PRIVACY NOTICE PROVIDED PURSUANT TO ART. 13 OF EU REG. 2016/679 – GDPR (GENERAL DATA PROTECTION REGULATION)

Homizy SIIQ S.p.A. (hereinafter also "Homizy") and Deametra SIIQ S.p.A. (hereinafter also "Deametra") as Joint Controllers of processing ("Joint Controllers"), have as their main objective the respect of applicable regulations regarding the protection of personal data. In compliance with European Regulation no. 679/2016 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, we wish to inform you, as a User of the website, or Customer, current or potential, and therefore as a data subject (hereinafter "Data Subject"), about the Real Estate Project of the Joint Controllers of Via Tucidide – towers 3 and 4, as well as about aspects relating to the processing of personal data connected to your use of our web portal (hereinafter also "Site") and related functions, or to access, in general, to services, goods and products offered by the Joint Controllers and to the exercise of your rights.

The processing carried out by the Joint Controllers will be based, as provided by the GDPR, on the principles of lawfulness, fairness, transparency, purpose limitation and storage limitation, data minimization, accuracy, integrity and confidentiality.

1. THE JOINT CONTROLLERS OF PERSONAL DATA PROCESSING AND THE DATA PROTECTION OFFICER. CONTACTS

The Joint Controllers of Processing are:

• Deametra SIINQ S.r.l. with registered office in Via degli Olivetani, 10/12, 20123 – Milan (MI), reachable at: deametra@mypec.eu
• Homizy SIIQ S.p.A. with registered office in Via degli Olivetani, 10/12, 20123 – Milan (MI), contactable at: info@homizy.com

The Data Protection Officer or Data Protection Officer (DPO or DPO) is:

• Attorney Adamo Brunetti with office in Via degli Olivetani 10/12, contactable at: a.brunetti@code4com.it

2. DATA PROCESSED BY THE JOINT CONTROLLERS

This Privacy Notice aims to inform you about the types of data processed by the Joint Controllers (par. 2), the purposes for which your data is processed (par. 3) and the legal bases that legitimize the processing (par. 4).

2.1 Website navigation data

The Joint Controllers process, first of all, the personal data you voluntarily provide on the occasion of your interactions with the Site's functionalities and/or the request for services offered by the portal, such as – by way of example – those provided in case of registration to the same website, or request for an appointment with one of our operators, or request for information or informational material in addition to:

• Navigation data, i.e., those identifying data implicit in the use of Internet communication protocols, acquired by the computer systems and software procedures responsible for consulting the website. This type of data includes IP addresses or domain names of computers and terminals used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. This is information that is not collected to be associated with identified data subjects, and which is therefore processed anonymously;
• Cookies and other tracking systems, whose specific information can be found at the following LINK.

The above-described categories of data are processed by the Joint Controllers through the website https://homizy.com/, within the limits of the purposes referred to in par. 3.

2.2 Data relating to the sales process

The Joint Controllers also process your personal data within the sales process of the real estate units offered by them.

In this context, the Joint Controllers process the personal data you provide during the purchase process (hereinafter "Process" or "Purchase Flow"), or in one of the phases into which it is divided, indicated below:

1. Teaser Phase, to which corresponds a specific section of the website (hereinafter "Teaser Section");
2. Pre-Sales or Commercial Phase, to which corresponds another section of the website (hereinafter "Project Section" or "Commercial Campaign");
3. Sales Phase.

Specifically, in each of the aforementioned phases, the Joint Controllers process the following categories of personal data:

1) Teaser Phase

• Personal and contact data (name, surname, e-mail, mobile phone) voluntarily provided by you on the occasion of your registration to the Teaser Campaign;

2) Pre-Sales Phase

• Personal data voluntarily provided by you (identifying data, contact data, relating to preferences regarding the various real estate solutions proposed, etc.) in the pre-sales phase on the occasion of interaction, by any means implemented (personally, by telephone, email, through messaging services), with our operators for the study of a project, for requesting information, for setting an appointment, for quotation, for evaluating the feasibility of a specific plan or purchase, for preliminary analysis of a real estate solution, for requesting informational material, for registration or participation in an event organized by the Joint Controllers or by a Group Company;
• Access data to the Reserved Area created for you on the SalesForce portal for the purposes referred to in par. 3, no. 2), lett. f) of this notice, i.e., your IP address, access date and geographical area from which access is made (approximately calculated based on the IP address).

3) Sales Phase

• Personal data (personal, contact, financial and tax data) provided by you in order to conduct activities – pre-contractual and contractual – attributable to the sales phase, as well as all information obtainable from identification documents that – for the same purposes – you release to the Joint Controllers (e.g., type, date of issue, expiration, etc.).

In this regard, it should be noted that, as in this case, the sales process can be managed through Group Companies with which Homizy SIIQ S.p.A. operates under a joint controllership regime. In this case, a specific notice will be provided in the section dedicated to the individual project.

No data belonging to the special categories referred to in art. 9, i.e., those capable of revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or genetic data, biometric data intended to uniquely identify a natural person, data relating to health or sex life or sexual orientation of the person, are processed – in any of the phases indicated above.

Furthermore, no data relating to criminal convictions and offenses (art. 10 GDPR) is processed.

3. PURPOSES OF PROCESSING

The Joint Controllers – in relation to the activities and phases referred to in the previous par. 2 – process your data for the following purposes:

1) Teaser Phase

a) Allow you to register, enabling you to take advantage of the services offered in this phase, such as, for example, receiving telephone information about the Project or setting an appointment with an operator;

b) With your prior consent, allow the Joint Controllers to proceed with the collection and selection of information you provide, aimed at analyzing needs and interests you have expressed towards certain real estate solutions among those proposed; this in order to allow them to identify the best offer in relation to the needs and preferences you have expressed, as well as to send you personalized informational and promotional material on real estate initiatives, projects and services proposed by the Joint Controllers;

c) Send you, with your prior consent, information and updates on real estate projects, services, offers, sales, promotional campaigns, initiatives and events promoted by the Joint Controllers or by Group Companies, as well as on events in which they participate, including any invitations to such initiatives.

2) Pre-Sales Phase

d) Allow you to register for the Project you are interested in;

e) Allow you to take advantage of the services that the Joint Controllers offer in the pre-sales phase aimed, in particular, at an in-depth and detailed knowledge on your part of the Project of which the Joint Controllers are promoters provided through face-to-face meetings or video calls;

f) Give you the possibility to access the Reserved Client Area from which you can – among other things – create new quotes, manage those already created or request to receive a purchase proposal;

g) Receive, with your prior consent, a personalized service based on your preferences and real estate needs;

h) To send you, if you consent, updates on the activities, promotional campaigns and initiatives of the Group.

3) Sales Phase

i) Allow you to manage the entire phase of pre-contractual and contractual negotiations;

j) Sign the purchase proposal, possibly using the electronic signature application made available by the Joint Controllers;

k) Enter into the preliminary and final contract;

l) Fulfill obligations arising from civil, tax and accounting regulations;

m) Carry out administrative, accounting and tax activities related to sales;

n) Manage relationships with competent Authorities for the issuance of authorizations, concessions and provisions however named, necessary for the successful outcome of sales activities and those related to them;

o) Manage relationships with Credit and Insurance Institutes with which the Joint Controllers interact on the occasion of obtaining financing and/or guarantees in support of sales contracts or the completion of banking operations ancillary to the latter;

p) Manage any disputes that may arise in the management of the sales process.

In relation to the Site's functionalities, instead, the joint controllers process your data:

q) With reference to navigation data, exclusively for statistical purposes and in anonymous form, in relation to access and use of the site, for monitoring and improving the functioning and content of the portal itself;

r) For profiling activities understood as an operation of collection and selection of information you provide, aimed at analyzing needs and interests you have expressed towards certain real estate solutions among those proposed by the Joint Controllers; this in order to allow the Joint Controllers to identify the best offer in relation to the needs and preferences you have expressed, as well as to send you personalized informational and promotional material on real estate initiatives, projects and services proposed by the Joint Controllers;

s) To send you information and updates on real estate projects, services, offers, sales, promotional campaigns, initiatives and events promoted by the Joint Controllers or by other Group Companies, as well as on events in which they participate, including any invitations to such initiatives (promotion of sales activities);

t) To verify your level of satisfaction with respect to services offered by the Joint Controllers, also with a view to continuous improvement of their quality.

u) Only in post-sales, to inform you of "similar products or services" to those offered to you in the sales phase (so-called "Soft Spam").

4. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL TO RESPOND. LEGAL BASIS OF PROCESSING

Taking into account the purposes of processing as illustrated in the previous paragraph 3, your personal data will be processed:

A. Without your express consent for the purposes referred to in letters a), d), e), f), i), j), k), l), m), n), o), p), q) and u) of the previous paragraph 3, as they are connected to the services and activities you have requested from the Joint Controllers, as well as to the execution of contractual and pre-contractual measures, in compliance with fiscal, civil and accounting obligations incumbent on them.

It follows that any failure, partial or inaccurate communication of data and information on your part may result in the impossibility on the part of the Joint Controllers to perform the aforementioned services and activities;

B. Only with your specific and distinct consent, for the purposes referred to in letters b), c), g), h), r), s), t), of paragraph 3; if you decide not to give consent to data processing for said purposes, your browsing experience will not be precluded, nor the possibility of taking advantage of services or goods offered by the Joint Controllers. We also inform you that at any time you can freely and free of charge revoke your consent through the methods indicated in the following par. 9.

All your personal data is processed by the Joint Controllers on the basis of one or more of the following lawfulness premises:

• Consent of the Data Subject – Art. 6, par. 1 Letter a) GDPR, since, with specific regard to the purposes indicated in letters b), c), g), h), r), s), and t) i.e., those of marketing and profiling, processing is possible only following your express consent in the manner referred to in art. 7 of the GDPR. Specifically, consent may be expressed alternatively upon completion of the registration Forms to the site – Teaser or of the Project you are interested in – of Homizy SIIQ S.p.A. or at the first contact with the Call Center;
• Performance of a contract or pre-contractual measures adopted at the request of the Data Subject – Art. 6, par.1 Letter b) GDPR, since, in relation to the purposes indicated in letters a), d), e), f), i), j), k), l), m), n), o) p), q), processing is made necessary by the performance of contractual provisions and pre-contractual measures adopted at your request. In particular, all data provided by you is strictly necessary for the management and execution of requests you have made in the various phases indicated in the preceding paragraphs. With reference to the purpose referred to in letter u), i.e., that of so-called "Soft Spam", the Joint Controllers make use of the email contact you have provided to propose exclusively "similar products or services" to those subject to sale. It is specified that, at any time, you can communicate to the Joint Controllers – in the manner referred to in the following par. 9 – that you do not want to receive such promotional information;
• Legal Compliance – Art. 6, par.1 Letter c) GDPR, as processing is necessary for the Joint Controllers to fulfill accounting, tax and civil obligations that – by virtue of the activity conducted and the regulations applicable to it – incumbent on them;
• Legitimate interest of the Data Controller – Art. 6, par.1 Letter f) – since processing may be necessary for the establishment of any disputes and be, therefore, supported by compliance arising from binding rules to which the Joint Controllers are subject.

5. METHODS OF PROCESSING EXECUTION

Processing is carried out with tools, both manual and computerized and telematic, with organizational and processing logics strictly related to the purposes for which the processing is carried out and in any case in such a way as to guarantee the security, integrity and confidentiality of the data itself in compliance with the organizational, physical and logical measures provided for by current provisions.

The Joint Controllers, for communications made in execution of your requests and those more properly having marketing purposes, use specially prepared information channels, such as: telephone, e-mail, SMS/MMS or instant messaging applications.

Specifically, it is the Contact Center that contacts you in the different phases of the process, both for informational purposes (par.3) and – in the post-sales phase and with your prior consent – for evaluation purposes, with a view to constant improvement of the services rendered (ref. purpose referred to in letter t) of par.3).

Homizy also uses – during the entire sales flow – SalesForce, a Customer Relationship Management (CRM) Software.

6. COMMUNICATION OF PERSONAL DATA

Your personal data may be communicated to the following categories of recipients or shared with them, within the scope of the above-indicated purposes:

• Data processors identified from time to time;
• Persons, companies or professional firms that provide assistance and consultancy activities to the Joint Controllers in accounting, administrative, legal, tax, financial and debt collection matters relating to the provision of Services;
• Subjects with whom it is necessary to interact for the provision of Services (for example hosting providers);
• Subjects delegated to carry out technical maintenance activities (including maintenance of network equipment and electronic communication networks);
• Third parties, including international ones, who provide any services in favor of the Joint Controllers;
• Companies and professionals that the Joint Controllers use to protect their rights;
• Subjects, entities or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders from authorities or to prevent and/or identify any fraudulent activities or abuses in the use of the site and services offered by the Joint Controllers;
• Persons authorized by the Joint Controllers to process personal data necessary to carry out activities strictly related to services, who have committed to confidentiality or have an adequate legal obligation of confidentiality (e.g., employees or collaborators of the joint controllers);
• With your prior consent, Group companies for autonomous direct marketing purposes.

7. PLACE OF PROCESSING

Data is processed at:

1. The headquarters of the Joint Controllers;
2. The BOX Cloud Storage whose servers are located within the perimeter of the European Union;
3. The MICROSOFT Cloud Platform as regards the website; the Data Centers of this Cloud Platform are located within the territory of the European Union;
4. The Data Centers that host the SalesForce CRM also located within the European Union;
5. The servers in which the accounting platform used by the Joint Controllers is located, which is stationed in Italian territory.

The services referred to in letters b), c), d) and e) operate in compliance with the relevant European regulations (GDPR) and according to specific policies that the Joint Controllers have acquired and that they can provide you in case of your request.

8. RETENTION PERIOD OF PERSONAL DATA

Personal data processed for the purposes of using the services made available by the Joint Controllers through the internet portal will be kept for the time strictly necessary to achieve those same purposes and, subsequently, for the time provided for by the applicable reference regulations, or until it will be necessary to process them by virtue of:

1. specific regulatory obligations;
2. provisions of public authorities;
3. obligations related to accounting;
4. any reasons of Justice, including those related to the protection of one's interests (Art. 2946 et seq. of the Civil Code).

Data processed for profiling purposes and those related to the promotion of sales activities will be kept for 24 months.

9. YOUR RIGHTS

In relation to data processed by the Joint Controllers, you may, at any time, exercise the rights listed below:

• right of access, aimed at allowing you to know what data is processed and all information related to processing;
• right of rectification, aimed at allowing you to request modification of data because it is inaccurate or obsolete;
• right to limitation of processing, aimed at allowing you to limit the processing of your data, provided that one of the cases provided for by the applicable discipline occurs;
• right to erasure, aimed at allowing you to request data deletion;
• right of opposition, aimed at allowing you to request the cessation of data processing (e.g., cessation of commercial communications).

The exercise of your rights may take place through:

1. sending an e-mail to info@homizy.com or to the PEC address deametra@mypec.eu;
2. sending a written request addressed to Homizy S.p.A., with registered office in Milan (MI), in Via degli Olivetani, 10/12, 20123 – Milan (MI).

10. COMPLAINT

We inform you that in case you should believe that the processing of your personal data through this website occurs in violation of the GDPR, you have the right to lodge a complaint with the Data Protection Authority, as provided for by art. 77 of the Regulation itself, or to resort to the competent judicial offices (art. 79 of the GDPR).