ZED ROUND TABLE

Privacy Notice on the Processing of Personal Data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

The personal data you provide to us (including your identification and contact details, tax identification number and/or VAT number, bank details, where applicable, information concerning products purchased or in which you have expressed an interest, as well as data collected through the digital channels described in Section 4) are processed by RIFLESSI S.r.l. (hereinafter the “Data Controller” or the “Company”) in connection with the establishment and performance of a contractual relationship, your visit to one of our stores, your attendance at trade fairs and events, or your browsing of and submission of forms through the website and the related store-specific pages. Personal data are processed in accordance with the principles of fairness, lawfulness, transparency, data minimisation and storage limitation. Processing may be carried out in writing, in paper form and/or by electronic and telematic means, using procedures and systems designed to ensure the security, integrity and confidentiality of the data, through appropriate technical and organisational measures intended to prevent loss, unlawful or improper use and unauthorised access.

No automated decision-making process that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR is carried out in connection with the processing of your personal data.

1. Data Controller

The Data Controller is RIFLESSI S.r.l., with registered office at Via Nino Pace No. 58 – Z.I., 66026 Ortona (CH), Italy, VAT No. 01536130691. For any information concerning the processing of your personal data, the Data Controller may be contacted at privacy@riflessi.it. The Data Controller’s contact details are also available at www.riflessi.it/it/privacy .

2. Purposes of the processing and legal basis

Your personal data are processed by the Data Controller for the following purposes:

2.1 Contractual, accounting and statutory purposes (mandatory processing)

To respond to your requests, manage store appointments, enter into and perform purchase agreements, and comply with obligations arising under applicable laws, regulations, and accounting and tax legislation.

The legal basis for such processing is Article 6(1)(b) and (c) GDPR. The provision of personal data for these purposes is necessary; failure to provide such data will make it impossible to fulfil your request or establish or continue the contractual relationship. This processing does not require the data subject’s consent.

2.2 Direct marketing purposes (optional processing)

Subject to your specific and express consent, the identification and contact details you provide—including through website forms, requests for appointments at stores, attendance at trade fairs and events, or subscription to the newsletter—may be used by the Data Controller for direct marketing purposes. This includes sending commercial communications, newsletters, information on new products, promotions, offers and initiatives of the Company and its network of authorised dealers, including by automated means, via email, SMS, post or telephone.

The legal basis for such processing is Article 6(1)(a) GDPR. Consent is optional and may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal. Refusal or withdrawal of consent will result solely in your no longer receiving marketing communications.

Soft spam. Pursuant to Article 130(4) of Italian Legislative Decree No. 196/2003 (the Italian Data Protection Code), the email address you provide in connection with a purchase may be used by the Data Controller, without your consent, to offer products or services similar to those previously purchased, unless you object. You may object when your data are first collected or upon receipt of any subsequent communication by writing to privacy@riflessi.it or using the unsubscribe link included in each communication.

3. Recipients and categories of recipients of personal data

Your personal data will not be made publicly available and may be disclosed, solely to the extent strictly necessary to pursue the purposes described above, to the following recipients:

• personnel of the Data Controller authorised to process personal data for the purposes specified above, who have received appropriate instructions and training in data protection and use systems and tools designed to ensure data security;
• parties acting as independent data controllers where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims, such as public authorities, legal professionals, banks and insurance companies;
• parties acting as data processors pursuant to Article 28 GDPR, namely contractually authorised suppliers processing personal data on behalf of the Data Controller, including, by way of example, the provider of the CRM system and related server infrastructure, the provider of the newsletter distribution platform, providers of IT systems and hosting services, and companies providing accounting and administrative services;
• authorised dealers and agents within the Riflessi sales network, to whom your identification and contact details and the contents of your request may be transmitted, to the extent necessary to respond to your sales enquiry or manage your appointment at the relevant store. Authorised dealers act as independent data controllers in respect of the personal data they receive.

Transfers of personal data outside the EEA. Certain suppliers engaged by the Company to provide the services described above—including, by way of example, hosting and cloud infrastructure providers—may process personal data outside the European Economic Area. In such cases, personal data will be transferred in accordance with the safeguards set out in Chapter V GDPR, including European Commission adequacy decisions and Standard Contractual Clauses. Further information is available from the Data Controller upon request.

4. Methods and channels used to collect personal data

In accordance with the principle of transparency, the principal channels through which the Company collects your personal data are set out below:

• at Riflessi-branded stores, in connection with a purchase, a request for an appointment or the completion and signing of this form;
• through the website www.riflessi.it  and its pages dedicated to individual stores and appointment requests, as well as through newsletter subscriptions and any registration required to access restricted areas and download technical materials;
• at trade fairs and events attended by the Company, through direct collection by Riflessi personnel or by means of a paper consent form;
• through the Company’s CRM system, into which the data collected via the channels referred to above are entered and through which consent, the relevant retention period and any renewal of consent are managed.

Personal data collected through these channels are processed subject to the same safeguards and for the same purposes described in this Privacy Notice, irrespective of the channel through which they are obtained.

5. Retention period

Your personal data will be retained for no longer than is necessary to fulfil the purposes for which they were collected, taking into account applicable statutory obligations and the need to protect the Data Controller’s rights. In particular:

• personal data processed for contractual, accounting and tax purposes will be retained for the period prescribed by the applicable legislation—generally ten years following termination of the relationship—without prejudice to any different retention periods required by law;
• personal data processed for direct marketing purposes will be retained until consent is withdrawn and, where consent is not withdrawn, for no longer than 36 months from the date on which the data were collected or consent was last renewed. Upon expiry of this period, the Company will ask you to renew your consent; if consent is not renewed, the data will be anonymised or deleted.

Upon expiry of the periods specified above, personal data will be deleted or permanently anonymised, without prejudice to their retention in aggregated or anonymous form for statistical purposes.

6. Data subject rights

As a data subject, you have the right, pursuant to Articles 15–22 GDPR, to request from the Data Controller at any time:

• access to your personal data;
• rectification or completion of inaccurate or incomplete data;
• erasure of your personal data, where the conditions prescribed by law are met;
• restriction of processing;
• objection to processing, particularly for marketing purposes;
• portability of data processed by automated means on the basis of consent or a contract.

Requests for erasure remain subject to the Company’s statutory and document-retention obligations. To exercise your rights, you may contact the Data Controller at privacy@riflessi.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it  if you believe that your personal data are being processed in breach of applicable data protection legislation.

7. Amendments to this Privacy Notice

This Privacy Notice may be amended or updated, including as a result of changes in applicable legislation or the Company’s organisational arrangements. The latest version will always be available at Riflessi stores and at www.riflessi.it/it/privacy .

Rev. 1 dated 10 September 2026 – Document prepared in accordance with Regulation (EU) 2016/679.