PRIVACY NOTICE for informing data subjects, in accordance with EU General Data Protection Regulation 2016/679.

1. Data controller

Beretta SpA

Via Pietro Beretta, 18

25063 Gardone Val Trompia (Brescia), Italy

2. Contact person for matters concerning the register

Petri Palin, Data Protection Officer

Email: petri.palin(at)sako.fi

3. Name of the register and basis for collecting the data

The Sako Inner Circle register, into which data is collected only with the data subject’s personal consent. The data is obtained from the data subject themselves.

4. Purpose of processing personal data

The purpose of processing the personal data in Sako’s Inner Circle register is to inform and market to data subjects through various channels, such as a newsletter. Personal data may be used for opinion or market research for Sako’s needs.

The purposes of processing the personal data in the register may additionally be communicated through campaign-specific privacy notices. Such campaigns are defined in advance and are short-term in duration. The data content of these campaigns is communicated in a separate privacy notice drawn up for the campaign in question.

5. Description of the groups of data subjects

The Sako Inner Circle register contains natural persons and organisations.

6. Data content of the register and data retention periods

The Sako Inner Circle register contains the following data on the data subject:

• First and last name
• Country
• Email
• Information on the data subject’s areas of interest for targeted marketing, if they have given their consent for this

The data is retained and used until the person or organisation leaves the Inner Circle community.

7. Regular sources of data

The Inner Circle register contains data obtained when the data subject joined the Inner Circle community on websites maintained by Sako or at events.

8. Regular disclosures of data

Data is not disclosed outside the Beretta group.

9. Transfer of data outside the EU or EEA

Data is not transferred outside the EU or the EEA.

10. Principles of protecting the register

The data controller has protected the register with the necessary information-security measures. Access to the data in the register is restricted, and access rights require a personal username and password. Access rights are granted only to Beretta group personnel. Everyone who processes the data in the register has signed a confidentiality agreement.

11. Safeguarding the rights of the data subject

1. Right of access

The data subject may review the data stored about them in the register by requesting it from Sako’s contact person, whose contact details can be found in section 2 of this document. We disclose data only to the email addresses recorded in the register. In other cases, the person requesting the data must verify their identity to Sako.

2. Right to require rectification of data

A person included in the register has the right to require the rectification of incorrect data held in the personal data register. A request to rectify incorrect data can be made by contacting Sako’s contact person, whose contact details can be found in section 2 of this document.

3. Right to transfer personal data from one register to another

A person included in the register has the right to receive their data in a transferable format. A request for transfer can be made by contacting Sako’s contact person, whose contact details can be found in section 2 of this document.

4. Right to be forgotten

A person included in the register has the right to require the deletion of their personal data. A request to delete personal data can be made by contacting Sako’s contact person, whose contact details can be found in section 2 of this document.

5. Right to lodge a complaint with a supervisory authority

A person included in the register has the right to lodge a complaint with a supervisory authority if Sako does not, in its operations, meet the requirements of the General Data Protection Regulation 2016/679.

12. Other rights of the data subject

We will notify the data subject and the data protection supervisory authority of any data breaches affecting the data subject’s information. For all matters relating to data protection and the processing of personal data, you can contact Sako’s contact person, whose contact details can be found in section 2 of this document.