Privacy Policy

Last Updated: 2 October 2023

1. Information

Pursuant to applicable data protection laws, ESAOTE SpA (with registered office in Via Enrico Melen 77, Genoa, the Data Controller of personal data about citizens and residents of the European Union) and ESAOTE North America, Inc. (with registered office at 11907 Exit Five Parkway, Fishers, Indiana 46037, United States, the Data Controller of personal data about residents of United States and Canada) (collectively, “ESAOTE” or the "Company"), in the person of the Legal Representative, provides you with the following information regarding the use of your personal data.
We inform you that the personal data you provide will be processed in compliance with the applicable data protection legislation in your jurisdiction.

If you are a citizen or resident of the European Union, or a resident of California or Canada, please note that we have described additional details about our processing activities in your jurisdiction in the Supplemental Privacy Notices at points 10, 11, and 12 below.

2. Categories of personal data that we collect and process

We collect and process the following categories of personal data about you:

• Identifiers, such as name, alias, postal address, unique personal identifier, online identifier, email address, account name.
• Commercial information such as transaction information and purchase history.
• Internet or other electronic network activity information, such as browsing history and interactions with our website or advertisements.
• Inferences drawn from any of the Personal Information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics.
• Sensitive Personal Information, including Personal Information that reveals your:
  • Account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials for allowing access to an account;

For this Privacy Policy, “Personal Data” or “Personal Information” means information that identifies, relates, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

3. Legal basis and purpose of the processing

Your data will be collected, recorded, organized, modified, stored, processed, communicated and disseminated also together with data referring to other subjects, selected, extracted, compared and used for the following purposes:

1. fulfillment of the obligations established by laws, regulations and community legislation.
   The provision of common personal data necessary for this purpose is necessary, and its processing does not require your consent. This processing purpose is legitimized by the fulfillment of legal obligations to which the Data Controller is subject;

2. for registration on the ESAOTE WebShop, as well as for the completion of purchases on the same and for purposes strictly connected and instrumental to the management of the existing contractual relationship with you. The provision of common personal data necessary for these purposes is not mandatory, but your refusal will make it impossible for ESAOTE to implement what has been agreed in the contractual relationship with you, to which this information is attached. These processing purposes are legitimized by the execution of pre-contractual measures or the contract to which you are a party;

3. functional to ESAOTE's business:
   • promotion of ESAOTE products and services (implemented by sending commercial information or other communications relating to the economic, administrative and commercial activity of the Company, by telephone, post, forwarding agent, fax, e-mail and through reserved and private areas on our website);
   • detection of the degree of customer satisfaction - carried out by ESAOTE, through interviews, dissemination or sending questionnaires;
   • elaboration of studies and market research carried out by ESAOTE (through interviews, dissemination or sending of questionnaires);
   • profiling of user behavior within the eshop.esaote.com site.

It should be noted that the processing of personal data will not concern particular data.
Processing your personal data for the purposes indicated above is entirely optional and will be carried out only with your express, specific and unequivocal consent which you can do when registering your account and change at any other time through the personal area of your Profile. Your refusal to provide data for this purpose will have no effect in relation to the fulfillment of the service you requested from the Data Controller. You may decide to revoke any consent given at any time through the same area.

4. Sources of collection and processing method

We collect your Personal Information directly from you, through the cookies as described in our Cookie Policy, as well as from joint marketing partners, public databases, providers of demographic data, publication, professional organizations, and other entities when they share the information with us.

Personal data processing is in both hard and IT copy, by means of electronic or automated tools, in compliance with current legislation, in particular regarding confidentiality and security.

The Data Controller's organization sees to the processing directly.

5. Conservation period

The Company retains personal data in compliance with the principles of proportionality and necessity, for a period of time necessary to achieve the specific purposes of the processing, in compliance with contractual and/or regulatory obligations.
The Data Controller in particular, in relation to the purposes listed in letters a) and b) of point 2 of this information on the processing of personal data, will keep the personal data for the end of the contractual duration and, after the contract has been terminated, for the ordinary limitation period of 10 years.
With regard to the promotional activities referred to in point 2.c), the Data Controller will process the data relating to the promotional activities carried out towards you for a period of 7 years.
Once the retention terms indicated above have elapsed, the data will be destroyed, deleted or made anonymous in accordance with the cancellation and backup technical procedures and with the Owner’s accountability needs. In particular, following your possible revocation of consent, the Company will continue to process your data in order to have evidence of the fact that information and promotional marketing material will no longer be sent to you.

6. Data recipients

The data may be processed by external subjects operating as independent owners such as:

• Government authorities such as supervisory and control authorities and bodies and, in general, public or private subjects entitled to request such data,
• ESAOTE Group Affiliates: other companies of the ESAOTE Group (subsidiaries),
• Successors-in-interest during business transfers, assignments, merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all any portion of our business, assess, or stock (including in connection with any bankruptcy or similar proceedings),
• External advertising partners that conduct cross-context behavioral advertising for us.

The data may also be processed by the following categories of external parties on behalf of the Company, designated as data processors or Service Providers who are given appropriate operating instructions:

• companies specialized in marketing activities and market research companies;
• service companies;
• consultants, collaborators and freelancers.

The data will not be disseminated publicly.

7. Data controller

“Data controller” for the purpose of this Privacy Policy refers to the Esaote Group entity that determines the purposes and means of the processing of personal data and any materially equivalent terms under applicable data protection laws in the relevant jurisdiction (such as “Business” under the California Consumer Privacy Act or an “organization” that process personal information in the course of a commercial activity under the Canada Personal Information Protection and Electronic Documents Act).

For personal data about residents of United States and Canada, the Data Controller is ESAOTE North America, Inc. with registered office at 11908 Exit Five Parkway, Fishers, Indiana 46037, United States.

For personal data about citizens and residents of the European Union and any other data subject, the Data Controller is ESAOTE S.p.A., with registered office in via Enrico Melen 77, 16152 Genoa, Italy.

Our employees and our internal collaborators are authorized to process on the basis of the roles and work duties performed. Therefore, they have the right to know and process the data you transmit to us, within the limits of their competence and in accordance with the instructions given by the "Data Controller".
The treatments are carried out by internal staff, officially appointed and trained in the security and confidentiality of personal data, in accordance with the provisions of the applicable data protection legislation.

8. Contact Us

If you have questions, comments, requests, or concerns related to this Privacy Policy, the Company’s information practices, or how to access this policy in an accessible format, please contact us at dpo.esaote@esaote.com.

9. Changes to this Privacy Policy

We may revise or update this Privacy Policy at any time in our sole discretion. We will post any changes on this page and indicate at the top of the page the date this Privacy Policy was last revised or Company will contact you to inform you of the changes when required by law. We recommend that you regularly review the Privacy Policy when you visit our website.

10. Supplemental Privacy Notice for Citizens or Residents of a European Union Member State

1. Personal data processing to non-EU Countries

Personal data may be processed by other companies in the ESAOTE Group, also based in non-EU countries, whose level of data protection has in any case been considered adequate by the European Commission pursuant to Art. 45 of the GDPR or having signed Standard Contractual Clauses adopted and approved by the European Commission pursuant to Art. 46(2) (c) of the GDPR. A copy of these guarantees can be requested by sending an e-mail message to the Data Controller at the address: privacy.esaote@esaote.com.

2. Interested party rights

By writing to the e-mail address privacy.esaote@esaote.com, interested parties can request the Company, as Data Controller, to access the data concerning them, to rectify them, to integrate them if incomplete, to delete them, to limit their treatment in the cases provided for by art. 18 of the GDPR and may also oppose the processing, for reasons related to their particular situation, in the hypothesis of the Data Controller's legitimate interest.
Furthermore, in the event that the processing is based on consent or on a contract and is carried out in an automated way, the interested parties have the right to receive the data in a structured format, commonly used and readable by an automatic device and, if technically possible, have the right to transmit such data to another Data Controller without impediments.
Interested parties have the right to withdraw the consent given at any time for marketing purposes. The interested party who prefers to be contacted for the aforementioned purpose exclusively through traditional methods, can still express their opposition only to receiving communications through automated methods. Any withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent before the withdrawal itself.
Interested parties have the right to lodge a complaint with the competent supervisory authority in the Member State where they usually reside or work or in the State where the alleged violation occurred.

3. Data protection officer (DPO)

The DPO can be contacted at the following email address: dpo.esaote@esaote.com.

11. Supplemental Privacy Notice for Residents of California, United States

If you are a resident of California, you have rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations, (collectively, the “CCPA”). Pursuant to the CCPA, this Privacy Notice is intended to provide you with meaningful insight into our practices regarding your Personal Information, the rights you have, and how you may exercise them.

1. Collection, Processing, Disclosure, Sale, or Sharing of Personal Information

   We may have collected, processed, disclosed, sold, or shared the following categories of personal information about you in the preceding 12 months. For purposes of the CCPA, a “sale” is any disclosure of Personal Information to a Third Party for monetary or other valuable consideration, and a “share” is the disclosure of Personal Information to a Third Party for cross-contextual behavioral advertising, whether or not for monetary or other valuable consideration. However, we do not have actual knowledge that we sell or share Personal Information of California residents under the age of 16 years old.

   Categories of Personal Information (as described in point 2 of this Privacy Policy)	Categories of Data Recipients (as described in point 6 of this Privacy Policy) to Whom We have Disclosed Your Personal Information for a Business Purpose	Categories of Data Recipients to Whom we Have Sold or Shared Your Personal Information	Business or Commercial Purpose for Selling or Sharing Your Personal Information
   Identifiers	ESAOTE Group Affiliates Service Providers Successors-in-interest Government authorities Other Third Parties only with your consent or at your direction	External advertising partners that conduct cross-context behavioral advertising for us.	Customize our advertisements on other websites based on your user profile and preferences. Help us analyze how many visitors have seen or clicked on our advertisements in order to optimize advertising campaigns.
   Commercial information	ESAOTE Group Affiliates Service Providers Successors-in-interest Government authorities Other Third Parties only with your consent or at your direction	External advertising partners that conduct cross-context behavioral advertising for us.	Customize our advertisements on other websites based on your user profile and preferences. Help us analyze how many visitors have seen or clicked on our advertisements in order to optimize advertising campaigns.
   Internet or other electronic network activity information	ESAOTE Group Affiliates Service Providers Successors-in-interest Government authorities Other Third Parties only with your consent or at your direction	External advertising partners that conduct cross-context behavioral advertising for us.	Customize our advertisements on other websites based on your user profile and preferences. Help us analyze how many visitors have seen or clicked on our advertisements in order to optimize advertising campaigns.
   Sensitive Personal Information	ESAOTE Group Affiliates Service Providers Successors-in-interest Government authorities Other Third Parties only with your consent or at your direction	We do not sell or share this category of personal information.	N/A

2. Purpose for Processing Sensitive Personal Information

   We and our Vendors will use your Sensitive Personal Information only for the following purposes:

   • Performing the services or providing the goods reasonably expected by an average person who requests those goods or services;
   • Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
   • Resisting malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions;
   • Ensuring the physical safety of natural persons;
   • Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
   • Verifying or maintaining the quality or safety of a product, service, or device that is owned, manufactured by, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by us;
   • Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about an individual.

3. Data Subject Rights

   California residents have the following rights regarding our collection and use of their Personal Information, subject to certain exceptions.

   • Right to Receive Information on Privacy Practices: You have the right to receive the following information at or before the point of collection:
     • The categories of Personal Information to be collected;
     • The purposes for which the categories of Personal Information are collected or used;
     • Whether or not that Personal Information is sold or shared;
     • If the business collects Sensitive Personal Information, the categories of Sensitive Personal Information to be collected, the purposes for which it is collected or used, and whether that information is sold or shared; and
     • The length of time the business intends to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period.

     We have provided such information in this Supplemental Notice, and you may request further information about our privacy practices by contacting us at privacy.esaote@esaote.com.

   • Right to Deletion: You may request that we delete any Personal Information about you that we collected from you.

   • Right to Correction: You may request that we correct any inaccurate Personal Information we maintain about you.

   • Right to Know: You may request that we provide you with the following information about how we have handled your Personal Information in the 12 months preceding your request:
     • The categories of Personal Information we collected about you;
     • The categories of sources from which we collected such Personal Information;
     • The business or commercial purpose for collecting Personal Information about you;
     • The categories of Personal Information about you that we shared or disclosed and the categories of Third Parties with whom we shared or disclosed such Personal Information;
     • The business or commercial purpose for sharing and disclosing Personal Information about you; and
     • The specific pieces of Personal Information we have collected about you.

   • Right to Receive Information About Onward Disclosures: You may request that we disclose to you:
     • The categories of Personal Information that we have collected about you;
     • The categories of Personal Information that we have sold or shared about you and the categories of Third Parties to whom the Personal Information was sold or shared; and
     • The categories of Personal Information we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

   • Right to Opt-Out of the Sale and Sharing of Your Personal Information: You have the right to opt-out of the Sale and Sharing of your Personal Information. If you would like to opt-out of the Sale and Sharing of your Personal Information collected from your current device and browser, please click the icon below or the same link posted at the footer of each of our webpages. Please note that each opt-out request only applies to the device and browser that you use to submit that request. If you would like to opt out of the sale and sharing of your personal information collected from a different device or browser, you will also need to click the icon on our webpages using that device or browser.
   • Do Not Sell or Share My Personal Information
   • Right to Limit the Use of Your Sensitive Personal Information: You also have the right to limit the use of your Sensitive Personal Information to the purposes authorized by the CCPA. We do not use Sensitive Personal Information for purposes beyond those authorized by the CCPA.

   • Right to Non-Discrimination: You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights.