Zonzers S.r.l.

Personal Data Processing Notice

Pursuant to Art. 13 of EU Regulation 2016/679

Dear User, in compliance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “Regulation”), we wish to inform you about the processing of your personal data during your use of the Zonzers Application (hereinafter the “App”). Art. 13 of the Regulation establishes that, when the Data Controller collects data directly from the data subject, it must provide certain information, which is set out below:

---

1. Categories of personal data processed

In connection with your use of the App, Zonzers collects and processes your personal data belonging to the following categories:

1. common data as referred to in Art. 4(1) of the GDPR: first name, last name, username, password, gender, date of birth, email address, age, languages spoken, image, geolocation;
2. payment data (bank details);
3. usage-related data (such as access logs, activity logs, device information).

2. Purposes of processing and relevant legal basis

The categories of personal data described in the previous point are processed by Zonzers for the following purposes:

• creating and managing your account on the Zonzers App;
• fulfilling obligations imposed by laws, regulations, or provisions issued by authorities legally empowered to do so and by supervisory and oversight bodies;
• defending or establishing a right in civil, administrative, or criminal proceedings;
• producing statistics and qualitative analysis of processes;
• sending, including via newsletter, informational, commercial, and advertising material about Zonzers' products, services, or initiatives, in order to promote them, carry out direct sales, conduct market research, and verify the quality of the products or services offered;
• analyzing preferences, interests, habits, ways of using the services, interactions with the App, communications, and promotional initiatives, in order to offer content, services, offers, and communications that are personalized and more closely aligned with each user's interests.

The legal basis for the processing is as follows:

• for the purposes referred to in letter a), the performance of the employment contract to which you are a party (Art. 6(1)(b) GDPR);
• for the purposes referred to in letter b), the need to fulfill the legal obligations to which the Data Controller is subject (Art. 6(1)(c) GDPR);
• for the purposes referred to in letters c) and d), the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR);
• for the purposes referred to in letters e) and f), your freely given consent (Art. 6(1)(a) GDPR).

Providing your personal data for the purposes referred to in letters a), b), c), and d) is necessary for the creation and management of your account, as the processing is required for the performance of contractual and/or legal obligations. It is therefore not necessary to provide your consent.

Providing your personal data for the purposes referred to in letters e) and f) is optional, and any refusal to consent does not affect your ability to use the services offered. Consent may be withdrawn at any time in the manner indicated in this privacy policy. In particular, you may unsubscribe from the newsletter at any time using the unsubscribe procedure provided in the footer of the newsletter itself.

3. Data retention

Zonzers retains your personal data in compliance with the principles of proportionality and necessity, for the period set out in company policies and, in any event, for a period not exceeding what is necessary to achieve the purposes for which it was collected or subsequently processed, as well as for the period required by law for administrative purposes, for managing any complaints/disputes, or for criminal-law purposes. Personal data collected for marketing and profiling purposes is retained for 12 months and 24 months, respectively, from account deactivation.

4. Disclosure and transfer outside the EU

Some processing of your personal data may also be carried out by third parties to whom Zonzers entrusts activities (or part of them) connected with the management of the employment relationship and with the purposes referred to in point 2 of this notice. Such third parties may also be established abroad, in EU or non-EU countries; in the latter case, the data transfer is carried out on the basis of a specific European Commission decision regarding the adequacy of the level of data protection in the non-EU country, or on the basis of the appropriate and suitable safeguards provided for in Arts. 46 or 47 of the GDPR (e.g., the signing of the “standard contractual clauses” for data protection adopted by the European Commission) or other legal grounds for transfer provided for in Art. 49 of the GDPR. We inform you that your personal data may be disclosed to:

• parties whose access to the data is recognized by legal, regulatory, or EU provisions;
• duly appointed Data Processors;
• Authorities (e.g., AGCom, AGCM, and the Italian Data Protection Authority), the Judicial Authority, and any other public body legally entitled to request the data.

5. Rights of the data subject

With regard to the processing of data described herein, as a data subject you may exercise the rights provided for by the Regulation (Arts. 15-22), including:

• receiving confirmation of the existence of your personal data and accessing its content (right of access);
• updating, modifying, and/or correcting your personal data (right to rectification);
• requesting the erasure or restriction of processing of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which it was collected or otherwise processed (right to erasure and right to restriction);
• objecting to the processing (right to object);
• receiving, in a structured, commonly used, and machine-readable format, the data provided to the Data Controller and, where technically feasible, transmitting it to another data controller without hindrance, where the conditions for exercising the right to data portability under Art. 20 of the GDPR are met;
• withdrawing consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

6. Exercising your rights

We also inform you that you may exercise the rights referred to in the preceding paragraph by sending a specific request to the Data Controller (including by downloading the relevant form from the website of the Italian Data Protection Authority), through the following methods:

• by email to the following address: info@zonzers.com;
• by sending a request to the DPO c/o Zonzers S.r.l., Corso Venezia, 36 – 20121 Milan, or to the email address: dpo@zonzers.com;
• by postal mail to Zonzers S.r.l. – Corso Venezia, 36 – 20121 Milan.

Also pursuant to EU Regulation 2016/679, you have the right both to lodge a formal complaint with the Data Protection Authority (Art. 77) in accordance with the procedures indicated on the Authority's website, and to bring a judicial action (Art. 79).