NOTICE ON THE PROCESSING OF PERSONAL DATAPURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 (“GDPR”)

By means of this privacy notice, L. & S. Italia S.p.A. – sole shareholder company – provides Data Subjects associated with its clients with information regarding the processing of their personal data.

Data Controller

The Data Controller, namely the entity that determines the purposes and means of the processing of personal data, is L. & S. Italia S.p.A., having its registered office at Viale L. Zanussi, 8 – 33070 Maron di Brugnera (PN), Italy, and may be contacted at the following details: Tel. +39 0434 616611, email: info@ls-light.com.

Data Protection Officer (DPO)

The Data Controller has appointed a Data Protection Officer (DPO), who may be contacted at the following email address: rpd@legalmail.it.

Purposes and Legal Bases of Processing

Personal data are processed for the following purposes and on the respective legal bases:

Processing of Personal Data under Joint Controllership

L. & S. Italia S.p.A., as a member of the L&S Group, carries out certain processing activities relating to its customers’ personal data as a joint controller together with the following Group companies (the “Joint Controllers”

L&S Lighting Corporation - sole shareholder company -

1505 Pavilion Place, Suite A, Norcross, Georgia, USA,

+18778770757, info.us@ls-light.com

L&S Deutschland GmbH - sole shareholder company -

Charles-Eames-Str. 2, 79576 Weil am Rhein, Germany,

+49522387900, info@ls-light.de

LS Lightning (Shanghai) Co., Ltd. - sole shareholder company –

No.255, Longpan Rd.,Malu Town,Jiading District

+8602169153825, info.china@ls-light.com

FLUX S.R.L. - sole shareholder company -

Via Armando Cingolani 13, 62019 Recanati (MC), Italy

+ 39 071 096 0074, sales@fluxitalia.com

Visplay GmbH - sole shareholder company -

Charles-Eames-Straße 2, 79576 Weil am Rhein, Baden-Württemberg, Germany

+49 (0)7621 986 5800, info@visplay.com

Visplay Inc - sole shareholder company -

c/o Cubework, 175 Cesanek Rd, Northampton, PA 18067, USA,

+1 484 591 3600, visplay-usa@visplay.com

Visplay Ltd. - sole shareholder company -

32 Rivington Street, London, EC2A 3LX, United Kingdom

+44 207 608 6200, visplay-uk@visplay.com

Visplay SAS - sole shareholder company -

So Square Opéra, 5, Rue Boudreau, 75009 Paris, France,

+33 788 095 291, visplay-france@visplay.com

Joint controllership arises whenever two or more controllers jointly determine the purposes and means of processing pursuant to Article 26 GDPR. In particular, within the L&S Group, joint controllership concerns the following processing activities:

• Use of the Group CRM (Customer Relationship Management) solution for the management of contractual and commercial relationships with Customers.
• Where applicable, subject to the data subject’s explicit consent, the sending of promotional newsletters relating to the companies of the L&S Group. With regard to this specific purpose, data subjects are invited to consult the newsletter privacy notice available at the following link: https://www.ls-light.com/en/privacy-policy-newsletter

Accordingly, the respective responsibilities of the Joint Controllers with regard to compliance with the obligations arising under the GDPR have been determined by means of an internal arrangement. An extract of such arrangement is available to data subjects at the following link: https://www.ls-light.com/hubfs/L-S/Corporate/policy/Joint_Controllership_Agreement.pdf

Nature of the Provision of Data

The provision of personal data required for compliance with legal obligations, for the establishment of a contractual relationship, or for its performance is mandatory. Failure to provide such data will result in the impossibility of responding to the data subject’s requests or performing the contract.

Where required, consent to the processing of personal data is optional and does not affect the provision of services. If given, such consent may be withdrawn at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal.

Disclosure of Personal Data

Without prejudice to compliance with applicable laws and regulations, personal data may be disclosed, exclusively for the purposes set out in this Privacy Notice, to:

• Companies belonging to the same corporate group;
• Entities to whom disclosure is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request, as well as, more generally, for the pursuit of the purposes set out in this Privacy Notice;
• Entities entrusted with credit management activities, such as, by way of example, factoring companies, banks and financial institutions, debt collection agencies, credit insurance companies, and business information providers;
• In particular, entities processing personal data on behalf of the Data Controller as data processors pursuant to Article 28 GDPR, including, by way of example and not limitation, professionals and/or companies engaged in administrative-accounting, legal, commercial, managerial, technical, and IT-related activities. An updated list of Data Processors is available to entitled parties upon request at the registered office of the Data Controller;
• Entities authorised to access the data pursuant to applicable legislation and/or to whom disclosure is required in compliance with legal obligations.

Personal data may also be processed by employees and collaborators assigned to the competent departments of the Data Controller, who have been expressly authorised to process personal data pursuant to Article 29 GDPR and applicable national legislation.

Transfers of Personal Data Abroad

Personal data may be transferred outside the European Union exclusively in compliance with Articles 44 et seq. of the GDPR (on the basis of adequacy decisions and/or appropriate safeguards, provided that data subjects are afforded enforceable rights and effective legal remedies, or, where applicable, on the basis of one of the specific derogations provided for under applicable law).

In particular, the sharing of the Group CRM system entails the transfer of personal data to other L&S Group companies established outside the European Union, as indicated in the section “Processing of Personal Data under Joint Controllership”. Standard Contractual Clauses pursuant to Article 46 GDPR have been executed with such entities.

Data Retention Period

Personal data shall be retained for no longer than is necessary to achieve the purposes set out in this Privacy Notice. In particular, data shall be retained in our records in accordance with the following criteria:

• Data processed for compliance with obligations pursuant to Article 2220 of the Italian Civil Code: 10 years, without prejudice to any delayed payments that may justify extended retention;
• Data processed for purposes other than those referred to above, within the scope of the contractual relationship and as described in this Privacy Notice: until the expiry of the contract and/or of the relevant commercial supply relationship.

In light of the applicable statutory limitation periods under national law, data necessary for the establishment, exercise or defence of legal claims may be retained for longer periods.

The data retained are subject to periodic review in order to assess their continued relevance in relation to the purposes for which they were collected.

Rights of the Data Subject

Data subjects have the right, in the cases provided for, to obtain access to their personal data and to request rectification or erasure thereof, or restriction of processing concerning them, or to object to processing (Articles 15 et seq. GDPR), by contacting the Data Controller at the following email address: privacy@ls-light.com.

Right to Lodge a Complaint

Data subjects who consider that the processing of personal data relating to them infringes the provisions of the GDPR have the right to lodge a complaint with the competent Supervisory Authority pursuant to Article 77 GDPR, or to seek judicial remedy pursuant to Article 79 GDPR.

L. & S. Italia S.p.A.

Last Modified: 4/03/2026