INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Regulation (EU) 2016/679

This information notice describes the methods by which MAC8 S.p.A. processes the personal data of users and subjects with whom it interacts, in compliance with the regulations in force regarding the protection of personal data.

1. Data Controller

The Data Controller is:

MAC8 S.P.A.
Registered office: Via Monte Napoleone 8, 20121 Milan (MI)
Tax code and VAT number: 13740200962
PEC: mac8spa@pec.it
Email for privacy issues: info@mac8.com

2. Principles Applicable to Treatment

MAC8 S.p.A.'s processing of personal data is guided by the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation, accuracy, integrity, and confidentiality, in accordance with Article 5 of the GDPR.

3. Types of Data Processed

The Controller processes the following categories of personal data:

• Customer and Supplier Data: Personal data (name, surname, company name), contact data (email address, telephone number), tax data (tax code, VAT number) and bank data (IBAN) required for the management of contractual and pre-contractual relations.
• Data from Potential Investors: Personal and contact details, as well as any other information voluntarily provided by interested parties in the context of negotiations, investment proposals, or requests for information about the Company.
• Navigation Data: Automatically, the computer systems and software procedures used to operate the website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses, domain names of the computers used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation, the time of the request, and other parameters relating to the user's operating system and IT environment.
• Data provided voluntarily by the user: The optional, explicit and voluntary sending of messages to the Company's contact addresses, as well as the completion and submission of any forms on the site, involves the acquisition of the sender's contact details, necessary to respond, as well as all personal data included in the communications.
• Data collected via social media: The Company is present on social media platforms such as LinkedIn and Instagram. Interaction with the Company's pages on these platforms (e.g. “likes”, comments, private messages) involves the processing of the user's personal data (e.g. username, profile image) by the Company and, in joint control for certain operations, by the platform operator itself.

4. Purpose of the Processing and Legal Bases

Personal data are processed for the following purposes:

1. a) Performance of contractual and pre-contractual obligations: For managing relationships with customers and suppliers, including the drafting of contracts, the provision of services, order management, shipments, invoicing and payment management. This purpose includes all activities covered by the Company’s corporate object, such as the buying, selling and management of real estate, and the provision of consultancy, marketing, and training services.
   * Legal basis: Performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
2. b) Managing relations with potential investors: To provide requested information, conduct negotiations and carry out activities preparatory to the possible conclusion of investment or participation agreements.

* Legal basis: Execution of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).

1. c) Fulfilment of legal obligations: To fulfil obligations under tax, accounting and administrative regulations (e.g. bookkeeping, tax returns).

* Legal basis: Fulfilment of a legal obligation to which the Data Controller is subject (Art. 6(1)(c) GDPR).

1. d) Operation of the website: To ensure the proper functioning of the web pages and related services, as well as to obtain anonymous statistical information on site usage and to monitor its correct operation.
   * Legal basis: Legitimate interest of the Data Controller (Article 6(1)(f) GDPR) in ensuring the security and efficiency of their website.
2. e) Marketing and promotional communications (if any): For sending newsletters, advertising material, or commercial communications relating to the services offered by the Company.

* Legal basis: Specific, free, and informed consent of the data subject (Article 6(1)(a) GDPR).

1. f) Protection of rights in court: To establish, exercise or defend a right of the Controller in court.
   * Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR).
2. Nature of Data Provision

The provision of data for the purposes referred to in points 4.a), 4.b) and 4.c) is necessary for the drawing up and execution of contractual relationships and for the fulfilment of legal obligations. Failure to provide such data will make it impossible for the Data Controller to proceed with the relationship.

The provision of data for marketing purposes (point 4.e) is optional and failure to provide it does not affect the use of the other services.

6. Data recipients

Personal data may be communicated to third parties, who will act as autonomous Data Controllers or Data Processors (ex art. 28 GDPR), for purposes strictly related to those indicated above. In particular, the data may be communicated to:

• Legal and tax consultants (lawyers, accountants) for the management of compliance and litigation.
• Credit institutions for handling collections and payments.
• Web agencies and IT service providers to maintain the web platform and IT systems.
• Auditing companies and supervisory bodies.
• Public authorities and supervisory bodies, where required by law.

A revised list of data processors can be requested from the controller at the contact details provided above.

7. Transfer of Data Outside the European Union

Personal data is normally processed within the European Economic Area (EEA).
However, the use of social media platforms such as LinkedIn e Instagram (affiliated with companies based in the United States) may involve the transfer of some personal data outside the EEA. This transfer is legitimised by such providers' adherence to specific safeguards provided for by the GDPR, such as:

• European Commission adequacy decisions (e.g. EU-U.S. Data Privacy Framework).
• Subscription of Standard Contract Clauses (SCC) approved by the European Commission.

For more information on the privacy policies of these platforms, please refer to their respective privacy policies.

8. Data Retention Period

Personal data will be kept for a period of time not exceeding the achievement of the purposes for which they are processed, and in particular:

• For contractual and tax purposes (points 4.a, 4.b, 4.c), the data will be retained for the duration of the relationship and, after its termination, for 10 years, in compliance with civil and tax law obligations.
• Navigation data (point 4.d) are retained for no longer than seven days, except where necessary for the investigation of criminal offences by the judicial authorities.
• The data processed for marketing purposes (point 4.e) will be retained until consent is revoked by the data subject.
• Data collected for the handling of contact requests will be kept for the time strictly necessary to provide feedback.

9. Data Subject Rights

In accordance with Articles 15-22 of the GDPR, the data subject has the right to:

• To obtain confirmation as to whether or not personal data concerning him/her exists.
• Access your personal data and obtain a copy.
• Request the correction of inaccurate data or the completion of incomplete data.
• Obtain data erasure (right to be forgotten) in cases provided for by law.
• Obtaining restriction of processing.
• Object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
• Receive their data in a structured, commonly used and machine-readable format (right to portability).
• Withdraw consent at any time, without affecting the lawfulness of the processing based on the consent given before the withdrawal.
• Complain to the Data Protection Authority (garanteprivacy.it).

10. Modalities of Exercise of Rights

The data subject may exercise their rights by sending a written communication to the registered office address of MAC8 S.p.A. or via PEC email or to the dedicated privacy email address indicated in point 1.

11. Cookies and Other Tracking Systems

Regarding the use of cookies, please refer to the specific Cookie Policy present on the website. In summary, the site uses technical/essential cookies, which are necessary for its operation, and functionality cookies, to improve the user experience. No sensitive personal information such as addresses, passwords, etc. is stored in the cookies used.

12. Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this privacy policy at any time, giving notice to users on this page. Therefore, please consult this page regularly, referring to the date of last modification indicated at the bottom.