Exprivia S.p.A., with its registered office at Via A. Olivetti, 11, Molfetta (BA), in its capacity as the Data Controller, provides you with the following information, pursuant to Articles 13 and 14 of the GDPR, since the data is collected from third parties.

TYPES OF DATA PROCESSED

Data Types:

The data we process consists exclusively of general data collected through the organizers of the events in which we participated, who have previously obtained your consent to transfer your email address to their pre-determined partners or sponsors, including Exprivia S.p.A.;

Alternatively, your data may have been collected as a result of your consent to the disclosure of your information to other companies within the Exprivia Group, which participated as partners or sponsors in events and, in turn, received the email from the organizers of those events, who had obtained your informed consent.

PURPOSE OF THE PROCESSING AND LEGAL BASIS

NEWSLETTER SUBSCRIPTION

Your email address, collected from third parties as described above, will be used—subject to your specific consent—to send you newsletters.

Exprivia S.p.A., subject to your specific consent, may send you newsletters or white papers containing information about the products and services offered by the Exprivia Group, information about events it organizes or events in which it intends to participate as a sponsor or partner, information on regulatory updates or activities of interest in the IT sector—of which Exprivia is a part—or initiatives by Group companies, as well as similar informational materials such as proceedings from conferences or seminars in which Exprivia may have participated.

LEGAL BASIS – The legal basis for the processing is Article 6(1)(a) of the GDPR, namely your consent.

RETENTION – Your data will be retained for two years. At the end of this period, you will receive an email asking whether you are still interested in receiving newsletters, white papers, or other similar informational materials from Exprivia S.p.A. Only if you confirm your interest by clicking the link in the email will you continue to receive communications for the next two years; otherwise, your email address will be deleted. You retain the right to withdraw your consent at any time, even before the two-year period expires.

Withdrawal of consent does not affect previous processing.

DEFENSIVE PURPOSES AND LEGAL BASIS

Exprivia S.p.A. may process your data if it is necessary to establish, exercise, or defend a right in court or in an out-of-court setting (“Defensive Purposes”).

LEGAL BASIS For the purpose of legal defense, the legal basis is found in Article 6.1.f) of the Regulation, as the processing is necessary to meet any defense requirements.

RETENTION For this purpose, the data will be retained for the maximum statute of limitations period, throughout the entire defense process, and for a maximum period of ten years from the date the judgment to be enforced is issued.

COMPLIANCE WITH LEGAL OBLIGATIONS

Your data may be used to comply

with legal obligations

, such as in response to a request from a judicial authority or to address your privacy requests.

LEGAL BASIS – In this case, the legal basis for the processing is Article 6(1)(c).

RETENTION – In this case, the data will be retained for ten years.

Tracking Pixels and Profiling

We inform you that the Data Controller uses tracking pixels in emails; therefore, users who wish to technically prevent these tools from being downloaded to their computer may set their email client to display messages in text-only format. In this way, the tracking pixel—just like any other image—will not be downloaded and, therefore, will not be able to track the recipient’s behavior.

The processing of these tracking pixels complies with Article 122 of the Privacy Code, since, on the one hand, they allow for the “storage of information on the terminal device of a contracting party or user” (i.e., the insertion of the tracking pixel into the email) and, on the other hand, subsequently allow for “access to information already stored” (i.e., the tracking, via that pixel, of the user’s behavior).

We also believe it is appropriate to inform you that the inclusion of tracking pixels in emails constitutes an instruction, directed at your device, to send specific information to the parties that use them; this information consists of:

• the pixel ID,
• the user ID,
• the message ID,
• the delivery ID in the form of a timestamp relative to the actual delivery,
• any security tokens used to ensure the integrity of the message

and enable tracking of whether the recipient opens the email and clicks on subscription buttons and links to content on the Exprivia website.

Sending this information also allows us to monitor your habits ……… and to profile you; for this reason, we have requested your specific consent for the collection of tracking pixels for profiling purposes. Through the use of tracking pixels, the Data Controller carries out automated behavioral segmentation and profiling activities. If you do not consent to profiling but do consent to marketing activities, the Data Controller, unless you exercise your right to object, may use tracking pixels to carry out general promotional activities (e.g., determining which products and services are most popular or which types of emails are not opened) but not personalized activities based on profiling.

We also inform you that you have the right to object to the use of tracking pixels and that this right to withdraw consent may be exercised on a granular basis with respect to the processing of your data for marketing purposes or other similar rights.

You may, therefore, exercise your right to opt out of the use of tracking pixels by clicking the link provided in the footer of the email, which will take you to the section dedicated to exercising your rights.

By clicking on the link, you will be able to access a private area where you can exercise your privacy rights; there, you can request that we stop sending you unsolicited emails or, alternatively, stop using tracking pixels (which are used for marketing profiling) while continuing, thereby continuing to receive generic, non-personalized promotional emails that do not contain tracking markers.

Exercising your right to opt out of tracking will in no way affect your ability to use the services and products offered, in full respect of your freedom of choice.

3 CONSENT AND WITHDRAWAL

To validly obtain your consent to receive newsletters, we use a double opt-in procedure.

In fact, consent will be considered valid only if the email address holder has previously confirmed subscription to the newsletter by clicking on the link provided in the confirmation email. To verify this, we record the completion of each step in the two-step opt-in process.

For those processing activities for which consent must be obtained as the legal basis, you may revoke your consent at any time. Therefore, regarding the processing involved in sending newsletters, you may withdraw your consent at any time by contacting the DPO via email; to make this easier for you, every newsletter email will include a link allowing you to exercise your right to object.

Withdrawal of consent does not affect processing that has already taken place.

Exercising your right to object will result in the removal of your email address from the newsletter database, and this action will be recorded in our databases.

4 DATA PROTECTION OFFICER (DPO)

The Data Controller, together with the other companies of the Exprivia Group, has appointed a Data Protection Officer in accordance with Articles 37 et seq. of EU Regulation 2016/679, who can be contacted at the following email address: DPO_ExpriviaSpa@exprivia.com.

5 DISCLOSURE AND/OR DISTRIBUTION OF DATA

Within the Exprivia organization, your data may be processed by employees who need to know and/or use it solely for the performance of their duties and for the purpose of providing the requested services. These individuals are designated in writing by Exprivia S.p.A. as authorized data processors and have been trained on the obligations set forth in the GDPR. This does not constitute a form of disclosure but rather a transfer of data.

5.1 SCOPE OF DISCLOSURE

Your data, however, may be disclosed to the following parties:

external consultants (e.g., law firms) for the exercise of the right to defense or for cybersecurity purposes;

institutions and/or public authorities, judicial authorities, law enforcement agencies, and data protection authorities for the fulfillment of legal obligations;

subject to prior consent, other companies within the Exprivia Group—a list of which can be viewed at the link provided in the following paragraph—which may use such data for the same purposes.

The personal data collected will not be disclosed.

6 TRANSFER OUTSIDE THE EU

Your personal data will be stored on a server located within the European Union.

We do not transfer your personal data outside the European Union or the European Economic Area for the purposes set forth in paragraph 2 of this policy.

In particular, in the event of a transfer to third countries for which the European Commission has not issued an adequacy decision regarding the level of personal data protection, Exprivia will implement the safeguards provided for in Chapter V, “Transfers of Personal Data to Third Countries or International Organizations,” of the Regulation, including the adoption of standard contractual clauses.

With regard to the transfer of data to other companies in the Exprivia Group located in non-EU countries that do not have adequate legal safeguards, such transfers will take place only if standard contractual clauses have been signed.

7 RIGHTS OF DATA SUBJECTS

“

Data subjects

,” that is, the natural persons to whom the data refer, may, at any time, exercise the following rights set forth in Articles 15 et seq. of the GDPR:

Right of access: You have the right to obtain from the data controller confirmation as to whether or not personal data concerning you are being processed and, if so, to obtain access to the personal data and the information specified in Article 15 of the General Data Protection Regulation;

Right to rectification: You have the right to obtain from the data controller the rectification of inaccurate personal data concerning you without undue delay and the completion of incomplete personal data, including by providing a supplementary statement;

Right to erasure: You have the right to obtain from the data controller the erasure of your personal data without undue delay, provided that the grounds specified in Article 17 of the General Data Protection Regulation apply;

Right to restriction of processing: You have the right to obtain from the data controller a restriction of processing when one of the circumstances set forth in Article 18 of the General Data Protection Regulation applies;

Right to data portability: You have the right to receive, in a structured, commonly used, and machine-readable format, the personal data concerning you that you have provided to the data controller. You also have the right to transmit such data to another data controller, without hindrance from the data controller to whom you provided the data, provided that the conditions set forth in Article 20 of the General Data Protection Regulation are met;

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data in the cases and under the conditions set forth in Article 21 of the General Data Protection Regulation;

The right to withdraw consent at any time pursuant to Article 7(3) of the General Data Protection Regulation, without prejudice to the lawfulness of processing carried out on the basis of consent that was subsequently withdrawn;

The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning the data subject or similarly significantly affects the data subject, in accordance with the procedures set forth in Article 22 of the GDPR. The aforementioned rights may be exercised by sending a request to Exprivia S.p.A. at the address indicated above, or to the Data Protection Officer specifically appointed for the Exprivia Group, who can always be contacted at the email address dpo_expriviaspa@exprivia.com.

Right to File a Complaint with the Supervisory Authority. Finally, if you believe that the processing of your data violates the provisions of the Regulation or if you believe that the response you have already received from the Data Controller is unsatisfactory, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) as provided for in Article 77 of the Regulation, or to bring the matter before the appropriate courts (Article 79 of the Regulation).

CONSENSUS FORMULAS

• I have read the privacy policy provided to me by Exprivia S.p.A.
• I authorize Exprivia S.p.A. to use my email address to send newsletters, white papers, or similar informational materials related to IT services;
• I authorize Exprivia S.p.A. to use my email address, including tracking pixels that record when the email is opened and when links are clicked, to personalize promotional campaigns for profiling purposes in order to offer you the IT services that are of greatest interest to you.

Following the completion of the development of our Artificial Intelligence Management System (AIMS), on July 27, 2026, Exprivia also successfully completed the certification process, which attests to the system’s compliance with the requirements of the international standard ISO/IEC 42001.

This achievement represents a significant recognition of the company’s commitment to promoting the responsible, transparent, and secure use of AI in compliance with applicable regulatory requirements, further strengthening the trust of our customers, partners, and stakeholders in our ability to manage innovation in a structured and effective manner.

The Artificial Intelligence Management System (SGIA), adopted by Exprivia in accordance with the principles and requirements of the ISO/IEC 42001 standard, provides a structured framework for the governance, development, implementation, and monitoring of artificial intelligence systems. This system supports the organization in the responsible, secure, and transparent use of AI technologies, facilitating risk management, regulatory compliance, stakeholder protection, and continuous performance improvement, while promoting innovation.

Specifically, this certification attests to the development and provision of generative AI systems, machine learning models, and intelligent automation components to support business processes for public and private sector clients, in accordance with the Statement of Applicability , Version 2.1, dated July 20, 2026.

Achieving this certification is not an endpoint, but rather the beginning of a new phase aimed at leveraging the certification as a strategic tool and progressively expanding the adoption of the AI Governance System throughout the entire organization, increasingly integrating AI governance into business processes with the goal of making Artificial Intelligence a driver of responsible innovation and value creation for our Group.