Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679 and Art. 19 FADP

With this document (“Privacy Notice”), the Data Controller, as defined below, wishes to inform you about the purposes and methods of processing your personal data and about the rights granted to you under the Swiss Federal Act on Data Protection (FADP) and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Privacy Notice may be supplemented by the Data Controller where any additional services you may request require further processing.

Data Controller

GK Investment Holding SA, with registered office at Via Marconi 2 – Lugano, 6900 – Switzerland, represented by its legal representative pro tempore

Categories of Data Processed

The processing activities carried out are aimed at the acquisition of the following personal data:

Identification data (e.g. name, surname, date of birth, address);
Contact details (e.g. telephone, e-mail);
Technical and browsing data (e.g. IP addresses, domain names of computers)

Categories of Data Subjectsi

The processing activities carried out concern the following categories of data subjects: Website Users and Visitors, Potential Clients, Clients

Purposes, Legal Basis and Retention Period

Purposes	Legal Basis	Retention Period
The processing of data is essential to ensure the proper functioning and usability of the website by users. By way of example, such activity may include the management of sessions, traffic monitoring aimed at optimizing website performance, ensuring adequate response times, and resolving system errors.	Personal Data. The processing is necessary for the pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6, para. 1, lett. f) GDPR.	For the duration of the browsing session or in any case for a period strictly necessary to achieve the purpose (except where necessary for the investigation of offences by judicial authorities).
The processing is necessary for the use of cookies and other similar technologies. For further information, please refer to the Cookie Policy accessible from the website footer.	Personal Data. The processing is necessary for the pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6, para. 1, lett. f) GDPR.	For further details on the use of these technologies and to manage cookie settings, please consult the Cookie Policy.

Additional Processing Activities beyond navigation purposes:

Purpose	Legal Basis	Retention Period
he processing is aimed at managing and responding to requests sent by users via contact forms or other channels available on the website.	Personal Data. The processing is necessary for the performance of a contract to which the data subject is party or to take pre-contractual steps at the request of the data subject. Pursuant to Art. 6, para. 1, lett. b) GDPR.	Until the request has been fulfilled and in any case no longer than 6 months, except for possible disputes. Data will be retained for the time strictly necessary to process the request, taking into account its content and complexity (except for possible disputes).
The processing is necessary for the establishment, exercise or defence of legal claims by the Data Controller, as well as for debt recovery actions against the data subject.	Personal Data Legitimate interest of the Data Controller. Pursuant to Art. 6, para. 1, lett. f) GDPR. Special Categories of Data Establishment, exercise or defence of legal claims. Pursuant to Art. 9, para. 2, lett. f) GDPR.	For the entire duration of the dispute, until the expiry of limitation or appeal periods.
The processing is necessary for managing requests to exercise data subject rights under Arts. 15 et seq. GDPR.	Personal Data Compliance with a legal obligation to which the Controller is subject. Pursuant to Art. 6, para. 1, lett. c) GDPR.	Data will be retained for up to 5 years from the request (except for possible disputes).

Pursuant to the FADP, processing is carried out in compliance with the principles of lawfulness, good faith and proportionality (Arts. 6 et seq. FADP).

Processing Methods

The processing of data is carried out using IT tools.

Data Transfers outside the EU

Personal Data are not transferred to countries outside the European Union and the European Economic Area.

Should such transfer be necessary and/or unavoidable for organizational needs of the Controller, please note that:

transfers will take place exclusively to countries for which an adequacy decision has been issued by the European Commission;
where the country has not been recognized as adequate, transfers will be regulated by Standard Contractual Clauses or, where agreed between the Parties involved, by other safeguards under Art. 46 GDPR, or by applying one of the derogations under Art. 49 GDPR.

Transfers to third countries outside the EU/EEA and outside Switzerland will only occur if:

there is an adequacy decision by the European Commission or the Swiss Federal Council;
in the absence thereof, adequate safeguards are adopted (e.g. Standard Contractual Clauses);
or one of the specific exceptions provided by GDPR and FADP applies

Data Recipients

Personal data may be shared with service providers strictly related and functional to the Controller’s activities, who typically act as processors pursuant to Art. 28 GDPR. The full list is available by contacting the Controller at the addresses indicated above.

Data Subject Rights – Complaint to the Supervisory Authority

With regard to the processing described in this Privacy Notice, as a data subject you may, under the GDPR, exercise the rights set out in Articles 15 to 22 GDPR, including in particular the following:

Right of access – Art. 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data;
Right to rectification – Art. 16 GDPR: right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
Right to erasure (right to be forgotten) – Art. 17 GDPR: right to obtain without undue delay the erasure of personal data concerning you. The right to erasure shall not apply where processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise or defence of legal claims;
Right to restriction of processing – Art. 18 GDPR: right to obtain restriction of processing when: (a) the accuracy of personal data is contested; (b) the processing is unlawful and the data subject opposes erasure and requests restriction instead; (c) the data are required by the data subject for legal claims; (d) the data subject has objected to processing pending verification of overriding legitimate grounds of the Controller;
Right to data portability – Art. 20 GDPR: right to receive, in a structured, commonly used and machine-readable format, the personal data provided to the Controller, and to transmit those data to another controller without hindrance, where processing is based on consent and carried out by automated means. The right also includes the right to have personal data transmitted directly to another controller, where technically feasible;
Right to object – Art. 21 GDPR: right to object, at any time, to processing of personal data concerning you based on the legitimate interest condition, including profiling, unless the Controller demonstrates compelling legitimate grounds to continue processing, or for the establishment, exercise or defence of legal claims;
Right not to be subject to automated decision-making – Art. 22 GDPR: right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, unless necessary for a contract or based on your consent. In any case, you have the right to obtain human intervention, express your opinion, and contest the decision;
Right to lodge a complaint with the Italian Data Protection Authority: http://www.garanteprivacy.it.

With regard to Switzerland, the data subject may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), available at the official website: http://www.edoeb.admin.ch.

Right to withdraw consent: you may withdraw your consent at any time with the same ease with which it was given, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise the above rights, you may contact the Data Controller:

by sending an email to: communication@gkinvest.com
by calling: +41 844 00 11 11

The exercise of your rights as a data subject is free of charge pursuant to Art. 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including due to their repetitive character, the Controller may charge you a reasonable fee taking into account the administrative costs incurred to process your request, or refuse to comply with it.

Finally, please note that the Controller may request additional information necessary to confirm the identity of the data subject.