Privacy Notice pursuant to Article 13 of the GDPR Data Controller The Data Controller’s details are specified in the listing (hereinafter the "Web Page") regarding the business activity published on web portals and, where applicable, on the Data Controller’s business page on social networks (e.g., Instagram and Facebook). Personal data processed When the user utilizes the services described below, the following personal data are processed: personal and contact details (e.g., first and last name/company name, telephone number, e-mail address, VAT number, company name, physical address); other data voluntarily provided in sections where a message or information can be entered, as well as in the Reviews section. Furthermore, the Data Controller may process so-called tracking pixels—tiny, transparent, and invisible images embedded in the body of e-mails sent for service-related or commercial communications (subject to the necessary consent). Whenever the recipient opens the message and has enabled image downloading, the pixel is downloaded from the sender's remote server, automatically transmitting information such as: (i) the recipient's device IP address, (ii) the type of client/browser and operating system used, (iii) the date, time, and number of times the message was opened, and (iv) the recipient's unique identifier. Purposes and legal bases for processingPersonal data will be processed for the following purposes, where applicable: Managing and responding—including via direct contact (e.g., telephone and SMS)—to requests for the provision of a service (e.g., requests for information, assistance, or bookings) submitted through contact channels available on the webpage published on web portals or social media. Where available, these channels may include: (i) email, SMS, and data collection forms (e.g., feedback request forms, event registration forms); (ii) social media channels such as Instagram Direct and Facebook Messenger, which may also involve the use of artificial intelligence systems; and (iii) artificial intelligence systems, such as chatbots for responding to inquiries and AI voice systems that require the recording and transcription of telephone calls to provide the service. The legal basis for this processing is the performance of a contract to which the user is a party or the implementation of pre-contractual measures taken at the user's request. Providing personal data is necessary in such cases. Failure to provide the data may make it impossible to provide the service to the user.Managing and responding—including via telephone—to requests to download the catalog submitted by filling out the dedicated form. The legal basis is the performance of a contract to which the user is a party or the implementation of pre-contractual measures taken at the user's request. Providing personal data is necessary in these cases. Failure to provide the data may make it impossible to fulfill the user's request. Requesting a coupon to take advantage of offers proposed by the Data Controller. The legal basis for the aforementioned purposes is the performance of a contract to which the user is a party or the implementation of pre-contractual measures taken at the user's request. Providing personal data is necessary in these cases. Failure to provide the data may make it impossible to use a coupon. Managing and responding to reviews published on the Web Page, including through the use of artificial intelligence systems. To write and publish a review, the user must register for or log in to one of the web portals specifically indicated in the privacy policy found at the bottom of the account registration form. Reviews are subject to a moderation process carried out by a human operator and/or an artificial intelligence system.The legal basis for the aforementioned purposes is the performance of a contract to which the user is a party or the implementation of pre-contractual measures taken at the user's request. Providing personal data in such cases is necessary. Failure to provide the data may result in the inability to respond to reviews. Sending promotional communications via automated and non-automated means (e.g., email and SMS) regarding the Data Controller’s services and products, including through the use of tracking pixels. Such communications may also be managed using artificial intelligence systems designed to create campaigns for the Data Controller. The legal basis for processing is consent, which the user may withdraw at any time. Providing personal data and the corresponding consent is optional. However, failure to provide data for this purpose makes it impossible for the Data Controller to pursue this specific purpose. Sending personalized promotional communications via automated and non-automated means (e.g., email and SMS) based on an analysis of the user's preferences and habits; this process involves the use of artificial intelligence systems designed to create the Data Controller’s campaigns. The legal basis for processing is consent, which the user may withdraw at any time. Providing personal data and the corresponding consent is optional. However, failure to provide data for this purpose makes it impossible for the Data Controller to pursue this specific purpose. Complying with legal and regulatory obligations and requests from competent authorities. The legal basis for processing is the legal obligation to which the Data Controller is subject. Providing personal data for this purpose is necessary to enable the Data Controller to fulfill the aforementioned legal obligations. To establish, exercise, and defend a right in judicial or extrajudicial proceedings. The legal basis for the aforementioned processing is the Data Controller's legitimate interest. Categories of data recipientsThe Data Controller may disclose personal data to external parties acting as independent data controllers or as data processors appointed pursuant to Article 28 of the GDPR. Users wishing to receive further information regarding the list of recipients may submit a request to the Data Controller. Transfer of data abroad For the purposes indicated above, the Data Controller may need to transfer personal data outside the EU to countries for which the European Commission has not issued an Adequacy Decision. In such cases, the Data Controller undertakes to ensure adequate levels of protection and safeguards—including contractual ones—in accordance with applicable regulations, potentially supplemented by technical, legal, and organizational measures necessary to guarantee a level of personal data protection equivalent to that of the EU. Users wishing to receive further information regarding the safeguards implemented may submit a request to the Data Controller. Personal data retention period The Data Controller retains personal data for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose, in compliance with the storage limitation principle set forth in Article 5(1)(e) of the GDPR. User personal data processed for purposes 1 through 3 are retained for the time necessary to fulfill the request and for no longer than 12 months from collection. Data processed for the purpose of managing and responding to reviews are retained for 2 years from collection. Data processed for sending commercial communications are retained for 24 months from the granting of consent, or until such consent is withdrawn, whichever occurs first. Data processed for the sending of personalized commercial communications is retained for 12 months from the time consent is given, or until such consent is withdrawn, whichever occurs first.Data processed for sending personalized commercial communications is retained for 12 months from the time consent is given, or until such consent is withdrawn, whichever occurs first. Regarding data processed to comply with legal obligations, the data is retained for the period prescribed by law. Should it be necessary to process data for legal defense purposes, such data is retained for the duration during which claims and/or legal actions may be pursued—specifically, throughout the pre-litigation and litigation phases, until the expiration of time limits for filing appeals or challenges. Rights of the Data Subject Users may at any time exercise the rights listed below—as set forth in Articles 15–21 of the GDPR—by contacting the Data Controller directly using the contact details published on the Webpage and/or on the Data Controller’s business page on social networks (where applicable): Access – obtain confirmation from the Data Controller regarding the existence of their data and request a copy thereof; Rectification – request the modification of their data; Erasure – request the deletion of their data; Withdrawal – withdraw specific consents via the channels made available to the data subject, without affecting the lawfulness of processing carried out prior to such withdrawal; Restriction – request the restriction of processing, in the cases provided for by law; Objection – object to processing on legitimate grounds; Portability – receive an electronic copy of their data; Complaint – lodge a complaint with the Supervisory Authority (Italian Data Protection Authority – *Garante per la protezione dei dati personali* – www.garanteprivacy.it) in the event of a violation of personal data protection regulations. Last update: September 2026.

Assistenza Tecnica Dal 1998