SNATT LOGISTICA S.p.A., (Tax Code and VAT No.: 02060420359) (hereinafter “SNATT”), in the person of its pro tempore legal representative, with registered office in Campegine (RE), Via Kennedy, 12/b , in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), informs you that, pursuant to Article 13 of the GDPR, your personal data described in Article 1 below will be processed for the purposes described in Article 2 below.

1. Category of personal data subject to processing.

1.1. SNATT collects and processes, for the purposes described in Article 2, your personal data pursuant to Article 4(1) of the GDPR, i.e. identification/common/contact data (e.g. name; surname; e-mail address), including any additional information you enter in the free text field provided by SNATT in the form on the SNATT website (hereinafter “Website”).

2. Purposes of processing and related legal basis.

2.1. Your personal data is processed by SNATT for the following purposes:

To fulfil your request for contact/further information.

In accordance with Article 13(2)(e) of the GDPR, SNATT specifies that any failure to provide (even partially) your personal data, which may be required as mandatory in the form on the Website, may make it impossible for SNATT to correctly and completely fulfil the processing purpose referred to in Article 2.1. letter a). In this regard, SNATT specifies that the legal basis for the processing purpose referred to in Article 2.1. letter a) is found in the following regulatory provision: Article 6, paragraph 1) letter b) of the GDPR.

2.2. Your personal data is/may be processed by SNATT for the following processing purpose, subject to obtaining your specific, informed, free and unequivocal consent:

Sending commercial/promotional/advertising/marketing communications (including market research), to be carried out by automated/electronic/telematic means (e.g. e-mail; newsletters).

In accordance with Article 13(2)(c) of the GDPR, SNATT informs you of your right to withdraw, at any time, any consent you may have given for the processing purpose described in Article 2.2(b), without this affecting the lawfulness of the processing based on the consent given prior to the withdrawal. In this regard, SNATT specifies that the legal basis for the processing purpose described in Article 2.2. letter b) can be found in the following regulatory provisions: Article 6(1)(a) of the GDPR; Article 130(1) and (2) of the amended Legislative Decree No. 196/2003 (Privacy Code).

3. Retention period.

3.1. In accordance with Article 13(2)(a) of the GDPR, SNATT informs you of the following retention periods/criteria, at the end of which your personal data may be subject to erasure, destruction or anonymisation: (i) for the purposes of processing referred to in Article 2.1. letter a): 5 years, starting from the complete and full execution of your request for contact/further information, a term that may be extended in order to comply with regulatory obligations (including those that may arise) or to assert or defend a right, including in court; (ii) for the fulfilment of the processing purpose referred to in Article 2.2. letter b): until consent is revoked.

4. Recipients.

4.1. In accordance with Article 13(1)(e) of the GDPR, SNATT informs you that your personal data may be communicated, where appropriate and necessary, to one or more recipients pursuant to Article 4(9) of the GDPR, identified in general terms by category: (i) for the purposes of processing referred to in Article 2.1. letter a): subjects authorised pursuant to Articles 4(10), 29 and 32(4) of the GDPR to process data by SNATT (hereinafter “subjects authorised to process data by SNATT”); companies controlled by/connected to SNATT, in compliance with Recital 48) of the GDPR; consultants/companies of various kinds/forms that provide services directly/indirectly connected to the fulfilment of the processing purpose referred to in Article 2.1. letter a) (e.g. ICT companies); (ii) for the execution of the processing purposes referred to in Article 2.2. letter b): persons authorised to process data by SNATT; subsidiaries/affiliates of SNATT, in accordance with Recital 48) of the GDPR; consultants/companies of various kinds/forms that provide services directly/indirectly related to the fulfilment of the processing purposes referred to in Article 2.2. letter b) (e.g. marketing companies). Finally, SNATT specifies that your personal data will not be disclosed for the purposes of processing described above.

5. Transfer.

5.1. Your personal data is/will be stored in automated/partially automated/non-automated archives belonging to, or in any case attributable, even indirectly, to SNATT, and located within the European Economic Area (EEA). In the event that storage in fully or partially automated archives potentially outside the EEA occurs, SNATT hereby specifies that, pursuant to Article 13(1)(f) of the GDPR, it will comply with the safeguards set out in Chapter V of the GDPR.

6. Rights of the data subject.

6.1. With regard to your personal data, SNATT informs you that you have the right to exercise the following rights, which may be subject to the limitations provided for in Articles 2-11 and 2-12 of the Privacy Code: right of access pursuant to Article 15 of the GDPR: right to obtain confirmation as to whether or not personal data are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, storage period); right to rectification pursuant to Article 16 of the GDPR: right to correct, update or supplement personal data; right to erasure pursuant to Article 17 of the GDPR: right to obtain the erasure or destruction or anonymisation of personal data, where the conditions listed in the same article are met; right to restriction of processing pursuant to Article 18 of the GDPR: right with a markedly precautionary connotation, aimed at obtaining the restriction of processing where the conditions governed by Article 18 apply; right to data portability pursuant to Article 20 of the GDPR: the right to obtain personal data provided to the Data Controller in a structured, commonly used and machine-readable format (and, where requested, to transmit them directly to another Data Controller), where the specific conditions indicated in the same article are met (e.g. legal basis of consent and/or performance of a contract; personal data provided by the data subject); right to object pursuant to Article 21 of the GDPR: right to obtain the permanent cessation of a specific processing of personal data; right to lodge a complaint with the Supervisory Authority (i.e., the Italian Data Protection Authority) pursuant to Article 77 of the GDPR: right to lodge a complaint where it is believed that the processing under analysis violates national and EU legislation on the protection of personal data.

6.2. In addition to the rights described in Article 6.1 above, the Data Controller informs you that, in relation to your personal data, you have the right, where possible and applicable, to exercise, on the one hand, the (sub) right provided for in Article 19 of the GDPR (“The data controller shall communicate any rectification or erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall communicate those recipients to the data subject upon request”), which is to be considered connected and related to the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, the Data Controller informs you that, in relation to your personal data, you have the right, where possible and appropriate, to exercise the right provided for in Article 22(1) of the GDPR (“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”), subject to the exceptions provided for in paragraph 2 below.

6.3. In accordance with Article 12(1) of the GDPR, SNATT undertakes to provide the communications referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the request of the data subject, shall be provided orally, provided that the identity of the data subject is verified by other means.

6.4. In accordance with Article 12(3) of the GDPR, SNATT informs you that it undertakes to provide information regarding the action taken in response to a request pursuant to Articles 15 to 22 of the GDPR without undue delay and, in any case, no later than one month after receipt of the request; this deadline may be extended by two months if necessary, taking into account the complexity and number of requests (in this case, SNATT undertakes to inform you of this extension and the reasons for the delay within one month of receiving the request).

6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details provided in Article 7 below.

7. Contact details.

7.1. SNATT can be contacted at the following address: snattlogisticaspa@legalmail.it

7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by SNATT, is Gabriele Borghi, who can be contacted at the following address: dpo@snatt.it

Campegine (RE), 10 September 2025 (date of last update).

SNATT LOGISTICA S.p.A.

(in the person of its pro tempore legal representative)