable, and to third parties they use; - to all those subjects, including public authorities, who have access to data by virtue of regulatory or administrative provisions. - to all those public and/or private entities, natural and/or legal persons (legal, administrative, and tax consulting firms), if the communication is necessary or functional for the correct fulfillment of contractual obligations undertaken in relation to purchases through the Site as well as obligations deriving from the law or in the case of assessment, exercise or defense of a right. The list of recipients is available at the headquarters of T-DATA S.R.L.

10. Transfers to third countries

Users' personal data are transferred by T-DATA S.R.L. to the following third country: India. The recipient of such data is Zoho Corporation PVL, LTD, provider, together with Zoho Corporation B.V., of the Site's chat service. Regarding the transfer of data to India, the following is noted: • there is no adequacy decision in relation to the level of data protection guaranteed in India; • in the absence of an adequacy decision, data may be transferred to the third country only if appropriate safeguards as per art. 46.2 of the Regulation are provided, including standard contractual clauses adopted by the Commission and/or a national supervisory authority; • the transfer of data to India by T-DATA S.R.L. takes place based on the standard contractual clauses referred to in the "standard contractual clauses adopted by the European Commission with Decision (EU) 2021/914 for the transfer of personal data to processors established in third countries pursuant to Directive 95/46/EC of the European Parliament and of the Council" [notified under number C(2010)/87/EU] and therefore on the basis of the consequent "Authorization for transfers to third countries via standard contractual clauses referred to in the Commission Decision (EU) 2021/914 in the event of an importer established in a third country" issued by the Garante per la Protezione dei Dati Personali with provisions of 27 May 2010 and 15 November 2012, still in force pursuant to art 46.5 of the Regulation.

11. Right to object

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out for the purposes referred to in sections 4, 5, and 8 of this privacy policy and having as their legal basis the legitimate interest of the data controller. The data subject can exercise the right to object by contacting T-DATA S.R.L. at the following addresses: Via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO).

Further information

In the event of exercising the right to object, the data controller shall refrain from further processing the personal data, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

12. Right of access

The data subject has the right to obtain from the data controller (and therefore from T-DATA S.R.L.) confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information indicated below. The data subject can exercise the right of access by contacting T-DATA S.R.L. at the following addresses: Via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO).

Further information

In the event of exercising the right of access, the user can obtain access to personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer, pursuant to Article 46 of the Regulation. The data controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

13. Right to rectification

The data subject has the right to obtain from the data controller (and therefore from T-DATA S.R.L.) the rectification of inaccurate personal data concerning him or her without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement. The data subject can exercise the right to rectification by contacting T-DATA S.R.L. at the following addresses: via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO).

14. Right to erasure

The data subject has the right to obtain from the data controller (and therefore from T-DATA S.R.L.) the erasure of personal data concerning him or her without undue delay, and the data controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject objects to the processing based on the legitimate interest of the data controller for reasons related to his or her particular situation (and, therefore, in cases of objection to processing for the purposes referred to in sections 4, 5, and 8 of this privacy policy); c) the personal data have been unlawfully processed; d) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject. The data subject can exercise the right to erasure by contacting T-DATA S.R.L. at the following addresses: via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO)

Further information

Where the controller has made the personal data public and is obliged to erase them, taking account of available technology and the cost of implementation, the controller shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. The right to erasure does not apply to the extent that processing is necessary: a) for exercising the right of freedom of expression and information; b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; c) for reasons of public interest in the area of public health; d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing; e) for the establishment, exercise or defence of legal claims.

15. Right to restriction of processing

The data subject has the right to obtain from the data controller (and therefore from T-DATA S.R.L.) restriction of processing where one of the following applies: - the accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data; - the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use; - although the data controller no longer needs the personal data for the purposes of the processing, they are required by the data subject for the establishment, exercise or defence of legal claims; - the data subject has objected to processing in cases of processing based on the legitimate interest of the data controller, for reasons related to his or her particular situation (and, therefore, in case of objection to data processing for the purposes referred to in sections 4, 5 and 8 of this privacy policy), pending the verification whether the legitimate grounds of the data controller override those of the data subject. The data subject can exercise the right to restriction by contacting T-DATA S.R.L. at the following addresses: via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO)

Further information

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. A data subject who has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted. Return to summary

16. Right to data portability

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: a) the processing is based on consent or on a contract; b) the processing is carried out by automated means. The data subject can therefore exercise the right in question in relation to the purposes referred to in the following sections of this privacy policy: 3. The data subject can exercise the right to portability by contacting T-DATA S.R.L. at the following addresses: via email to supporto@t-data.it, or at the operational headquarters of T-DATA S.R.L. Via Strasburgo 31, 41011 Campogalliano (MO)

Further information

In exercising his or her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability shall be without prejudice to the right to erasure. The right to data portability shall not adversely affect the rights and freedoms of others.

17. Time and methods of response in case of exercising data subject rights

The data controller shall provide information on action taken on a request under Articles 15 to 22 of the Regulation (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) and referred to in sections 11, 12, 13, 14, 15 and 16 of this privacy policy (“Data Subject Rights”) to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The data controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Further information

If the controller does not comply with the data subject's request, the controller shall inform the data subject without delay, and at the latest, within one month of receipt of the request, of the reasons for non-compliance and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. Communications in response to the exercise of Data Subject Rights and actions taken are free of charge. If the data subject's requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the controller may: a) charge a reasonable fee, taking into account the administrative costs incurred in providing the information or taking the action requested; b) refuse to act on the request. Where the controller has reasonable doubts concerning the identity of the natural person making the request concerning the Data Subject Rights, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

18. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes the Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy.