1. Banca Mediolanum itself;
2. Mediolanum Group companies; including: Mediolanum Gestione Fondi SGR p.A., Mediolanum Vita S.p.A., Mediolanum International Funds Ltd., Mediolanum International Life Ltd., Mediolanum Communication S.p.A.;
3. Companies outside the Mediolanum Group such as Mediolanum Assicurazioni S.p.A., Vacanze Italia S.p.A.;
4. other companies outside the Mediolanum Group.

Pursuant to Article 13 of Legislative Decree 196/2003 "Code regarding the protection of personal data" (hereinafter the "Code"), the companies included in letters a), b) and c) in the preface wish to provide the following policy statement.

1. Source of Personal Information
Data are collected directly from data subjects through financial advisors, insurance producers, business developers, credit brokers, collaborators in general, and direct employees who operate as data processors pursuant to Article 30 of the Code.

2. Pur pose of handling the Personal Information
The data, provided or otherwise acquired by one of the companies included in letters a), b) and c) of the Preface in the performance of their duties, and the execution of contractual relationships, will be processed for the following purposes:

1. fulfillment of obligations set forth in laws, regulations, and/or directives issued by aupervisory authorities and oversight and control bodies;
2. fulfillment of pre-contractual and contractual obligations strictly related to the management of existing relationships;
3. conduct of marketing, promotion, advertising and market research, directly and through companies of the Mediolanum Group or external to it.

1. The personal data may be transmitted, as autonomous processors, to government and law enforcement entities, public and private parties delegated under laws and regulations to perform functions important in terms of public information (including, but not limited to, auditing firms, CONSAP, risk control centers, etc.) that are legitimate recipients of communications required by laws and regulations.
2. When necessary, and dependent on the existing relationship, the personal data can be transmitted between the companies specified in letters a) and b) of the Preface in their capacity as autonomous processing controllers, more precisely: Mediolanum Vita S.p.A., Partner Time S.p.A., Mediolanum Comunicazione S.p.A., Alboran S.p.A., PI Distribuzione S.p.A., Mediolanum International Life Ltd., Banca Esperia S.p.A., Mediolanum Gestione Fondi SGR p.A., Mediolanum International Funds Ltd..
3. When necessary, and dependent on the existing relationship, personal data may be transmitted, in their capacity as autonomous processing controllers, to (i) companies outside the Mediolanum Group that issue credit and/or debit cards and/or are connected with or instrumental to the management of contractual relationships; (ii) to consultants, professional offices; (iii) other banking and financial intermediaries and associations and consortia of the financial, banking or insurance sectors; (iv) factoring and credit recovery companies; (v) insurance, co-insurance, reinsurance and insurance brokers.
4. When necessary, and dependent on the existing relationship, the data may also be disclosed, in their capacity as autonomous processors performing activities necessary to manage the contractual relationship, to the Mediolanum Group companies listed in point b) above and the following third-parties outside the Group: data management and service companies in the banking and insurance sectors; entities and bodies that electronically manage data and payment media; companies that print, transmit, prepare, transport and sort communications to customers; companies that provide document archiving services and companies specialized in data entry services; IT service companies and companies that provide IT service technical assistance; companies that provide administrative and accounting services; companies specialized in commercial information and promotion, market research, control and quality of products/services provided, and firms that measure the satisfaction level of customers, their needs and expectations, and the potential demand for other products and services.
5. When necessary, and dependent on the existing relationship, the data may be disclosed to personnel assigned to the following offices/departments of the data controller, as data processors: Information Systems, Customer Administration, Credit Area, Securities Back Office, Call Center, Customer Service, Legal Area, Tax Area, Secretary General, Marketing Department, Systems Department, Inspection Department, Securities Trading, Service Quality, Banca Mediolanum branches, Pending Transactions, Financial Advisors, insurance producers, business developers, credit brokers, and collaborators in general.
6. With prior consent, solely for marketing, promotion, advertising and market research, the data can be transmitted to the companies listed in letter a), b) and c) of the Preface, in their capacity as processing co-controllers, i.e.: Mediolanum S.p.A., Mediolanum Vita S.p.A., Partner Time S.p.A., Mediolanum Comunicazione S.p.A., PI Distribuzione S.p.A., Mediolanum International Life Ltd, Bank Esperia S.p.A., Mediolanum Gestione Fondi SGR p.A., Mediolanum International Funds Limited, Mediolanum Assicurazioni S.p.A. e Vacanze Italia S.p.A.

6. Circulation of information
The information gathered and may not be the subject of general circulation.

7. Rights of the interested party
Article 7, 8, 9 and 10 of the Code regulates the “Right of Access to Personal Information and Other Rights”, the “Exercise of the Rights”, “How to Exercise the Rights”, the “Response to the Interested Party”. The interested party therefore has the right to:

• obtain information on the origin of the personal information, the purpose and means of handling, the logic applied in the case of handling by electronic means, identification information about the data controller, the managers and the designated representative pursuant to article 5 subsection 2 of the Code, the persons and categories of persons to whom the personal information may be communicated or who may become aware of it in their capacity as designated representatives within the territory of the State, as managers or as appointed persons;
• (i) update, correct and add to the information, (ii) delete, make anonymous or block information handled in breach of the law and (iii) a declaration that the abovementioned operations were brought to the notice of those to whom they had been communicated or circulated.

The data subject has the right to oppose, wholly or in part:

• on legitimate grounds, to the handling of the information, even though it is relevant to the object of the data-gathering;
• to the handling of personal information concerning him or her for the purposes of sending advertising or direct-selling material or for market research or commercial communication.
  The above rights are exercised by means of an informal request to the data-controller or manager, including through an appointed person, and an appropriate response is provided without delay.

8. Date-holder and managers of handling of personal information

• Data-controller is Mediolanum S.p.A.
• Manager for “Response to Interested Party” pursuant to article 10 of the Code is the Privacy Office, Via F. Sforza, Palazzo Meucci – Milano 3, 20080 Basiglio (MI) fax 02.9049.3433 – e-mail ufficio.privacy@mediolanum.it
• To see the full list of managers please contact the “Manager for Response to Interested Party” as above.