PRIVACY

Dear Customer,

In this document, in compliance with data protection and privacy regulations in the electronic communications sector, Banca Sistema S.p.A. helps you understand what data is collected while you browse the web and how it is used. The guidelines provided below are based on Recommendation No. 2/2001, which the European data protection authorities—meeting within the Working Party established by Article 29 of Directive No. 95/46/EC—adopted on May 17, 2001, to identify certain minimum requirements for the online collection of personal data, and, in particular, the methods, the timing, and the nature of the information that data controllers must provide to Users when they access web pages, regardless of the purpose of the visit.

Banca Sistema S.p.A., with registered office in Milan, Largo Augusto 1/A, at the corner of Via Verziere 13 – 20122 Milan (“Banca Sistema”).

The Data Protection Officer (DPO) can be contacted at:

• Banca Sistema S.p.A.’s mailing address: Largo Augusto 1/A, at the corner of Via Verziere 13, 20122 Milan
• Email address: privacy@bancasistema.it

Browsing Data

The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters related to the user’s operating system and computing environment. This data is used solely to obtain statistical information on the use of the website and to verify its proper functioning.

Data Provided Voluntarily by the User

The optional, explicit, and voluntary sending of e-mails to the addresses listed on this site entails the subsequent collection of the sender’s address—which is necessary to respond to requests—and any other personal data included in the message. Specific summary privacy notices may be progressively provided or displayed on the pages of the site dedicated to particular on-demand services.

Data processing is carried out using manual, computerized, and telematic tools, with logic strictly related to the purposes for which the data was collected. Specific security measures are observed to prevent data loss, unlawful or improper use, and unauthorized access.

This processing takes place only to the extent that you have provided your optional consent. You have the right to request at any time that those using such solutions delete the information collected via cookies.

You may, at any time, exercise the rights set forth in Articles 15 through 23 of the GDPR by contacting:

Banca Sistema S.p.A.

Largo Augusto 1/A, at the corner of Via Verziere 13 – 20122 Milan

Email address: compliance&antiriciclaggio@bancasistema.it

DPO email: privacy@bancasistema.it

Exercising the rights outlined in this section is not subject to any formal requirements and is free of charge. The Data Controller is required to provide information regarding the action taken by the data subject without undue delay, and no later than one month from the receipt of the request. Extensions are permitted pursuant to Article 12, paragraph 3, of the EU Regulation.

With regard to the processing described in this privacy notice, you may exercise the following rights:

• right of access;

• the right to rectification, anonymization, or erasure of data;

• the right to withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent prior to withdrawal;

• the right to restriction of processing;

• the right to data portability;

• right to object;

• the right to object to direct marketing;

• the right to file a complaint with the Data Protection Authority if the data subject believes that their rights have not been respected.

Any corrections, deletions, or restrictions on processing carried out at the request of the data subject—unless this proves impossible or involves a disproportionate effort—will be communicated by the Data Controller to each of the recipients to whom the personal data has been disclosed.

The data collected may be transferred or disclosed to other subsidiaries or affiliates of the Bank for activities strictly related to and necessary for the operation of the service, such as the management of the IT system, or for processing carried out by other companies in the group for the same purposes. Personal data provided by users who request informational materials (brochures, informational materials, etc.) are used solely for the purpose of providing the requested service and are disclosed to third parties only if necessary for that purpose (companies providing enveloping, labeling, and shipping services). Apart from these cases, the data will not be disclosed or provided to anyone, unless required by contract or authorized by the data subjects. In this regard, personal data may be transmitted to third parties, but only and exclusively if:

• there is explicit consent to share the data with third parties;
• there is a need to share the information with third parties in order to provide the requested service;
• this is necessary to comply with requests from judicial authorities or public security agencies.

No data derived from the web service is disclosed.