Happio Shopping Center

POLICY ON THE PROCESSING OF PERSONAL DATA

Forum Real Estate Management S.r.l., with registered office in Milan, via Manzoni, 30, tax code and VAT no. 08580210964 (hereinafter, “FREM” or the “Data Controller”) may come into possession of the personal data of persons who voluntarily leave their contact details by filling in the appropriate form on the website www.frem.it (hereinafter, the “Website”).

Giving that:

1. “processing” is defined as any operation, including the mere collection and/or storage, of personal data of any natural person (hereinafter, “Data Subject”),
2. “data controller” is defined as the one who determines the purposes and means of the processing, and
3. “personal data” is defined as any information relating to an identified or identifiable natural person by reference to any other information,

the personal data processed are those spontaneously submitted to FREM by Data Subjects, through the use of the dedicated section on the Site, i.e. name, surname, e-mail address and telephone number (hereinafter, the “Personal Data”).

This notice is provided to the Data Subject before he or she submits his or her Personal Data, by means of publication at the bottom of the contact form on the Site; the Site requires that he or she read it before being able to submit his or her Personal Data.

1. Data Controller

The Data Controller is Forum Real Estate Management S.r.l., with registered office in Milan, via Manzoni, 30, tax code and VAT number 08580210964 – e-mail info@frem.it.

You may contact the Data Controller free of charge by writing to the e-mail address info@frem.it, or by sending a registered letter with acknowledgement of receipt to the registered office, as identified above.

The Data Protection Officer appointed by the Data Controller is Mr. Francesco Conti, with an office in Milan, at Via Bigli, 28. You can contact the Data Protection Officer free of charge via telephone number +39 02 8342 0630, via e-mail (f.conti@conti.legal) or via certified e-mail (francesco.conti@milano.pecavvocati.it).

2. Purpose of processing

The data will be used for the following purposes:

• customer care and satisfaction by promptly responding to requests received from the public;
• performance of obligations set by law, regulation or EU legislation;
• carrying out administrative activities;
• exercise company’s rights in court;
• compliance with specific requests by judicial and/or public security authorities.

3. Nature of data provision

Since this is a spontaneous and unsolicited request of the Data Subject, the provision of Personal Data is optional for the purposes set out in points 2.a) to 2.e) above. However, as it is strictly functional to the performance of the service requested by the Data Subject to the Data Controller, i.e receiving the information requested through the form, the non-conferment of Personal Data will make it impossible for the Data Controller to provide the requested service.

Similarly, any request for deletion of the data means that the Controller cannot keep fulfilling the requested services.

4. Categories of persons to whom data may be disclosed

Personal data will be accessible to judicial authorities in the event of a specific request. Where necessary or required by laws, regulations, EU legislation, rulings by judges, arbitrators or public authorities, as well as for the performance of contractual obligations (e.g. Public Bodies, Control Authorities, Banking Institutions, etc.), Personal Data may be transmitted to the subjects to whom the communication is addressed. The data will not be subject to further dissemination.

5. Treatment modalities

FREM will carry out operations of collection, recording, storage and archiving of Personal Data by means of manual, computerized and telematic tools with logics strictly related to the purposes and, in any case, in such a way as to ensure the security and confidentiality of the collected data.

The security of the data and their transmission is guaranteed by adequate protection systems such as antivirus, anti-ramsonware, firewalls and access passwords, and by physical impediment measures to select and prevent access to the premises where they are stored

6. Legal basis for processing

The legal basis for the processing referred to in point 2. above is:

• the performance of a service requested by the data subject, resulting from spontaneous and unsolicited contact by the data subject;
• the legitimate interest of the Data Controller, identified in the customers care and the maintenance of its reputation, by promptly responding to requests received from the public.

7. Data retention periods

The processing of Personal Data shall last no longer than necessary for the performance of FREM’s obligations arising from the requested services, with reference to the purposes set out in point 2 above.

A further retention period required by law to comply with civil, tax and fiscal obligations in force will be added. At the end of the processing data retention period, Personal Data will be deleted, i.e permanently anonymized.

8. Rights of the Data Subject

The rights of the Data Subject who contacts the Data Controller through the special form on the Site, thus conferring his or her Personal Data, include the following:

• request from the Data Controller access to their Personal Data and to information relating thereto; rectification of inaccurate data or integration of incomplete data; deletion of Personal Data concerning him/her (upon the occurrence of one of the conditions set out in Article 17(1) of the Regulation and in accordance with the exceptions provided for in paragraph 3 of the same Article); limitation of the processing of the personal data conferred (upon the occurrence of none of the cases set out in Article 18(1) of the GDPR);
• request and obtain from the Data Controller – in cases where the legal basis of the processing is a contract or consent, and the processing is carried out by automated means – the Personal Data provided in a structured and machine-readable format, also for the purpose of communicating such data to another data controller (so-called right to data portability);
• object at any time to the processing of the Personal Data provided in the event of special situations concerning the user;
• file a complaint with a supervisory authority (“Autorità Garante per la protezione dei dati personali” – it).

The Data Subject may exercise his/her rights free of charge at any time by contacting the Data

Controller at the e-mail address info@frem.it.

9. Policy updates

This Policy is subject to occasional revision. If any changes are made to the processing, the Data Controller will notify the Data Subject accordingly. Where required by applicable law, the Data

Subject shall be entitled to give FREM consent to any new processing. In the event of refusal, the Personal Data of the Data Subject will not be processed in accordance with the changes contemplated in this notice.

10. Transfer abroad

The Personal Data of the Data Subject will not be transferred to non-EU countries.

Milan, November 2022

Forum Real Estate Management S.r.l.