PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA FOR MARKETING AND COMMERCIAL COMMUNICATIONS

MVM S.r.l, with its registered office at Via del Progresso, No. 14, Correggio (RE), Italy, Tax Code and VAT number 01858720350, in its capacity as Data Controller, is committed to protecting the confidentiality of your personal data and implements appropriate measures to safeguard it against any event that could compromise its security.

The Data Controller has appointed a Data Protection Officer (DPO), who may be contacted at dpo@mvmsrl.it for any questions regarding the data protection policies and practices adopted by the Company.

for any questions regarding the data protection policies and practices adopted by the Company.

PERSONAL DATA COLLECTED AND SOURCES OF DATA

Personal identification and contact data (including email addresses and telephone numbers) may be provided directly by the data subject when completing forms on the Data Controller's websites or when requesting or using services and engaging in activities with the Data Controller.
Personal data may also be obtained from third-party partners to whom you have given authorisation for data processing and who operate through linked platforms or under specific partnership agreements.
Furthermore, personal data may be provided by third-party partners supplying databases of addresses and business contacts. Such partners may collect data, subject to the necessary authorisations, from public directories or registers or by obtaining consent directly from the data subjects concerned.

PURPOSES OF PROCESSING

Personal data may be processed for the following purposes:

1. Direct marketing activities involving the sending of promotional and informational materials, including newsletters, concerning services and activities similar to those already purchased or used with the Company;
2. Direct marketing communications concerning services already purchased or services similar to those previously purchased or used with the Company;
3. 3. Direct marketing activities involving the sending of promotional and informational materials, including newsletters, concerning new services that differ from those originally requested at the time of initial contact or following the conclusion of a contract or transaction with the Company;
4. 4. General direct marketing communications or communications concerning new services, features or activities offered by the Data Controller, its affiliated companies or other companies belonging to the MVM S.r.l. Group.

Please note that marketing communications and newsletters may contain tracking technologies, such as tracking pixels or similar tools, which allow us to monitor recipients' interactions with our emails, including whether a message has been opened or its contents viewed.
This information helps us assess the effectiveness of our marketing and information campaigns, improve the relevance and quality of our communications, and better understand recipients' interests in the Company's products, services and initiatives.

LEGAL BASIS FOR PROCESSING AND NATURE OF DATA PROVISION

With regard to the processing activities described in points 1 and 2, personal data is processed on the basis of the Data Controller's legitimate interest, pursuant to Article 6(1)(f) of Regulation (EU) 2016/679.
IThe Data Controller considers that data subjects may have a reasonable interest in receiving information about activities and services that are similar or potentially relevant to those they have previously requested or used. Likewise, the Data Controller has an interest in informing data subjects about such activities and services.
You may object to the processing of your personal data for direct marketing purposes at any time by using the appropriate opt-out procedures provided in our communications or by contacting the Data Controller using the contact details indicated in this notice.
With regard to the processing activities described in points 3 and 4, the legal basis is the data subject's consent, which is freely given and optional, pursuant to Article 6(1)(a) of Regulation (EU) 2016/679.
Refusal to provide consent will prevent the Data Controller from processing personal data for the aforementioned purposes.
Consent may be withdrawn at any time by using the appropriate opt-out procedures provided in our communications or by contacting the Data Controller using the contact details indicated in this notice.

METHODS OF DATA PROCESSING

Personal data is processed in accordance with the principles of lawfulness, fairness, transparency and data minimisation, taking into account the principles of data protection by design and by default.
Processing is carried out using appropriate technical and organisational measures, taking into account the state of the art and what is reasonably practicable, to ensure the security, confidentiality, integrity, availability and resilience of processing systems and services.
These measures are intended, among other things, to prevent the accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to, personal data, as well as any other unlawful use of such data.
Reasonable measures are also implemented to ensure that inaccurate personal data is promptly rectified or erased, taking into account the purposes for which it is processed.
Personal data collected and stored for the purposes described in this notice will be processed using IT systems, automated procedures and management software designed to optimise communication activities, including platforms and software used to send commercial information, newsletters and other communications.
Information on the Use of Artificial Intelligence – Article 13 of Italian Law No. 132 of 23 September 2025
In carrying out the tasks and/or services entrusted to us, we use, or may use, conversational Artificial Intelligence (AI) systems.
The Company has adopted internal policies and rules of conduct governing the use of Artificial Intelligence systems.
The use of AI systems by the Company is, in any event, limited to activities that are instrumental to or support the processing operations carried out.
Such activities are always subject to supervision or verification by staff members and/or individuals authorised to process personal data.

DATA RETENTION PERIOD

Personal data will be retained for a period of 24 months from the date of the last contact and/or until a request for erasure is submitted.
Data subjects may request the erasure of their personal data at any time, without affecting other activities, by using the opt-out function provided in our communications or by contacting the Data Controller.

RECIPIENTS OF PERSONAL DATA AND DATA DISCLOSURE

For the purposes described above, personal data may be disclosed to the entities and/or categories of recipients listed below, including companies and individuals based in Italy or abroad who provide services, including outsourced services, on behalf of the Data Controller.
For clarity, the following is a non-exhaustive list of potential recipients:

• IT service providers;
• Providers of dedicated service management platforms, formally appointed as external Data Processors where applicable;
• Marketing consultancy firms;
• Regulatory and supervisory authorities;
• Companies belonging to the Data Controller's corporate group within the European Union.

Personal data will not be made publicly available or disclosed to the general public.

Personal data will not be subject to solely automated decision-making.

TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

Your personal data will not be transferred outside the European Union. Should transfers of personal data outside the European Union become necessary for technical reasons, due to the adoption of new management platforms or in connection with the provision of services related to data processing, such transfers will be carried out in compliance with Articles 44, 45, 46 and 47 of Regulation (EU) 2016/679.

RIGHTS OF THE DATA SUBJECT

With regard to the personal data covered by this notice, data subjects may exercise the rights granted under Regulation (EU) 2016/679, as outlined below:

• Right of access (Article 15 GDPR): The right to obtain confirmation as to whether personal data concerning the data subject is being processed and, where applicable, to access such data and obtain a copy thereof.
• Right to rectification (Article 16 GDPR): The right to obtain the rectification of inaccurate personal data and the completion of incomplete personal data concerning the data subject.
• Right to erasure – "Right to be forgotten" (Article 17 GDPR): The right to obtain the erasure of personal data concerning the data subject without undue delay, where the conditions laid down by the Regulation are met.
• Right to restriction of processing (Article 18 GDPR): The right to obtain the restriction of processing in the circumstances provided for by the Regulation, including where the accuracy of personal data is contested or the processing is unlawful.
• Right to object (Article 21 GDPR): The right to object to the processing of personal data concerning the data subject, including the right to object at any time to processing for direct marketing purposes.
• Right not to be subject to solely automated decision-making (Article 22 GDPR): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them, except in the circumstances permitted by the Regulation.

In accordance with Article 19 of Regulation (EU) 2016/679, MVM S.r.l. will communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort

With regard to the purposes described above, data subjects may withdraw their consent to the processing of their personal identification and contact data at any time by sending an email to infoprivacy@mvmsrl.it or by using the opt-out options provided in our communications.