Privacy Policy

Courtesy translation: in case of any discrepancy, the Italian text prevails.

Contents

• Introduction
• Data Controller
• Scope of Application
• Definitions
• Principles of Processing
• Categories of Personal Data
• Processing Activities and Lawful Bases
• Account Registration and Management
• Mamify Services
• AiToro Services
• Cashback Services
• Affiliate Programme
• Revenue Sharing Services
• Orders and Payment Processing
• Stripe Payment Services
• Wise Payment Services
• Amazon Web Services (AWS)
• Domain Registration and DNS Services
• Push Notification Services
• Geolocation Services
• Cookies and Similar Technologies
• Marketing Communications
• Automated Decision-Making and Profiling
• International Data Transfers
• Data Retention
• Security Measures
• Exercise of Data Subject Rights
• Erasure Requests
• Complaints
• Contact

1Introduction

Condividiamo Ltd ("Condividiamo", the "Company", "we" or "our") recognises the importance of protecting the privacy and personal data of every person who uses its services.

This Privacy Policy explains how personal data is collected, used, stored, shared and protected when individuals interact with:

• the Mamify platform;
• the AiToro platform;
• the websites operated by Condividiamo;
• the mobile applications;
• the cashback services;
• the affiliate programmes;
• the revenue sharing services;
• customer support;
• the digital products;
• the online events;
• the newsletters;
• the commercial communications;
• all other services provided by Condividiamo.

Condividiamo processes personal data in accordance with:

• the Gibraltar General Data Protection Regulation ("Gibraltar GDPR");
• the Data Protection Act 2004;
• where relevant, any other applicable legislation in the jurisdictions in which the Company operates.

This Privacy Policy applies to every natural person whose personal data is processed by Condividiamo.

2Data Controller

The Data Controller of personal data is:

Condividiamo Ltd

Registered office: Gibraltar

Email: privacy@mamify.app

Website: https://www.condividiamo.club

Where required by applicable law, Condividiamo may appoint data processors or authorised representatives acting on its behalf.

All data processors are contractually required to process personal data solely on the basis of documented instructions received from Condividiamo and to implement appropriate technical and organisational security measures.

3Scope of Application

This Privacy Policy applies whenever a person:

• creates an account;
• accesses Mamify;
• accesses AiToro;
• purchases products or services;
• receives cashback;
• joins an affiliate programme;
• participates in revenue sharing activities;
• books appointments;
• contacts customer support;
• receives notifications;
• visits our websites;
• subscribes to newsletters;
• communicates with Condividiamo through any channel.

The Policy applies regardless of whether the Services are used via desktop computers, mobile phones, tablets, web browsers, mobile applications, APIs or future digital platforms operated by Condividiamo.

4Definitions

For the purposes of this Privacy Policy:

5Principles of Processing

Condividiamo processes Personal Data in accordance with the following principles:

### Lawfulness

Processing takes place only where there is a lawful basis under Article 6 of the Gibraltar GDPR.

### Fairness

Personal Data is processed fairly in relation to Data Subjects.

### Transparency

Condividiamo provides clear information on: why Personal Data is processed; which Personal Data is collected; the lawful basis relied upon; retention periods; recipients; international transfers; the rights of Data Subjects.

### Purpose Limitation

Personal Data is collected only for specified, explicit and legitimate purposes.

### Data Minimisation

Only the Personal Data necessary for the relevant processing activity is collected.

### Accuracy

Reasonable measures are taken to ensure that Personal Data remains accurate and up to date.

### Storage Limitation

Personal Data is retained only for the period necessary to fulfil the relevant purpose or to comply with applicable legal obligations.

### Integrity and Confidentiality

Appropriate technical and organisational measures are implemented to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access.

### Accountability

Condividiamo maintains internal procedures adequate to demonstrate compliance with the Gibraltar GDPR. The Company regularly reviews its processing activities, security measures and public documentation to ensure continued compliance with applicable law.

6Categories of Personal Data

Depending on the Services used, Condividiamo may collect and process the following categories of Personal Data. The categories of data collected vary according to the functionality used by the User and the contractual relationship established with Condividiamo.

### 6.1 Identification Data

Condividiamo may process identification information including: first name; surname; username; profile photograph (where voluntarily provided); date of birth; nationality (where required); tax code or equivalent identification data where required by applicable law; identity documents issued by public authorities where necessary for identity verification or legal compliance. The Company processes only the identification data necessary for the specific service requested.

### 6.2 Contact Data

Condividiamo may process: email address; mobile telephone number; postal address; country of residence; preferred language; preferred method of communication. This data is used to provide the services requested and to communicate with Users.

### 6.3 Account Data

When an account is created or managed, Condividiamo processes: User ID; username; encrypted password; login history; authentication records; account status; User preferences; notification preferences; security settings. Passwords are never stored in plain text and are protected by one-way cryptographic hashing algorithms that comply with industry standards.

### 6.4 Financial Data

Depending on the Services used, Condividiamo may process: cashback balances; wallet balances; orders; purchases; transactions; revenue sharing records; affiliate commissions; payment confirmations; invoices; credit notes; refund information. Condividiamo does not store full payment card numbers. Payment card information is processed directly by authorised payment service providers.

### 6.5 Technical Data

When Users access the Services, Condividiamo automatically processes certain technical information including: IP address; browser type and version; device model and identifier; operating system; screen resolution; language settings; time zone; application version; crash reports; diagnostic information; security logs; error logs. This data is processed to ensure the stability, availability and security of the Services.

### 6.6 Usage Data

Condividiamo records information relating to the use of its Services, including: access dates and times; pages visited; features used; cashback activity; referral activity; affiliate activity; participation in revenue sharing; purchases; orders; interactions with customer support; participation in webinars; use of digital products. Usage data contributes to improving the quality and security of the Services.

### 6.7 Geolocation Data

Where enabled by the User or permitted by device settings, Condividiamo may process approximate geolocation data. Geolocation may be used for purposes such as improving the User experience; providing location-based services; preventing fraud; security monitoring; compliance with legal obligations where applicable.

Users may disable location permissions at any time through their device settings. Disabling may limit the availability of certain features. Condividiamo does not continuously monitor the User's location, unless this is expressly required by a specific feature requested by the User.

### 6.8 Communications

Condividiamo processes the communications exchanged with Users, including: emails; support tickets; contact forms; live chat messages; WhatsApp messages; messages received via social media; appointment requests; webinar registrations; conversations with customer service. Communications may be retained where necessary to respond to requests, demonstrate compliance, resolve disputes, improve customer support or fulfil legal obligations.

### 6.9 Marketing Data

Where permitted by applicable law, Condividiamo may process: newsletter subscriptions; marketing preferences; participation in promotional campaigns; consent records; communication preferences; opt-in and opt-out records. Marketing communications are sent only where there is a valid lawful basis under Article 6 of the Gibraltar GDPR. Where consent is required, Users may withdraw it at any time.

### 6.10 Data Collected from Third Parties

In limited circumstances, Condividiamo may receive Personal Data from third parties, including: payment providers; business partners; affiliate partners; identity verification providers (where applicable); fraud prevention services; regulatory authorities; public registers where permitted by law. Condividiamo processes such Personal Data only where there is a valid lawful basis and only for the purposes for which the data was lawfully obtained.

### 6.11 Sensitive Data

Condividiamo does not intentionally collect or process special categories of Personal Data under Article 9 of the Gibraltar GDPR, unless: this is expressly required by law; it is necessary for the establishment, exercise or defence of a legal claim in judicial proceedings; the Data Subject has given explicit consent where permitted by law. Where the processing of special categories of Personal Data becomes necessary, Condividiamo will implement additional safeguards appropriate to the nature of the data.

7Processing Activities and Lawful Bases

Condividiamo processes Personal Data only where there is a valid lawful basis under Article 6 of the Gibraltar General Data Protection Regulation. Each processing activity has been assessed individually and is linked to a specific lawful basis. Condividiamo does not indiscriminately rely on all lawful bases for every processing activity.

### 7.1 Processing Activities

Account registration

Identification, contact and account data

Creation and management of User accounts

Art. 6(1)(b) – Performance of a contract

Until account closure and applicable statutory retention periods

User authentication

Account credentials, technical data

Secure access to the Services

Art. 6(1)(b)

Duration of the account

Management of User profiles

Account data and preferences

Personalisation of the Services

Transaction, wallet and order data

Administration of cashback programmes

Duration of the contractual relationship

Transaction records, affiliate data, payment records

Calculation and distribution of revenue sharing

Duration of the contractual relationship and applicable statutory periods

Identification data, commissions, referral records

Management of affiliate relationships

Purchase of products and services

Orders, invoices, payment confirmations

Fulfilment of customer orders

Applicable statutory retention periods

Payment processing

Billing data, transaction records

Processing of payments through authorised providers

Art. 6(1)(b) and 6(1)(c) where required by law

Customer support

Contact data, communications, support history

Responding to requests and providing support

Art. 6(1)(b) and 6(1)(f) where appropriate

24 months from the closure of the support request

Webinar registration and attendance

Contact data, attendance data

Organisation of online events and training

24 months unless a longer retention period is required by law

Push notifications

Device identifiers, notification preferences

Sending of service-related notifications

Security monitoring

IP addresses, technical logs, authentication records

Protection of systems and prevention of unauthorised access

Art. 6(1)(f) – Legitimate interest

In accordance with the Data Retention Policy

Fraud prevention

Transaction history, technical data

Detection and prevention of fraudulent activity

Art. 6(1)(f)

For as long as necessary for fraud prevention and legal protection

Approximate location data

Provision of location-based features and fraud prevention

Art. 6(1)(b) or 6(1)(a) where consent is required

Only for as long as necessary to provide the relevant feature

Contact data, communication preferences

Sending of promotional communications

Art. 6(1)(a) – Consent, or 6(1)(f) where permitted

Until the User withdraws consent or objects

Newsletters

Email address

Distribution of newsletters

Art. 6(1)(a)

Until consent is withdrawn

Compliance with legal obligations

Financial records, identification data

Compliance with tax, accounting and regulatory obligations

Art. 6(1)(c)

As required by applicable law

Defence in legal proceedings

Relevant personal data

Establishment, exercise or defence of a legal claim

Until the expiry of the limitation period or the conclusion of the proceedings

Internal audits and compliance

Processing records, operational data

Compliance monitoring and governance

As necessary for compliance purposes

### 7.2 The Lawful Bases Explained

### Performance of a Contract – Article 6(1)(b)

Processing is necessary for the performance of a contract with the User or to take pre-contractual steps at the User's request. This applies, for example, to: account creation; provision of Mamify and AiToro services; cashback programmes; affiliate management; revenue sharing; order fulfilment; customer support directly connected to the contractual services.

### Legal Obligation – Article 6(1)(c)

Some Personal Data must be processed to comply with legal obligations to which Condividiamo is subject, including accounting obligations; tax compliance; compliance with court orders; compliance with requests from competent public authorities. Where Personal Data is retained solely to comply with a legal obligation, such data will not be used for marketing or other incompatible purposes.

### Consent – Article 6(1)(a)

Where processing is based on consent, it must be freely given, specific, informed and unambiguous. Users may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

### Legitimate Interest – Article 6(1)(f)

Condividiamo may process Personal Data where necessary for its own legitimate interests or those of a third party, provided that such interests do not override the rights and freedoms of the Data Subject. Legitimate interests include protecting the security of the Services; preventing fraud; preventing abuse of the platforms; maintaining the integrity of systems; defence in legal proceedings; carrying out internal audits; improving operational efficiency. Before relying on legitimate interest, Condividiamo carries out an assessment to ensure an appropriate balance with the rights and freedoms of Data Subjects.

### 7.3 No Automated Decisions with Legal Effects

Unless otherwise indicated for a specific Service, Condividiamo does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning Users or similarly significantly affect them. Should automated processing be introduced in the future, Condividiamo will provide the appropriate information pursuant to Articles 13, 14 and 22 of the Gibraltar GDPR.

8Account Registration and Management

### 8.1 Creating an Account

Users may create an account to access one or more services offered by Condividiamo, including the Mamify and AiToro platforms. During registration, Users may be asked to provide the information necessary to create and maintain their account. Depending on the service requested, this may include: first name; surname; email address; telephone number; country of residence; username; password; preferred language; referral or affiliate information where applicable. Condividiamo collects only the information necessary to provide the Services requested.

### 8.2 Accuracy of Information

Users are responsible for ensuring that the information provided at registration remains accurate, complete and up to date. In the event of changes, the User is required to update their account or inform Condividiamo without undue delay.

### 8.3 Account Security

Users are responsible for maintaining the confidentiality of their login credentials. Users must choose a strong password; keep their credentials confidential; immediately inform Condividiamo of any suspected unauthorised access; avoid sharing the account with third parties unless expressly authorised by the applicable service.

Condividiamo will never ask for a User's password by email, telephone or messaging applications.

### 8.4 Suspension of Accounts

Condividiamo may temporarily suspend access to an account where reasonably necessary to: investigate suspected fraud; prevent unauthorised access; comply with legal obligations; protect the security of the Services; carry out scheduled maintenance; protect the rights of Users or third parties. Where appropriate, the User will be informed of the suspension and the reasons for it.

### 8.5 Closure of Accounts

Users may request the closure of their account at any time. Closure of the account does not automatically result in the immediate deletion of all Personal Data. Some Personal Data may continue to be retained where necessary to comply with legal obligations; to establish, exercise or defend a legal claim in judicial proceedings; to comply with tax or accounting legislation; to protect the security and integrity of the Services. Any Personal Data retained will be processed solely for such purposes and subject to appropriate access restrictions.

9Mamify Services

Mamify is a digital platform operated by Condividiamo that gives Users access to cashback services, digital products, promotional campaigns, training content, affiliate programmes and additional services offered through the platform.

The processing of Personal Data within Mamify is limited to what is necessary for: User authentication; account administration; cashback management; purchase of products and services; affiliate management; customer support; platform security; fraud prevention; compliance with applicable law.

Where new features are introduced within Mamify, Personal Data will be processed only where there is an appropriate lawful basis. Should additional categories of Personal Data become necessary, this Privacy Policy will be updated accordingly, where required by law.

10AiToro Services

AiToro is a digital platform operated by Condividiamo that offers training, commercial and platform-related services. Depending on the features used, Personal Data may be processed for: User registration; access management; training content; appointment scheduling; webinars; customer support; commercial communications; account management; platform security.

Condividiamo does not provide regulated financial advice through AiToro.

Where Users access services provided by third-party financial institutions or brokers through the platform, such third parties remain independently responsible for the processing of Personal Data carried out on their own systems. Users are encouraged to consult the privacy notices of such third-party providers before using their services.

11Cashback Services

Condividiamo operates cashback programmes through the Mamify platform. To administer such programmes, Condividiamo may process: account data; transaction history; purchase records; cashback balances; order history; participation in promotional campaigns.

Cashback calculations are carried out using the information necessary to determine eligibility and to calculate applicable rewards. Cashback records may be retained where necessary to administer accounts, resolve disputes, comply with legal obligations and meet accounting and audit requirements.

12Affiliate Programme

Users may participate in the affiliate programmes offered by Condividiamo, where applicable. Participation may require the processing of: affiliate identification data; referral records; commission records; network structure; qualification history; payment information.

Affiliate data is processed solely for the administration of the programme and the fulfilment of contractual obligations. Participation in an affiliate programme does not authorise Users to process the Personal Data of third parties, except where permitted by applicable law and in accordance with separate contractual agreements.

13Revenue Sharing Services

Where Users participate in revenue sharing programmes offered by Condividiamo, the Company may process the Personal Data necessary to: record participation; administer contractual rights; calculate revenue allocations; process payments; comply with accounting obligations; resolve disputes; comply with legal and regulatory requirements.

Revenue sharing calculations are based on the contractual agreements applicable to the relevant programme. Financial records relating to revenue sharing may be retained for the period required by applicable accounting, tax and legal obligations.

14Orders and Payment Processing

### 14.1 Purchase of Products and Services

Condividiamo allows Users to purchase products and services through the Mamify and AiToro platforms. To process an order, Condividiamo may collect and process: customer identification data; billing data; order details; products or services purchased; payment status; invoice data; cashback information where applicable. Processing is necessary for the performance of the contract concluded with the User.

### 14.2 Order Management

Personal Data is processed for purposes such as order confirmation; order fulfilment; customer support; invoicing; refunds; accounting; fraud prevention; dispute resolution. Only authorised personnel may access order information, where necessary to perform their duties.

### 14.3 Invoicing

Where required by applicable law, Condividiamo processes the Personal Data necessary to issue invoices; issue credit notes; comply with accounting obligations; comply with tax legislation. Accounting documentation is retained for the period required by applicable legislation.

15Stripe Payment Services

Condividiamo uses Stripe to process electronic payments made through its Services. Stripe acts as an independent payment service provider and processes payment information in accordance with its own privacy notice and applicable financial legislation.

Condividiamo does not receive or store full payment card numbers, CVV codes or other sensitive card authentication data.

The information received from Stripe is limited to what is necessary to confirm successful payments; process refunds; prevent fraud; reconcile transactions; comply with accounting obligations. Users are encouraged to consult Stripe's privacy notice for further information on Stripe's processing of payment data.

16Wise Payment Services

Where applicable, Condividiamo may use Wise to process international payments and financial settlements. In such cases, the Personal Data necessary to complete the transaction may be transmitted to Wise in accordance with applicable law. Such information may include: name; payment amount; destination country; payment reference; information necessary to comply with anti-money laundering and financial legislation.

Wise processes Personal Data independently, in accordance with its own privacy notice.

17Amazon Web Services (AWS)

Condividiamo hosts most of its production infrastructure using Amazon Web Services (AWS). AWS provides the cloud infrastructure supporting: application hosting; databases; storage; backup infrastructure; computing resources; network infrastructure; security services.

AWS acts as a data processor for the infrastructure services provided on behalf of Condividiamo. Condividiamo selects AWS because it provides internationally recognised security standards and technical measures designed to protect Personal Data. The Company regularly reviews its cloud infrastructure to ensure that appropriate security measures remain in place.

### 17.1 Security Measures Implemented on AWS

Depending on operational requirements, Condividiamo may implement security measures including encrypted communications; access control mechanisms; User authentication; network security controls; logging and monitoring; regular software updates; secure backup procedures; disaster recovery planning; business continuity measures. Access to production environments is restricted to authorised personnel whose access is necessary for the performance of their responsibilities.

18Domain Registration and DNS Services

Condividiamo uses GoDaddy exclusively for domain registration; DNS management; administration of internet domains. GoDaddy is not used to host customer databases or store application data. The Company's operational data is hosted separately using AWS infrastructure.

19Push Notification Services

Condividiamo sends push notifications through the Mamify and AiToro applications. The technical delivery of push notifications takes place through Firebase Cloud Messaging (FCM) for Android devices and Apple Push Notification Service (APNs) for Apple devices. These services are used exclusively to deliver notifications generated by Condividiamo. The content, scheduling and management of notifications remain under the control of Condividiamo.

### 19.1 Types of Notifications

Users may receive notifications relating to account security; cashback activity; purchases; service updates; appointments; webinars; customer support; operational communications. Marketing notifications are sent only where permitted by applicable law. Users may disable push notifications through their device settings at any time. Disabling may limit certain features of the Services.

20Geolocation Services

Certain features of the Services may use approximate geolocation data, where permission has been granted by the User. Geolocation may be processed for purposes such as improving the User experience; providing location-related features; preventing fraud; security; compliance with legal obligations where applicable.

Location information is collected only where necessary for the relevant feature. Condividiamo does not continuously monitor the location of Users, unless such functionality is expressly activated by the User. Users may revoke location permissions at any time through the settings of their mobile device. Revocation may affect the availability of certain features.

21Cookies and Similar Technologies

### 21.1 Use of Cookies

Condividiamo uses cookies and similar technologies to ensure the proper functioning, security and performance of its websites and digital services. Cookies are small text files stored on the User's device that allow the device to be recognised on subsequent visits. Cookies are used to improve the User experience, strengthen security and support the delivery of the services requested. Where required by applicable law, cookies that are not strictly necessary are used only with the User's prior consent. Further details are available in the Company's Cookie Policy.

### 21.2 Categories of Cookies

### Strictly Necessary Cookies

Essential for the operation of the Services. They enable functions such as User authentication; session management; security; fraud prevention; load balancing. These cookies cannot normally be disabled as they are necessary to provide the service requested.

### Functional Cookies

They store User preferences to improve the browsing experience, including language selection; display preferences; login preferences where permitted.

### Analytics Cookies

They may be used to understand how Users interact with the Services. Analytics information is used solely to improve usability; performance; stability; navigation. Where required by law, analytics cookies are activated only with the User's prior consent.

### Marketing Cookies

They may be used to provide Users with personalised communications and promotional content. Where required by applicable law, such cookies are used only with valid prior consent.

### 21.3 Cookie Management

Users may manage their cookie preferences through the cookie banner presented on the website; browser settings; device settings where applicable. Disabling certain cookies may affect the functionality of some Services.

22Marketing Communications

Condividiamo may send commercial or promotional communications relating to its products, services and activities. Such communications may concern Mamify services; AiToro services; cashback programmes; affiliate programmes; training events; webinars; platform updates; promotional campaigns; new services. Marketing communications are sent only where there is a lawful basis under Article 6 of the Gibraltar GDPR.

### 22.1 Consent-Based Marketing

Where consent is required, Condividiamo will obtain it from the User before sending marketing communications. Consent records are retained to demonstrate compliance with applicable law. Users may withdraw consent at any time. Withdrawal does not affect communications necessary for the performance of the contract or for compliance with legal obligations.

### 22.2 Legitimate Interest-Based Marketing

Where permitted by applicable law, Condividiamo may send communications relating to products or services similar to those previously requested by the User, relying on its legitimate interests. Users always have the right to object to such processing.

### 22.3 Opt-out

Every marketing email includes a mechanism enabling the User to unsubscribe. Users may also object to marketing communications by contacting Condividiamo through any channel described in this Privacy Policy. Opt-out requests are processed without undue delay.

23Automated Decision-Making and Profiling

Condividiamo does not use automated decision-making processes that produce legal effects concerning Users or similarly significantly affect them within the meaning of Article 22 of the Gibraltar GDPR.

Certain automated processes may be used for operational purposes, including fraud detection; security monitoring; technical diagnostics; optimisation of system performance; cashback calculation; notification management. Such processes support the operation of the Services but do not replace human decision-making where decisions with legal or similarly significant effects are involved.

Should Condividiamo introduce automated decision-making or profiling subject to Article 22 of the Gibraltar GDPR in the future, Users will be informed in advance and will receive all the information required by applicable law.

24International Data Transfers

Condividiamo may transfer Personal Data outside Gibraltar, the United Kingdom or the European Economic Area where necessary to provide its Services. Whenever an international transfer takes place, Condividiamo ensures that appropriate safeguards are in place in accordance with the Gibraltar GDPR.

Such safeguards may include adequacy decisions; Standard Contractual Clauses approved under applicable law; contractual commitments; recognised international transfer mechanisms; additional technical and organisational security measures where appropriate.

Before relying on service providers located outside Gibraltar or the United Kingdom, Condividiamo assesses whether the proposed transfer complies with applicable data protection legislation. Where required by law, Users may request further information on the safeguards applicable to international transfers.

25Data Retention

### 25.1 General Principle

Condividiamo retains Personal Data only for the period necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, to resolve disputes, to enforce contractual rights and to protect the Company's legitimate interests where permitted by law. At the end of the applicable retention period, Personal Data is securely deleted or irreversibly anonymised, unless continued retention is required by law.

### 25.2 Retention Periods

User account data

Until account closure and any applicable statutory retention period

Customer support records

Orders and transactions

As required by applicable accounting and tax legislation

Invoices

Cashback records

Affiliate programme records

Revenue sharing records

Security logs

Only for the period reasonably necessary to ensure the security of systems and to investigate incidents

Marketing preferences

Until consent is withdrawn or an objection to processing is raised

Consent records

For the period necessary to demonstrate compliance with applicable law

Geolocation data

Only for the period necessary to provide the relevant feature

Push notification preferences

Until disabled by the User or the account is closed

Where legal proceedings, investigations or regulatory obligations require a longer retention period, Personal Data may be retained for the period necessary to comply with such obligations.

26Security Measures

Condividiamo implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. Security measures include, where appropriate:

• encryption of data in transit via TLS/SSL;
• secure password hashing;
• role-based access control;
• principle of least privilege;
• authentication procedures for authorised personnel;
• network protection and firewalls;
• monitoring and logging of security events;
• regular software updates and patch management;
• backup and disaster recovery procedures;
• periodic review of security controls.

Access to Personal Data is restricted to authorised personnel who need such access to perform their duties. Condividiamo regularly reviews and updates its security measures to address technological developments and evolving risks.

27Exercise of Data Subject Rights

To the extent provided by the Gibraltar GDPR, Data Subjects may exercise the following rights: right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object to processing; right to withdraw consent where processing is based on it; rights relating to automated decisions where applicable. Condividiamo is committed to facilitating the effective exercise of such rights.

### 27.1 How to Submit a Request

The Data Subject may submit a request through any channel reasonably suited to identifying the request itself, including email; contact forms on the website; customer support; written correspondence; messaging services used by Condividiamo for communications with customers, including WhatsApp where applicable. Condividiamo will assess requests on the basis of their content and not solely on the basis of the channel used. Where necessary, Condividiamo may request additional information solely for the purpose of verifying the identity of the requester.

### 27.2 Response Times

Condividiamo will respond to requests without undue delay and, in any event, within the time limits established by the Gibraltar GDPR. Where an extension is permitted due to the complexity or number of requests, the User will be informed within the statutory time limit, together with the reasons for the extension.

28Erasure Requests

Upon receipt of a valid erasure request, Condividiamo will assess whether the conditions laid down in Article 17 of the Gibraltar GDPR are met. Where erasure is due, Condividiamo will take reasonable steps to erase the relevant Personal Data without undue delay.

Where certain Personal Data cannot be erased because retention is required by law or is necessary for the establishment, exercise or defence of a legal claim in judicial proceedings, such data will be retained solely for those purposes and access to it will be appropriately restricted. Condividiamo maintains internal procedures designed to identify and process erasure requests across the relevant operational systems.

29Complaints

If a User believes that their Personal Data has been processed in breach of applicable data protection legislation, they are invited to contact Condividiamo first so that the matter can be examined and, where possible, resolved.

Users also have the right to lodge a complaint with the Gibraltar Regulatory Authority, acting through the Information Commissioner, or with another competent supervisory authority where permitted by applicable law. Nothing in this Privacy Policy limits the rights granted to Data Subjects by the Gibraltar GDPR.

30Contact

For any questions regarding this Privacy Policy or the processing of Personal Data, Users may contact:

Gibraltar

Condividiamo will use reasonable endeavours to respond promptly and within the time limits established by the Gibraltar GDPR.

### Final Provision

This Privacy Policy supersedes any previous privacy notice relating to the Services covered by this document and applies from its effective date. Condividiamo may amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, technology or business operations. Where required by law, Users will be informed of material changes before they take effect.