This information notice describes the methods by which MAC8 S.p.A. processes the personal data of users and subjects with whom it interacts, in compliance with the regulations in force regarding the protection of personal data.

1. Data Controller

The Data Controller is:

MAC8 S.P.A.
Registered office: Via Monte Napoleone 8, 20121 Milan (MI)
Tax code and VAT number: 13740200962
PEC: mac8spa@pec.it
Email for privacy issues: info@mac8.com

2. Principles Applicable to Treatment

The processing of personal data by MAC8 S.p.A. is based on the principles of lawfulness, correctness, transparency, purpose limitation and storage, data minimisation, accuracy, integrity and confidentiality, in accordance with Article 5 of the GDPR.

3. Types of Data Processed

The Controller processes the following categories of personal data:

• Customer and Supplier Data: Personal data (name, surname, company name), contact data (email address, telephone number), tax data (tax code, VAT number) and bank data (IBAN) required for the management of contractual and pre-contractual relations.
• Data from Potential Investors: Personal and contact details, as well as any other information provided spontaneously by interested parties in the context of negotiations, investment proposals or requests for information on the Company.
• Navigation Data: The computer systems and software procedures used to operate the website automatically acquire certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This category includes IP addresses, the domain names of the computers used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation, the time of the request and other parameters relating to the user's operating system and computer environment.
• Data provided voluntarily by the user: The optional, explicit and voluntary sending of messages to the Company's contact addresses, as well as the filling in and forwarding of any forms on the site, entail the acquisition of the sender's contact data, necessary to reply, as well as any personal data included in the communications.
• Data collected via social media: The Company is present on social platforms such as LinkedIn and Instagram. Interaction with the Company's pages on these platforms (e.g. “like”, comments, private messages) entails the processing of the user's personal data (e.g. user name, profile picture) by the Company and, under a co-ownership regime for certain operations, by the manager of the platform itself.

4. Purpose of the Processing and Legal Bases

Personal data are processed for the following purposes:

1. a) Performance of contractual and pre-contractual obligations: For the management of relations with customers and suppliers, including the conclusion of contracts, provision of services, order management, shipping, invoicing and payment management. This purpose includes all activities envisaged in the company's corporate purpose, such as buying, selling and managing real estate, providing consultancy, marketing and training services.
   * Legal basis: Performance of a contract to which the data subject is party or performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
2. b) Managing relations with potential investors: To provide requested information, conduct negotiations and carry out activities preparatory to the possible conclusion of investment or participation agreements.

* Legal basis: Execution of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).

1. c) Fulfilment of legal obligations: To fulfil obligations under tax, accounting and administrative regulations (e.g. bookkeeping, tax returns).

* Legal basis: Fulfilment of a legal obligation to which the Data Controller is subject (Art. 6(1)(c) GDPR).

1. d) Operation of the website: To ensure the proper functioning of the web pages and related services, as well as to obtain anonymous statistical information on the use of the site and to monitor its proper functioning.
   * Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR) in ensuring the security and efficiency of its website.
2. e) Marketing and promotional communications (if any): For sending newsletters, advertising material or commercial communications relating to the services offered by the Company.

* Legal basis: Specific, free and informed consent of the data subject (Art. 6(1)(a) GDPR).

1. f) Protection of rights in court: To establish, exercise or defend a right of the Controller in court.
   * Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR).
2. Nature of Data Provision

The provision of data for the purposes of points 4.a), 4.b) and 4.c) is necessary for the conclusion and execution of contractual relationships and for the fulfilment of legal obligations. Failure to provide the data will make it impossible for the Controller to continue the relationship.

The provision of data for marketing purposes (point 4.e) is optional and failure to provide it does not affect the use of the other services.

6. Data recipients

Personal data may be communicated to third parties, who will act as autonomous Data Controllers or Data Processors (ex art. 28 GDPR), for purposes strictly related to those indicated above. In particular, the data may be communicated to:

• Legal and tax consultants (lawyers, accountants) for the management of compliance and litigation.
• Credit institutions for handling collections and payments.
• Web agencies and IT service providers to maintain the web platform and IT systems.
• Auditing companies and supervisory bodies.
• Public authorities and supervisory bodies, where required by law.

The updated list of Data Processors can be requested from the Controller at the above-mentioned addresses.

7. Transfer of Data Outside the European Union

Personal data are normally processed within the European Economic Area (EEA).
However, the use of social media platforms such as LinkedIn e Instagram (owned by companies based in the United States) may involve the transfer of some personal data outside the EEA. Such transfer is legitimised by the adherence of such providers to specific GDPR safeguards, such as:

• European Commission adequacy decisions (e.g. EU-U.S. Data Privacy Framework).
• Subscription of Standard Contract Clauses (SCC) approved by the European Commission.

For more information on the privacy policies of these platforms, please refer to their respective privacy policies.

8. Data Retention Period

Personal data will be kept for a period of time not exceeding the achievement of the purposes for which they are processed, and in particular:

• For contractual and tax purposes (points 4.a, 4.b, 4.c), the data will be retained for the duration of the relationship and, after its termination, for 10 years, in compliance with civil and tax law obligations.
• Browsing data (point 4.d) are retained for a period of no more than seven days, except where required by the judicial authorities for the investigation of criminal offences.
• Data processed for marketing purposes (point 4.e) will be retained until the data subject withdraws his or her consent.
• Data collected for the handling of contact requests will be kept for the time strictly necessary to provide feedback.

9. Rights of the Data Subject

Pursuant to Articles 15-22 of the GDPR, the data subject has the right to:

• Obtaining confirmation of the existence or otherwise of personal data concerning him/her.
• Access your personal data and obtain a copy.
• Request the rectification of inaccurate data or the supplementation of incomplete data.
• Obtain the deletion of data (right to be forgotten) in cases provided for by law.
• Obtaining restriction of processing.
• Object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
• Receive their data in a structured, commonly used and machine-readable format (right to portability).
• Withdraw consent at any time, without affecting the lawfulness of the processing based on the consent given before the withdrawal.
• Complain to the Data Protection Authority (garanteprivacy.it).

10. Modalities of Exercise of Rights

The interested party may exercise his/her rights by sending a written communication to the address of the registered office of MAC8 S.p.A. or by email to the PEC address or to the email address dedicated to privacy indicated in point 1.

11. Cookies and Other Tracking Systems

Regarding the use of cookies, please refer to the appropriate Cookie Policy present on the website. In summary, the site uses technical/essential cookies, which are necessary for its operation, and functionality cookies, to improve the user experience. No sensitive personal information such as addresses, passwords, etc. is stored in the cookies used.

12. Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this privacy policy at any time, giving notice to users on this page. Therefore, please consult this page regularly, referring to the date of last modification indicated at the bottom.

Date of last modification: 26/02/2026