Privacy Notice pursuant to Article 13 of Regulation (EU) No. 2016/679

This notice is intended to describe how personal data is managed through the website “www.mappi.it” (hereinafter the “Website”) with reference to users who access it.

Mappi International S.r.l. intends to ensure that the processing of personal data of each visitor to the Website, carried out by any means, whether automated or manual, takes place in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, relating to the protection of natural persons with regard to the processing of personal data and to the free movement of such data (hereinafter the “GDPR”), as well as by the other applicable data protection laws, including in relation to internet access carried out from abroad, in accordance with the provisions set out in this notice.

Unless otherwise specified and governed by a specific privacy notice provided pursuant to Article 13 of the GDPR, this notice shall also be considered as a document providing the information required under Articles 13 and 14 of the GDPR to those who browse the Website and interact with the Data Controller through the services offered by the Website.

Please note that this notice applies exclusively to the Website of Mappi International S.r.l. and does not refer to any other websites that may be consulted by the user via links and/or banners present on the Website.

---

1. Data Controller and Data Protection Officer

The Data Controller of your personal data is Mappi International S.r.l., represented by its legal representative pro tempore, with registered office at Via A. Fieramonti, 1 – 04012 Cisterna di Latina – Italy, Tax Code/VAT No. IT02218070593, email: info@mappi.it.

The Data Protection Officer (DPO) is Dr. Donato Eugenio Caccavella, email: dpo.voilap@amicadpo.eu.

---

2. Types of data processed, purposes of processing and legal basis related to browsing

Our Website provides informational and, in some cases, interactive content. During browsing, user information may be collected in the following ways:

• Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes: IP addresses, browser type, operating system, domain name and addresses of websites from which access or exit was made, information on pages visited within the site, access time, time spent on each page, internal navigation paths and other parameters relating to the user’s operating system and IT environment.

Legal basis: the legitimate interest of the Data Controller in managing and administering the website, as well as improving and developing online services, pursuant to Article 6(1)(f) GDPR.

---

• Data voluntarily provided by the user

This includes all personal data voluntarily provided by the user on the Website, for example, to register and/or access restricted areas, request information about a product or service through a form, or subscribe to the newsletter service offered by the Company.

The processing of such personal data will be carried out based on the information provided in the specific privacy notices issued pursuant to Articles 13 and 14 GDPR at the time of data collection.

Legal basis: processing for this purpose is based on the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR. For the newsletter service, the legal basis is the freely given consent of the data subject pursuant to Article 6(1)(a) GDPR.

---

• Cookies

In certain cases, personal data may be processed for profiling purposes through cookies. Such processing will be carried out in accordance with the Cookie Policy available on the Website, within the limits of the consent provided by the user pursuant to Article 6(1)(a) GDPR.

Legal basis: for non-technical cookies, the legal basis is the freely given consent of the data subject pursuant to Article 6(1)(a) GDPR.

---

3. Processing methods and data transfers

Personal data is processed using IT tools suitable to ensure data security and confidentiality and in compliance with the security measures deemed appropriate by the Data Controller pursuant to Article 32 GDPR.

Data may be processed both manually and by automated means, with or without electronic tools, in accordance with the principles of fairness, lawfulness and transparency.

Personal data may also be processed by authorized personnel who need to access it for the performance of their duties, or by external parties providing services on behalf of the Data Controller (e.g. IT system management), duly appointed as Data Processors or acting as independent Data Controllers.

Personal data may be transferred to countries outside the European Economic Area where necessary in relation to the use of third-party services (such as, by way of example, hosting services, website management platforms, statistical analysis services, marketing tools or social media services).

In such cases, transfers will be carried out in compliance with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR) and only in the presence of an adequacy decision by the European Commission or through the adoption of appropriate safeguards, such as Standard Contractual Clauses (SCCs) or other legal instruments ensuring a level of protection substantially equivalent to that guaranteed within the European Union.

The Data Controller adopts appropriate technical and organizational measures to ensure the security and confidentiality of personal data, including in the event of transfers to third countries.

---

4. Data retention period

Personal data collected will be stored, in accordance with Article 5 GDPR, for a period not exceeding that necessary to achieve the purposes for which it is collected and for the maximum period required by law.

In particular, personal data will be processed for the minimum period necessary, as indicated in Recital 39 GDPR, i.e. until the termination of the relationship between the data subject and the Data Controller, without prejudice to any additional retention period required by law, as provided for by Recital 65 GDPR.

Further details on specific retention periods for each type of processing will be provided in the privacy notice issued at the time of data collection.

---

5. Data subject rights

As provided for in Article 15 GDPR, the data subject may access their personal data, request rectification or updating if incomplete or inaccurate, request erasure where data has been processed unlawfully, and object to processing for legitimate reasons.

In particular, the data subject may exercise the following rights at any time:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object (Art. 21 GDPR)

• Right to lodge a complaint with a supervisory authority

To exercise these rights, the data subject may contact the Data Controller or the DPO at: dpo.voilap@amicadpo.eu

---

6. Personal data of minors

The services provided by this application are intended for a general audience and are not directed at children under the age of 14.

The Data Controller does not knowingly collect personal data from users under this age. In the event that such data is provided, it will be promptly deleted.

---

7. Changes to this notice

This notice applies to the Website from the date of its publication and supplements the privacy notices provided during each data collection phase.

The introduction of new regulations or updates to the Website may require changes to this notice. Users are therefore invited to periodically review this page.

Any changes to the privacy notices provided during data collection will be communicated to the data subjects in the manner determined by the Data Controller.