Information on the processing of personal data of users

With this information on the processing of personal data, provided pursuant to Article 13 of Regulation (EU) 2016/679 (the "Regulation"), SiamoSoci S.r.l, with registered office in Milan, Via Timavo, n. 34, P. IVA 07464370969 ("Mamacrowd"), as data controller, intends to explain to you the purposes and methods by which it collects and processes your personal data, what categories of data are processed, what rights you are granted as a data subject and how they can be exercised.

The information is provided exclusively for this website and the Mamacrowd mobile app (jointly, the "Portal"), so Mamacrowd assumes no responsibility for other websites or apps that may be consulted through hyperlinks on the Portal.

Users, by using the Portal, accept this policy and are, therefore, encouraged to read it before providing personal information of any kind.

1. Special provisions for newsletters and pushnotifications

The data you provide when subscribing to the newsletter will be used by Mamacrowd in order to send you advertising material and/or commercial communications. This data will be processed in order to execute the newsletter service you have requested, pursuant to Art. 6(1)(b) of the Regulations.

You may at any time request to unsubscribe from the newsletter by following the instructions from time to time indicated in each communication made for the purposes referred to in this point.

Even if you decide not to subscribe to the Portal, Mamacrowd may - with your consent - process certain browsing data (such as IP address, platform access time, server access methods, numeric code indicating the status of the response given by the server) to send you commercial communications through push notifications on your cell phone.

The consent given is revocable at any time by writing to privacy@mamacrowd.com or by disabling on your device the receipt of push notifications from the Mamacrowd app.

2. Categories of personal data

Mamacrowd may acquire and process the following types of personal data:

• personal data, such as first and last name, place and date of birth, social security number, gender and residential address
• contact data, such as shipping address, telephone number and e-mail address
• banking data, such as IBAN or BIC Code, in the case of a foreign account;
• financial data, such as qualified investor status, if any; data related to knowledge and experience in investing in financial instruments and equity crowdfunding portals; and frequency and amount of transactions;
• data related to education level and current and last twelve months' professional experience;
• browsing data, such as IP address, time of access to the site and/or registration to the platform, methods of access to the server, numeric code indicating the status of the response given by the server (successful, error, etc.).

In the event that you choose to subscribe to the Platform by linking your profile on social networks such as Facebook, Google and Linkedin ("Social Channels"), the Data Controller may acquire - subject to your authorization - certain categories of data (including first name, last name, e-mail address and photographic portrait) directly from the manager of the Social Channel you have chosen.

Through the Portal, the Owner will not acquire data of a sensitive nature or otherwise belonging to the special categories referred to in Article 9 of the Regulations or data relating to criminal convictions or offenses.

3. Purpose and legal basis of the processing

Mamacrowd will use your Data for the following purposes:

3.1 Contract execution

The data indicated in paragraph 2, nos. 1-3, will be processed by Mamacrowd in order to enable you to register with the Portal and benefit from its related services, including:

1. the capital raising service governed by Consob Resolution No. 18592/2013;
2. the fundraising service to support projects with a social or cultural purpose;
3. the administration of webinars.

These personal data are, therefore, processed to execute the contract, pursuant to Art. 6(1)(b) of the Regulations, and to fulfill legal obligations of an accounting and tax nature, pursuant to Art. 6(1)(c) of the Regulations.

The provision of data is necessary to enable the establishment and management of the contractual relationship; failing this, it will not be possible for us to execute the contract and provide you with the requested service.

3.2 Verification of adequacy

With reference to the capital raising service, Mamacrowd may process the personal data referred to in paragraph 2, nos. 1, 2, 4 and 5 in order to verify your level of experience and knowledge regarding investments in financial instruments.

This personal data is processed for the purpose of fulfilling legal obligations regarding the raising of capital through online portals, pursuant to Article 6(1)(c) of the Regulations.

The provision of data is necessary; failing this, it will not be possible for us to execute the contract and provide you with the requested service.

3.3 Disclosure to the custodian bank, bidder or promoter

With respect to the capital raising service, Mamacrowd may disclose the data indicated in paragraph 2, nos. 1-4, to the entity that receives and perfects orders pursuant to the current regulations on capital raising through online portals (the "Depository Bank"). Such processing is based, pursuant to Article 6(1)(c), on the fulfillment of the obligation set forth in Article 17 of Consob Resolution No. 18592/2013.

Mamacrowd may also disclose the personal data indicated in paragraph 2, nos. 1-2, to the company to which the financial instruments you have subscribed refer (the "Offeror") or to the entity that promoted the fundraising campaign to which you have subscribed (the "Promoter"). This communication is made in order to execute the contract, based on Article 6(1)(b) of the Regulations.

The Depositary Bank, the Offeror and/or the Promoter will process the data received from Mamacrowd as autonomous data controllers in accordance with the provisions of their respective privacy policies.

3.4 Sending of commercial communications

Where provided for on the Portal and subject to your specific consent, Mamacrowd may process the personal data referred to in paragraph 2, nos. 1 and 2 to send you, also on behalf of third parties, advertising material or commercial communications relating to any promotions or to process market research.

Such communications may be sent through the use of automated systems (e.g., e-mail, SMS, app notifications) and traditional systems (e.g., paper mail, operator phone calls).

The consent given is revocable at any time, even with reference to automated contact systems only, by writing to privacy@mamacrowd.com.

The data referred to in paragraph 2, nos. 1 and 2, acquired in the context of the provision of Mamacrowd's services through the Portal may be used, even without your prior consent, to send you commercial communications relating to services similar to those covered by the provision, pursuant to Article 130 of Legislative Decree no. 196 of June 30, 2003 (c.d. "Soft spam").

You may, however, object to such processing at any time by following the instructions from time to time indicated in any communication made for that purpose or by writing to privacy@mamacrowd.com.

4. Method of processing

Your personal data will be processed using manual, computerized and telematic tools, as well as on paper. The personal data you provide will not be subject to automated decision-making processes

5. Period of data retention and duration of processing

Your personal data will be processed for the period necessary to offer you the requested services and in any case until the termination of your contractual relationship with Mamacrowd and the final deletion of your account from the Portal.

Your data related to the contract concluded with Mamacrowd will also be kept for a period corresponding to the ordinary limitation period of rights (i.e. 10 years) exclusively for the fulfillment of legal obligations and for needs related to the possible protection of Mamacrowd's rights.

With reference to data processed for the purpose of appropriateness verification, we inform you that such data will be processed for a maximum period of 5 years. After this period or in case of opposition, the data will be kept if necessary to pursue other purposes or will be permanently deleted.

With reference to processing for marketing purposes, we inform you that the data will be processed for the entire duration of the contract unless the consent you have given is revoked. In case of Soft spam, your personal data will be processed until you exercise your right to object to the processing

6. Categories of recipients

In addition to the subjects indicated in paragraph 3.4 above, the personal data referred to in paragraph 1 above may be disclosed to third parties that Mamacrowd uses to perform certain processing operations. Such parties will be designated as Data Processors pursuant to Article 28 of the Regulations and will receive adequate operational instructions, with particular reference to the adoption of appropriate security measures, in order to be able to guarantee the confidentiality and security of the data.

A list of such data processors can be requested from Mamacrowd by data subjects by writing to privacy@mamacrowd.com.

No form of dissemination of your data to further and unspecified parties is envisaged.

7. Defense in court

Your personal data may be used for defense by Mamacrowd in court or in the preparatory stages of its possible establishment.

8. Cookies

To make navigation easier and more intuitive, Mamacrowd uses cookie technology. Please refer to the Cookie Policy for more information.

9. User Rights

We inform you that, in accordance with current regulations, you have the following rights:

• to request and obtain information about the existence of your own data in the availability of Mamacrowd and access to such data;
• for data subject to processing by automated systems, request the transfer to another owner;
• request and obtain the modification and/or correction of your personal data if you believe that they are inaccurate or incomplete;
• revoke the consents previously given by you in accordance with the preceding paragraphs, without prejudice to the legitimacy of the processing carried out by Mamacrowd before its a revocation;

Such requests may be transmitted to Mamacrowd by writing to privacy@mamacrowd.com or by registered mail with return receipt addressed to SiamoSoci s.r.l., via Timavo, n. 34 - 20124 Milano (MI).

We also inform you that in accordance with the regulations in force, you may propose any complaints regarding the processing of your personal data to the Guarantor for the Protection of Personal Data.

10. Deletion of personal data

We inform you that, in accordance with the regulations in force, you have the right to request and obtain the cancellation - and/or limitation of the processing - of your personal data if it is not necessary - or no longer necessary - for the above purposes and in the other cases provided for by law.

This request can be transmitted to Mamacrowd by writing to privacy@mamacrowd.com or by registered mail with return receipt addressed to SiamoSoci s.r.l., via Timavo, n. 34 - 20124 Milano (MI).

11. Changes

Mamacrowd reserves the right to modify or simply update the content of this Privacy Policy, in whole or in part. Mamacrowd will inform registered users of such changes as soon as they are introduced.