Information on the processing of personal data

With this information on the processing of personal data, provided pursuant to Article 13 of Regulation (EU) 2016/679 (the "GDPR Regulation"), Mamacrowd S.r.l, with registered office in Milan, Via Timavo, n. 34, P. IVA 07464370969 ("Mamacrowd"), as the data controller, intends to explain to you the purposes and methods by which it collects and processes your personal data, what categories of data are processed, what rights you are granted as a data subject and how they can be exercised.

The information is provided solely for this website (the "Platform"), so Mamacrowd assumes no responsibility for other websites or apps that may be consulted through hyperlinks on the Platform.

Users, by using the Platform, accept this policy and are, therefore, encouraged to read it before providing personal information of any kind.

1. DEFINITIONS

In order to enable easy reading of this policy we give below some recurring definitions:

• Data Controller: Mamacrowd;
• Data Subjects: collectively, Users, Project Holders or the SPV and Investors;
• Project Holder: a legal entity that intends to fund its own project through the Platform;
• Contact Person of the Project Holder: the natural person, with the necessary powers, who acts on behalf of the Project Holder;
• SPV: the legal person who conducts a crowdfunding bid on the Platform for financing a project of a Project Holder;
• Investor: a natural or legal person who acts as an investor by making investments through the Platform;
• User: a person interested in Mamacrowd's services in a generic way and who registers on the Platform through the registration form made available by Mamacrowd

Please also note that Mamacrowd has provided for the appointment of a Data Protection Officer (DPO) to whom data subjects may contact for all matters relating to the processing of their personal data and the exercise of their rights under the Regulation in question: (insert name and email address of DPO)

2. WHO THE DATA SUBJECTS ARE

This notice is addressed to all Users who decide to register on the Platform through the registration form made available at the following link Register | Mamacrowd.

Thereafter, Users may decide whether to continue following Mamacrowd projects as General Users, receiving information and periodic newsletters, or to become Project Owners or Investors.

In this case, the personal data required from each category of affected users will be different in type and purpose of processing.

3. HOW REGISTRATION TAKES PLACE

Through the above link, the User registers by entering his/her first name, last name and contact information (email address and phone number).

In the event that the User chooses to register to the Platform by linking his/her profile on social networks - such as Facebook, Google and Linkedin ("Social Channels") -, the Data Controller may acquire certain categories of data (including first name, last name, email address and photo portrait) directly from the operator of the Social Channel chosen by the User.

In order to finish registration, it will be necessary to give or not give the required consents for certain purposes that are outside the contractual, pre-contractual or legitimate interest obligations of the Data Controller.

Before giving the required consent, it is necessary to read this notice.

Through the Platform, the Data Controller will not acquire data of a sensitive nature or otherwise belonging to the special categories referred to in Article 9 of the GDPR Regulations or data relating to criminal convictions or offenses.

3.1. CATEGORIES OF PERSONAL DATA AND PURPOSES

A further processing carried out by the Data Controller concerns only the personal and contact data entered during registration through the Platform, which may be used, even without your prior consent, to send commercial communications relating to services similar to those that are the subject of your interest, pursuant to Article 130 of Legislative Decree No. 196 of June 30, 2003 (so-called "Soft spam").

4. CONFERMENT OF PERSONAL DATA

Please note that with reference to the purposes set out in the table in the previous paragraph, the conferment is necessary to allow the establishment and management of the contractual relationship; failing this, it will not be possible for us to execute the contract and provide you with the requested service.

Differently is the case for the consents required to terminate the registration. These consents are voluntary in nature and even once given may be revoked at any time by following the procedures indicated in the communications received or by writing to our contact address privacy@mamacrowd.com, also with reference to automated contact systems only.

Such consents concern, for example, the sending of the newsletter or the sending of commercial communications that the Controller may send you, also on behalf of third parties, advertising material or commercial communications relating to possible promotions or to process market research.

The sending of such communications may take place through the use of automated systems (e.g., e-mail, SMS) and traditional systems (e.g., paper mail, telephone calls with operator).

You may, however, object to such processing at any time by following the instructions from time to time indicated in each communication made for that purpose or by writing to privacy@mamacrowd.com.

5. METHODS OF PROCESSING

The processing is carried out by means of the operations or set of operations indicated such as collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, blocking, communication, cancellation and destruction of data.

The data will be processed in written form and/or on magnetic, electronic or telematic support, even when the data are communicated to the subjects indicated in this statement, who in turn are committed to process them using only methods and procedures strictly necessary for the specific purposes referred to in paragraph 3. The processing is carried out by appointees and collaborators within the scope of their respective functions and in accordance with the instructions received, always and only for the achievement of the specific purposes while scrupulously complying with the principles of confidentiality and security required by the aforementioned law.

6. COMMUNICATION OF DATA

Without prejudice to the communications made in compliance with legal obligations, the data may be communicated, exclusively for the purposes indicated in paragraph 3.1, only and exclusively to the following categories of collaborators or external parties:

1. Public and private entities, associated or subsidiary companies;
2. Banking institutions;
3. Self-employed collaborators of our company;
4. Professionals and consultants;
5. Anyone who is a legitimate recipient of communication for the above-mentioned purposes mentioned in Section 3.1.

Personal data are in no way subject to dissemination.

With reference to the crowdfunding service, Mamacrowd may disclose the data indicated in section 3.1 as "Investor", to the entity that receives and perfects orders pursuant to the current regulations on crowdfunding services (the "Depository Bank"). Such processing is based, pursuant to Article 6(1)(c), on the fulfillment of the obligation set forth in Article 10(5) of EU Regulation 2020/1503.

Mamacrowd may also disclose the personal data referred to in Section 3.1 as "Investor", to the company to which the financial instruments that the investor has subscribed refer or to the Project Owner whose project is financed through the SPV. This disclosure is made in order to execute the contract, based on Article 6(1)(b) of the GDPR.

The Custodian Bank, the Project Owner and/or the SPV will process the data received from Mamacrowd as autonomous data controllers in accordance with the provisions of their respective privacy policies.

You may, however, object to such processing at any time by following the instructions from time to time indicated in any communication made for this purpose or by writing to privacy@mamacrowd.com.

In addition to the subjects indicated, personal data may be communicated to third parties that Mamacrowd uses to carry out certain processing operations. These parties will be designated as Data Processors pursuant to Article 28 of the GDPR Regulations and will receive appropriate operational instructions, with particular reference to the adoption of appropriate security measures, in order to be able to guarantee the confidentiality and security of the data.

A list of such data processors can be requested from Mamacrowd by data subjects by writing to privacy@mamacrowd.com.

No form of dissemination of your data to additional and unspecified parties is envisaged.

7. DATA RETENTION PERIOD AND DURATION OF PROCESSING

Your personal data will be processed for the period necessary to offer you the requested services and in any case until the termination of your contractual relationship with Mamacrowd and the final deletion of your account from the Platform.

Your data related to the contract concluded with Mamacrowd as an "Investor" will also be kept for a period corresponding to the ordinary limitation period of rights (i.e. 10 years) exclusively for the fulfillment of legal obligations and for needs related to the possible protection of the rights of the Data Controller.

With reference to data processed for customer verification purposes, we inform you that such data will be processed for a maximum period of 5 years. Once this period has elapsed, the data will be retained if necessary to pursue other purposes or will be permanently deleted.

With reference to processing for marketing purposes, we inform you that the data will be processed for the entire duration of the contract unless the consent you have given is revoked. In the case of Soft spam, your personal data will be processed until you exercise your right to object to the processing.

The data provided as Project Owner and Project Owner's Contact Person will be processed by the Data Controller, should the application be successful, for the duration of the negotiations and the contract to be subsequently concluded. Upon expiration of the contract, the data will be retained in encrypted form for the next 10 years for compliance with legal obligations or for the protection needs of the Data Controller.

Should the application be unsuccessful, your personal data will be retained by Mamacrowd, where not needed for other purposes, for the 5 years following the application.

8. USERS' RIGHTS

We would like to inform you that, in accordance with Articles 15 to 22 of the GDPR Regulations, you may exercise your rights at any time in the manner set out below.

You will have the right to

• request and obtain information about the existence of your own data in the availability of Mamacrowd and access to such data;
• for data subject to processing by automated systems, request transfer to another data controller;
• request and obtain the modification and/or correction of your personal data if you believe that they are inaccurate or incomplete;
• revoke the consents previously given by you in accordance with the preceding paragraphs, without prejudice to the legitimacy of the processing carried out by Mamacrowd before its a revocation;
• right to request the deletion and/or restriction of the processing of your personal data

Such requests may be transmitted to Mamacrowd by writing to privacy@mamacrowd.com or by registered mail with return receipt addressed to Mamacrowd s.r.l., via Timavo, n. 34 - 20124 Milano (MI) or you can contact the Data Protection Officer (DPO) at the following address: dpo@mamacrowd.com

We also inform you that in accordance with the regulations in force, you may propose any complaints regarding the processing of your personal data to the Italian Supervisory Authority - Garante per la protezione dei dati personali - Piazza Venezia, 11, IT - 00187, Roma (www.garanteprivacy.it).

9. TRANSFER OF DATA ABROAD

Personal data are not transferred abroad except for the use of cloud storage systems, if provided in the services, with the management and security rules provided by the provider.

Should it become necessary for the company to transfer data to third countries for other management reasons, this will be done only with the consent of the data subject and after verification of the presence of an adequacy decision by the Commission or under standard contractual clauses as provided by the GDPR Regulation in Art. 46.

10. CHANGES

Mamacrowd reserves the right to modify or simply update the content of this Privacy Policy, in whole or in part. Mamacrowd will inform Data Subjects of such changes as soon as they are introduced.