Privacy Policy

1. Preamble. The operating model

MEDIA CONTACTLESS Srl, with registered office in Via Imperia 43, 20142, Milan (MI), Italy (hereinafter, "Media Contactless" ) is a company operating in theinformation technology sector and is, among other things, specialized in the preparation and management of software and hardware solutions based on near-field communication (hereinafter, "NFC") technology.

In particular, Media Contactless operates mainly as a platform capable of generating, transferring and making available to its customers (hereinafter, "Customers") certain data relevant to the business activity carried out by them, as a result of the use by users who are individuals (hereinafter, "Users") of NFC technology through electronic devices (hereinafter, "Services"). Media Contactless can also offer consulting services (e.g. creation of web pages), in a residual and marginal way in the current operating model.

As part of the operability in favor of its Customers (so-called "B2B") and, in particular, in the activity of data accumulation, Media Contactless processes data referable to Users collected by Customers, including any personal data, only with the prior consent of the latter where required by applicable legislation and in accordance with the rules and procedures on data protection adopted by the Customers.

As part of direct operability in favor of Users (so-called "B2C"), Media Contactless may process data and any personal data of Users only in accordance with, and for the purposes set out in, this Data processing privacy notice (hereinafter, "Privacy notice").

This Privacy policy is therefore made available to Customers and Users, as well as to any data subject, in accordance with the provisions on the protection of personal data applicable from time to time.

2. Data controller and contact information

The data, including any personal data of which Media Contactless becomes aware of in the provision of the Services, is collected and processed by Media Contactless as Data Controller.

Address

Via Imperia 43, 20142 Milan (MI), Italy.

Contact us

If you have any questions about your rights and obligations, or even just require clarifications about the methods of data processing, you can contact our Data Protection Officer at this address: privacy@mediacontactless.com

Media Contactless considers the correct and transparent management of data, including personal data, a central element of its operating model, and cares about the privacy of each data subject. Therefore, Media Contactless undertakes to cooperate with each recipient of this Privacy policy, and the other parties involved, to achieve a rapid and fair definition of any complaint in the field of data protection.

In any case, the right of data subjects to submit a complaint to the competent data protection authority remains (cf. Section 10).

3. Data categories

Media Contactless may access the User's personal data (cf. Section 1). Accordingly, Customers, through the use of the platform made available by Media Contactless, can access, and process, personal data referable to the User.

This category of data may include, by way of example but not limited to:

• the geographical location.
• telephone identity;
• the User's contacts;
• Information about tapping, clicking and browsing preferences;
• the data relating to the payment instruments used (e.g. credit card).

The User can also find information on the processing of their personal data in the context of the privacy policies or other relevant documentation adopted and made available by the Customer, in addition to this Privacy notice.

4. Mandatory or optional nature of the provision of data

The provision of personal data by the User is optional; however, failure to provide consent may not allow the User to use certain activities provided by Media Contactless and/or the Customer.

5. Processing methods

Data processing activities take place electronically, based on the information collected during the use of NFC technology. The data collected is transmitted in secure mode to the servers at Media Contactless, without any identification of the Users.

The data, including any personal data, of the Users may also be generated or transferred as part of the Services by companies of the Group Media Contactless belongs to.

6. Purposes of processing and legal basis

Personal data collected automatically can be processed for the following purposes:

• the execution of the contract;
• the fulfillment of legal obligations, including those provided for by regulations on auditing and accounts, antitrust, anti-money laundering and tax;
• the legitimate interest of Media Contactless, forthe following purposes:
• • the analysis of all or part of personal data for the improvement of our products (such as for research and development purposes);
• • the management of the existing contract, as well as of the contractual relationship, in the context of extraordinary corporate transactions, including mergers, demergers, capital increases, sale of the company, also with regard to the phases of due diligence.
• • to ensure data quality and computer security, as well as prevent, control and detect loss and unauthorized disclosures of personal data and confidential information;
• to send commercial and marketing communications or to carry out market research by e-mail or other channels, with regard to Media Contactless or Customer products. The User will always have the right not to receive such communications either at an initial time, or at any time, by communicating this choice to the contact email indicated in this Privacy notice (cf. Section 2).

7. Categories of personal data recipients

Media Contactless may disclose the User's data to the following categories of entities:

• other companies in the Group to which Media Contactless may belong (hereinafter, "Group"), also required to comply with this Privacy notice;
• supervisory authority

8. Data transfers

Media Contactless is based in the European Union. When making transfers of personal data to countries located outside the European Union area, such transfers are made in accordance with the legal and regulatory provisions in force in order to ensure an adequate level of protection.

In particular, when Media Contactless transfers personal data outside the European Economic Area (EEA), protective measures are guaranteed for the security and confidentiality of any personal data

9. Retention period

Media Contactless stores data, including any personal data that may be processed in accordance with the minimum and maximum retention periods provided for by applicable legislation.

The User's personal data is kept for as long as necessary for the operations for which such data was collected and, in any case, no later than 10 (ten) years from the termination of the relationship with Media Contactless, or pursuant to the different term in force pursuant to the legislation applicable from time to time.

Retention periods may change depending on the types of processing and applicable local regulations.

10. Data Subject's Rights

The User, if a data subject in the processing of personal data, may exercise at any time the rights to access, redress, erasure, portability, limitation or opposition, including the right to oppose decisions based exclusively on the automated processing of personal data or the right to oppose its processing, when the data is processed for profiling/marketing purposes, or based on our legitimate interest.

In particular:

1. the right to access derives from the right to obtain confirmation of the existence or not of a processing of personal data by Media Contactless;
2. the right to redress allows you to obtain without undue delay the redress of any inaccurate personal data, as well as the right to obtain the completion of any incomplete personal data;
3. the right to erasure allows you to request the erasure of your personal data when there is a reason justifying such a request, such as, for example, when the data is no longer necessary for the purposes for which it was collected;
4. the right to data portability allows you to receive personal data in a structured, commonly used and machine-readable format;
5. the right to restriction of processing allows you to request, where applicable in accordance with current legislation, a restriction of the processing of personal data;
6. the right to object allows, where applicable in accordance with current legislation, to object to the processing of personal data unless there are overriding legitimate reasons, interests, rights and freedoms or the right of defense of Media Contactless.

In addition to the above, at any time the data subject will have the right to lodge a complaint with the competent personal data protection authority, which for Italy is the Guarantor for the protection of personal data. Garante for the protection of personal data (hereinafter, "Garante")

Piazza Venezia 11

IT – 00187 ROMA

Email: protocollo@gpdp.it

Certified E-mail Address*: protocollo@pec.gpdp.it

switchboard +39 06.696771