Db Shaper S.r.l., having its registered office in Viale Lombardia 4, 26900 Lodi (LO), VAT No. and
Fiscal Code No. 10323430966 (hereinafter, “DB SHAPER”), hereby provides the privacy policy
pursuant to Article 13 of the Legislative Decree No. 196/2003 (the “Privacy Code”), in its capacity
as data controller in relation to personal data pertaining to the users registered to the Website
and to the App(hereinafter, the “Users”).

DB SHAPER takes the outmost account to the privacy rights and to the protection of its Users’
personal data. Users may contact DB SHAPER for any information in relation to this privacy policy
at any time whatsoever using the contacts specified under the following paragraph 5.

1. Purposes of data processing

The Users’ personal data will be processed by DB SHAPER for the following processing purposes:
a) contractual obligations (Article 24, paragraph 1, letter b) of the Privacy Code), i.e. in order to give
execution to the General Conditions of the Website and the App, being accepted by the User
during the registration process; fulfil specific requests of the User. Such data collected in order to
provided the services are: name, surname and nickname voluntarily chosen by the ser, age,
province of residence/domicile, gender, electronic e-mail address, and any personal information of
the User eventually and voluntary published. Subject to the User giving DB SHAPER a secific and
optional consent to its data processing for marketing purposes pursuant to the following
paragraph 2, any contact data (name, surname, electronic mail address) will be used by DB
SHAPER for the sole purpose of ascertaining the identity of the relevant User (also by means of
validation of the electronic e-mail address), avoiding frauds or infringements, and contact the User
only for services reasons (sending news in relation to Services offered on the Website and on the
App). In any case, DB SHAPER would never give access to User’s data to third parties or other
b) accounting-administrative purposes (Article 24, paragraph 1, letter 1-ter) of the Privacy Code), or
in order to carry out organisational, administrative, financial and accounting ctivities, as internal
organisational activities and activities aimed at fulfilling contractual and precontractual
c) legal obligations (Article 24, paragraph 1, letter a) of the Privacy Code), or in order to fulfil
obligations provided by the law or the European laws and regulations. Providing the ersonal data
for the processing purposes specified above is optional but necessary, since failing to provide the
same imply the impossibility to register to the Website and to the App. A star in the registration
form identifies the personal data, which are necessary for purporting the processing purposes
described under this paragraph 1.

2. Further purposes of processing: newsletter and marketing (sending advertising material,
direct sales and commercial communication)

With the free and optional User’s consent, some User’s personal data (name, surname and
electronic mail address) may be processed by DB SHAPER for a periodic newsletter and for
marketing purposes (direct sale, dispatch of marketing material and commercial communication)

or in order for DB SHAPER to contact the relevant User by means of electronic mail for proposing
to the same to purchase products and/or services offered by DB SHAPER and/or third parties
companies, present offers, promotions and commercial opportunities.

Giving consent to personal data processing for such purpose is free and optional and, in the event
such consent is missing, the possibility to carry on a purchase is not prevented in any manner
whatsoever. In the event that such consent has been granted, the relevant User may revoke the
same at any time whatsoever upon request to DB SHAPER following the methods specified under
the following paragraph 6. The relevant User may also easily oppose to the sending of further
marketing communications (by e-mail) also clicking on the specific revocation link for revoking the
consent, which is included in each marketing e-mail. Once revoked the consent, DB SHAPER will
send to the User an electronic mail message in order to confirm that the consent has been actually
revoked. DB SHAPER hereby informs that, following the exercise of the right to object to the
sending of marketing communications, it could be possible due to technical issues (i.e. sending list
already completed a little before the receipt by DB SHAPER of the objection request) the relevant
User continues receiving further marketing messages. In the event that the relevant User
continues receiving marketing messages once elapsed 24 hours from the exercise of the objection
right, please flag such issue to DB SHAPER, using the contacts specified under the following
paragraph 5.

3. Processing methods

Users’ personal data processing will be carried out by manual and IT instruments, applying logics
strictly connected to the purposes and, in any case, so that the safety and confidentiality of he
relevant data is guaranteed.

4. Data disclosure and dissemination

DB SHAPER’s employees and/or workers appointed to manage personal data may become aware
of any Users’ personal data. Such subjects, who are formally appointed by DB SHAPER as “persons
in charge for the processing”, will process the relevant User’s data exclusively for the purposes
specified under this policy and in compliance with the provisions of the Privacy Code.
Furthermore, third parties which may process personal data for the account of DB SHAPER may
become aware of any Users’ personal data in their capacity as “data processors”, such as,
including, but not limited to, providers of logistics and IT services functional for the Website and
the App operational, outsourcing or cloud computing services providers, professionals and
advisors, companies entrusted with the sending of marketing e-mails for the account of DB
SHAPER. Any users have the right to obtain a list of the data processors (if any) appointed by DB
SHAPER upon a specific request to be made to DB SHAPER following the modalities specified
under the following paragraph 5.

5. Data subjects’ rights

Pursuant to Article 7 of the Privacy Code, DB SHAPER hereby informs that any Users has the right
to obtain the indication of (i) the source of the personal data; (ii) the purposes and methods of the
processing; (iii) the logic applied to the processing, if the latter is carried out with the help of
electronic means; (iv) the identification data concerning data controller and data processors; (v)
the entities or categories of entity to whom or which the personal data may be communicated and
who or which may get to know said data in their capacity as designated data processor(s) or

person(s) in charge of the processing. Furthermore, data subjects have the right to obtain: a)
updating, rectification or, where interested therein, integration of the data; b) erasure,
anonymization or blocking of data that have been processed unlawfully, including data whose
retention is unnecessary for the purposes for which they have been collected or subsequently
processed; c) certification to the effect that the operations as per letters a) and b) have been
notified, as also related to their contents, to the entities to whom or which the data were
communicated or disseminated, unless this requirement proves impossible or involves a
manifestly disproportionate effort compared with the right that is to be protected. Users have the
right to object, in whole or in part: a) on legitimate grounds, to the processing of personal data
concerning him/her, even though they are relevant to the purpose of the collection; b) to the
processing of personal data concerning him/her, where it is carried out for the purpose of sending
advertising materials or direct selling or else for the performance of market or commercial
communication surveys. Users may exercise such rights by contacting DB SHAPER by the following
methods: (i) sending a registered letter with return receipt to the registered office of DB SHAPER,
(ii) sending an electronic mail message to the address