PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This Privacy Notice (the “ Notice ”) describes the features of the processing of your personal data collected through the website santandreatopproperties.com (the “Website”) of Gabetti Property Solutions Agency S.p.A.

This Notice does not apply to third -party websites, applications , or content , even if accessible from the Website. In such cases , third -party privacy policies may apply and may differ from this one. We recommend you review them before providing any data.

1. DATA CONTROLLER AND DATA PROCESSORS

Gabetti Property Solutions Agency S.p.A., with registered office in Milan, Via Bernardo Quaranta 40, VAT no. 00815040159, as the data controller (the “Controller”), pursuant to Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree no. 196 of June 30, 2003 as amended (the “Privacy Code”), informs you that the applicable legislation protects individuals with regard to the processing of personal data. Such processing will be based on principles of fairness , lawfulness , transparency , and the protection of your privacy and rights .

For the processing of data collected through the Website, the following company has been appointed as data processor , pursuant to Article 28 GDPR (the “Processor”):

Pipe Grep S.r.l., with registered office in Rome, via Monti Tiburtini 530, registered in the Business Register of Rome, Tax Code and VAT no. 13211701001, represented by its legal representative pro tempore.

The Processor handles data on behalf of the Controller based on and in accordance with the specific mandate received .

The Controller may appoint additional processors. For information on all data processors and/or further information, you can contact the company at the following address : Via Bernardo Quaranta, 40, 20139 Milano (MI) .

Your personal data will be processed in accordance with the aforementioned laws and related confidentiality obligations .

2. DATA COLLECTED

The Controller collects personal data through the Website when users register to use services or send requests through the forms or via email .

“Personal data” refers to any information that may be used to identify a data subject , directly or indirectly .

Certain personal data may also be collected automatically when you access, use, or interact with the Website.

Data you provide through the Website This includes data:

provided via registration fields when creating an account;

voluntarily shared through messages or contact forms on the Website.

Such data may include name, surname , email address , telephone number , and any other personal information you choose to share.

Data automatically collected The Website uses cookies and similar technologies (“Cookies”) to collect and store usage , access, or interaction data. This may include:

type of device used ;

operating system;

IP address ;

general geographic location;

browser type ;

content viewed or interacted with;

keywords entered .

For more details on cookies, please click here . [NOTE: INSERT LINK TO COOKIE POLICY]

3. PURPOSES AND LEGAL BASIS FOR PROCESSING

Your personal data will be processed for the following purposes : [NOTE: VERIFY AND ADAPT THESE PURPOSES AS NEEDED]

a) To allow you to register on the Website and maintain your user account; b) To respond to your information requests sent via contact forms or email; c) To execute a contractual mandate and comply with related legal obligations ; d) To send marketing, promotional , or advertising communications by post, phone, SMS, email, instant messaging from the Controller and/or related companies; e) To share your data with group companies for marketing communications related to their services/products; f) For the legitimate interests of the Controller (e.g., to exercise the right of defense).

The legal basis for purposes a) and c) is the execution of contractual or pre-contractual measures .

For purpose b) , the basis is the Controller's legitimate interest , balanced against your reasonable expectations .

For purposes d) and e) , the legal basis is your consent .

Providing data for a), b), and c) is necessary ; refusal would prevent us from fulfilling your requests . Providing consent for d) and e) is optional and may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal .

4. DATA DISCLOSURE

Your data may be processed by authorized staff and third parties strictly necessary for the above purposes .

These third parties may act as autonomous controllers or duly appointed processors. A full list of processors is available upon request from the Controller.

5. DATA PROCESSING METHODS

Your data will be processed by staff and collaborators of the Controller or external parties ( such as the Processor) using automated or electronic tools in compliance with GDPR Articles 6 and 32 and using appropriate security measures .

Data will be stored on servers or archives located within the European Union.

6. DATA DISCLOSURE TO THE PUBLIC

Your personal data will not be publicly disclosed .

7. DATA RETENTION

According to GDPR Article 5 and data minimization principles , your data will be retained :

for the duration of your account registration and use;

for the time necessary to respond to your requests ;

in line with legal retention periods (e.g., for tax or anti-money laundering purposes );

for the time necessary to protect the Controller’s legal interests .

8. DATA SUBJECT RIGHTS AND CONTACTS

Under GDPR, you have the right to:

Access your data (Art. 15);

Rectify inaccurate data (Art. 16);

Erase data under certain circumstances (Art. 17);

Restrict processing where legally applicable (Art. 18);

Be informed of rectifications or deletions (Art. 19);

Data portability (Art. 20);

Object to processing (Art. 21);

Not be subject to automated decisions , including profiling (Art. 22).

You may exercise these rights at any time by contacting :

The Controller at Gabetti Property Solutions Agency S.p.A.

The Processor at : Gabetti Property Solutions Agency S.p.A.

Additionally , under Article 77 GDPR, you may file a complaint with the Italian Data Protection Authority (Garante) : Piazza di Monte Citorio 121, 00186 Rome – Email : urp@gpdp.it