Subject: INFORMATION NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 679/2016 FOR THE WEBSITE

With this notice, drafted pursuant to Article 13 of EU Regulation No. 679/2016, Eurojersey S.p.A. (hereinafter also referred to as the “Controller” or the “Company”), in its capacity as Data Controller, provides you with the following information regarding the processing of your personal data carried out through consultation of the Company’s website.

1. Data Controller

The Data Controller is Eurojersey S.p.A., with registered office at Via San Giovanni Bosco, 260, 21042 Caronno Pertusella (VA).

Contact details: privacy@eurojersey.com.

2. Categories of Data Processed

For the purposes set out below, the following categories of Data will be processed:

• common or “identification” data, such as, by way of example: first name, last name, residential address, email and telephone contact details, tax code.

3. Purposes and Legal Basis of Processing

Your Data may be processed for the purposes listed below:

4. Mandatory or Optional Nature of Data Provision

The provision of personal data is optional, but necessary in order to browse the Controller’s website.
Failure to provide personal data will result in the inability to properly browse the website.

With reference to the newsletter service, consent may be withdrawn at any time by sending a specific request to the Data Controller using the contact details indicated above. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The provision of data for receiving the newsletter is optional and does not affect the other purposes of processing.

5. Methods of Processing and Communication of Data

The processing of Data will be carried out in accordance with the above-mentioned legislation, using both electronic and manual tools, ensuring the adoption of appropriate organizational and technical measures. The Company adopts appropriate preventive organizational and technical security measures aimed at safeguarding the confidentiality, integrity, completeness, and availability of the data subject’s personal data. Technical, logistical, and organizational measures are implemented to prevent damage, loss (including accidental loss), alteration, improper use, and unauthorized access to the processed data.

6. Data Recipients

The following categories of subjects may have access to personal data:

a) Within the organizational structure of the Data Controller, within the limits and in accordance with the duties assigned to them, and only where necessary for the purposes indicated above, individuals designated for processing pursuant to Article 2-quaterdecies of Legislative Decree 196/2003, or persons authorized to process data pursuant to Article 29 GDPR. These subjects operate on the basis of specific instructions provided by the Data Controller in order to process your personal data securely;

b) Subjects appointed as Data Processors pursuant to Article 28 GDPR, who process personal data on behalf of the Data Controller in relation to specific purposes. These subjects operate on the basis of a specific contract aimed at ensuring the secure processing of your personal data.

The complete list of such subjects may be requested by contacting the Data Controller using the contact details provided in this notice.

7. Transfer of Data outside the European Economic Area (EEA)

The Data Controller does not transfer your personal data to countries outside the EEA.

Should any third parties potentially be based in or use cloud services located in non-EU countries, please note that such countries provide an adequate level of data protection, as established by specific decisions of the European Commission.

The transfer of personal data to third parties residing or located in countries outside the European Union that do not ensure an adequate level of protection will only be carried out with the data subject’s consent or following the conclusion of specific agreements between the Data Controller and such parties, including safeguard clauses and appropriate guarantees for the protection of personal data (so-called “Standard Contractual Clauses”), also approved by the European Commission, or where the transfer is necessary for the conclusion and performance of a contract between the Data Controller and the data subject or for handling their requests.

8. Data Retention Period

Personal data will be processed for the time necessary to achieve the purposes indicated above (see paragraph 3), in compliance with applicable legislation.

Data relating to processing carried out for commercial communications via newsletters (paragraph 3(b)) will be retained for the time strictly necessary to achieve the above purposes, in compliance with applicable legislation and, in any case, for a period not exceeding 24 months from the granting of consent or its possible renewal.

If consent is subsequently withdrawn, the Data Controller will retain evidence of such consent solely for evidentiary purposes and to protect its rights, in order to demonstrate that the data subject validly provided consent, for a period of ten years.

A longer retention period may apply in the event of disputes. In such cases, personal data will be retained until the conclusion of the proceedings and the execution of any related measures.

9. Data Subject Rights

Pursuant to Articles 15–22 of the Regulation, the data subject has the right to exercise the following rights in relation to the personal data covered by this notice, as provided for and guaranteed by the Regulation:

1. Right of access and rectification (Articles 15 and 16 GDPR): you have the right to access your personal data and request that it be corrected, amended, or supplemented. If desired, we will provide a copy of the data we hold about you.

2. Right to erasure (Article 17 GDPR): in the cases provided for by applicable law, you may request the deletion of your personal data. Upon receipt and assessment of your request, we will cease processing and delete your personal data where the request is legitimate.

3. Right to restriction of processing (Article 18 GDPR): you have the right to request the restriction of processing of your personal data in the case of unlawful processing or where you contest the accuracy of the data.

4. Right to data portability (Article 20 GDPR): you have the right to obtain your personal data from the Data Controller in order to transmit it to another controller, in the cases provided for by the relevant article.

5. Right to object (Article 21 GDPR): you have the right to object at any time to the processing of your personal data based on our legitimate interest, by explaining the reasons for your request; before granting it, the Data Controller will assess your reasons.

6. Right to lodge a complaint (Article 77 GDPR): you have the right to lodge a complaint with the competent Data Protection Authority if you believe that a violation of your rights has occurred or is ongoing in relation to the processing of your personal data.

To exercise these rights, the data subject may contact the Company using the contact details indicated above.

10. Changes to this Notice

This privacy notice may be subject to changes and additions over time, as required due to new regulatory developments in the field of personal data protection or changes in the Controller’s operations.

In such cases, the Data Controller undertakes to provide you with the updated notice.

Last updated: April 2026