Cookies

This application, (hereinafter, the 'App') is owned by the company Fyne S.R.L., with registered office in Via Berardi 8, Taranto 74123, VAT number 03273410732 (hereinafter, 'We' or the 'Company').

As Cookie-like technologies (hereinafter referred to as "Identifiers") are used on our App for different purposes, we would like to explain with this notice what they are and how they are used on the App.

In this notice, pursuant to Article 13 of the EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, "Regulation"), we explain how we and third parties on the App collect data via Identifiers, for what purposes and what your rights are.

The Company takes the right to privacy and protection of personal data of its Users very seriously. For any information regarding this Cookie Policy, Users may contact the Company at any time, using the following methods:

- By sending a registered letter with return receipt to the Controller's registered office at Via Berardi 8, Taranto 74123;

- By sending an e-mail to: privacy@fyne.it

The Data Controller has not identified the figure of the Data Protection Officer (DPO), since it is not subject to the designation obligation provided for in Article 37 of the Regulation.

A. What are Identifiers and what are they used for

A.1. What are Cookies?

Cookies are small text files that sites visited by the user send directly to his/her terminal (usually to the browser), where they are stored and then transmitted to the same sites the next time the same user visits (so-called first-party cookies). While browsing a site, the user may also receive cookies from different sites or web servers on his terminal (so-called third-party cookies); this happens because on the website visited there may be elements such as, for example, images, maps, sounds, specific links to web pages of other domains residing on servers other than the one on which the requested page is located. In other words, they are those cookies that are set by a website other than the one you are currently visiting.

Cookies may have a lifetime limited to a single browser session (session cookies), in which case they are automatically deactivated when the user closes the browser; or they may have a predetermined expiration date, in which case they will remain stored and active in your browser until that expiration date, continuing to collect information over the course of different browser sessions (persistent cookies).

Cookies are used for different functions. Some are necessary to enable you to browse a site and use its features (technical cookies). Some technical cookies are necessary to provide you with an optimal browsing experience or to allow you to authenticate yourself, for example to make a purchase or enter your private area (so-called navigation cookies). Browsing cookies are normally session cookies and are therefore automatically deactivated once you close your browser.

Other technical cookies are useful to allow you to store certain preferences (e.g. language or country of origin) without having to reset them in the

during subsequent visits (so-called functionality cookies). For this reason, functionality cookies are often persistent cookies, as they remain stored on your computer even after you close your browser, until their expiry date or until you decide to delete them.

Some cookies are used to obtain statistical information, whether or not in aggregate, about the number of users accessing a site and how it is used (tracking or analytics cookies). Other cookies are used to build a profile of you as a consumer and display advertisements that may be of interest to you because they are consistent with your preferences (profiling cookies).

A.2. What are Identifiers?

Within the App, Cookie-like technologies are used to store and retrieve information about your device and its usage.

A pixel tag is a small graphic element (normally only one pixel wide and one pixel high) embedded in the code of a web page or within a mobile application. Pixel tags, in general, make it possible to collect information relating to visits and use of the web page and/or mobile application that contains them so that this information can be used for various purposes, such as, but not limited to,

optimisation of sales and marketing strategies, customisation of advertising and content.

Certain pixel tags are embedded within the code of mobile applications to enable the display of advertisements, data collection and implementation of related services. This technology is used for certain functionality through the mobile application based on analytical information associated with your mobile device.

B. Technical or 'strictly necessary' identifiers

The technical Identifiers used in the App are third-party Identifiers, which collect information in aggregated and anonymised form. These Identifiers are necessary for the correct functioning of the App. As required by current privacy legislation, therefore, for the installation of such

Identifiers do not require your prior consent.

The following technical identifiers are currently used in the App:

Name	Category	Function
Crashlytics (Google Ireland Limited)	- third-party technician - of navigation - of session	Infrastructure monitoring
Firebase Cloud Messaging (Google Ireland Limited)	- third-party technician - of functionality - persistent	Managing contacts and sending messages
Firebase Notifications (Google Ireland Limited)	- third-party technician - of functionality - persistent	Managing contacts and sending messages

C. Monitoring or 'analytics' identifiers and Profiling identifiers.

The analytics (or performance) identifiers and profiling identifiers used on this App collect information in a non-aggregated form and are used to make decisions - also - of a commercial nature: therefore, as required by current privacy legislation, your prior consent is required for their installation.

For this reason, when you access the App for the first time, a pop-up will be displayed prominently on your operating system, informing you that the App may collect certain information (such as your device's current advertising identifier) and track your activities on apps and websites that Fyne does not own (in order, for example, to analyse your activity within the App or to offer you targeted advertising and analyse your actions in response to advertising). If you do not authorise activity tracking, the App will not be able to access such Identifiers on your device.

The 'Identity Report' feature of Google Analytics, which is a third-party Identifier, is used on this App. Through this functionality, Google Analytics employs certain Identifiers, such as the advertising identifier, to analyse user activity on different devices used and create a single user path based on all data associated with the same identity. The 'Identity Report' functionality therefore provides a holistic and more unified picture of the user's relationship with Fyne. Your prior consent is required for the installation of such Identifiers, which collect information in a non-aggregated form. If you do not consent to activity tracking, the App will not be able to access such Identifiers on your device.

For more information on the 'Identity Report' feature of Google Analytics, please visit the site at the following link: https://support.google.com/analytics/answer/10976610?hl=it.

Google Analytics for Firebase' is also used on this App, which is a third-party Identifier that collects information in an aggregated and anonymised form. Therefore, this Identifier is installed on your device without your prior consent, as this is less invasive as it is anonymised.

If you have given your consent to tracking but later decide that you want to restrict the App from accessing your device, you can disable this option at any time without affecting your ability to access the App and enjoy its content in any way. To find out how to do this, follow the directions in section D or read the third party cookie policies carefully by following the links in the table below.

The following Monitoring Identifiers are currently used in the App:

Name

Category

Link to information

AdMob (Google Ireland Limited)

- third-party cookies

- profiling

https://policies.google.com/privacy

Please note that by logging in to the App using the credentials of a third party service you have subscribed to, you will receive third party Identifiers from the third party service provider, which typically, in addition to allowing you to authenticate to the App, also have profiling purposes. Before logging in through the buttons dedicated to third-party services, we therefore ask you to carefully read the information provided by the service providers on the use of these Identifiers. If you do not wish to receive these Identifiers, please log in normally without using the third-party services buttons. You can disable these Identifiers. To find out how to do this, please read the third party cookie policies carefully.

D. How to manage Identifiers and oppose their use

Follow the instructions provided by the manufacturer of the device you use to access the App, to find out how to manage or disable consent to the use of your device's advertising ID for profiling purposes. To restrict the App's access to your advertising ID, on iOS and iPadOS systems, go to Settings > Privacy > Tracking. If you disable this option, any app that attempts to ask you for the above permission will be blocked and automatically informed that you do not consent to tracking.

In order to restrict the Identity Report functionality of Google Analytics, and thus block the App's access to the Identifiers used by the functionality from your device, you need to access the settings from the App and by clicking on the relevant item you will be shown the pop-up requesting permission to track. If you do not authorise activity tracking, the App will not be able to access these Identifiers from your device.

It is not possible to block the installation of Technical Identifiers, since by removing them, the possibility of accessing, using all or part of the App, enabling or disabling certain functions or receiving certain services may be wholly or partly jeopardised.

E. Processing methods, data retention periods and transfers to third countries

As outlined in the introduction to this policy, it is possible that the Company collects and processes some of your personal data through the Identifiers that it conveys directly on the App (First Party Identifiers). The Company acts as the controller of this data, in accordance with the provisions of the Regulation. We will process your data only by electronic means, in a fully automated manner and without human intermediation. Therefore, our employees and collaborators will never have access to the content of your personal data obtained through the Identifiers, which means that they will never be able to access and/or have PII (Personally Identifiable Information), i.e. information from which you can be directly identified.

Some of our employees and collaborators, appointed by us as data processors, may carry out maintenance work on the computer systems hosting your data, without ever being able to access their actual content. Personal data may be stored on servers operated by parties

third parties (e.g. suppliers of computer systems) or may be managed by parties specialised in online advertising, who act as external data controllers on the basis of a specific appointment in writing by the Company.

Please note that, subject to the conditions and safeguards set out in the Regulation, your data may be transferred to countries outside the European Economic Area (EEA). Such countries may not offer a level of privacy and personal data protection comparable to that guaranteed by the Applicable Regulations; where the Company will act as data controller we will take the utmost account of the security of your data and, therefore, we will handle such transfers with all due care and guarantees in accordance with the Applicable Regulations and, in particular, in accordance with articles 45 (Transfer on the basis of an adequacy decision) and 46 (Transfer subject to adequate safeguards) of the Regulations.

Specifically, for the provision of the Google Analytics service, the Company's provider, Google Ireland Limited, may transfer the pseudonymous personal data of the App Users outside the EEA, on the basis of the so-called Standard Contractual Clauses and, in particular, to the United States, taking additional measures to ensure that this is done in accordance with the Regulation. Standard Contractual Clauses and, in particular, to the United States, taking additional measures to ensure that the transfer is carried out in accordance with the Regulation. More information about the additional security measures applied by Google Ireland Limited for transfers of personal data outside the European Union can be found in the following resources made available by the provider itself: "Regarding international data transfers in Google Analytics" (see link: https://support.google.com/analytics/answer/11609059) and "Safeguards for international data transfers with Google's advertising and analytics products".

(see link: https://services.google.com/fh/files/misc/safeguards_for_international_data_transfers.pdf). In view of the scope of the processing, the nature of the data processed and the risks of the processing carried out by the supplier, the Company has deemed appropriate the additional security measures that the supplier guarantees to take to protect the personal data processed on behalf of the Company.

We would like to point out that some of the third parties indicated in the tables in this policy and/or in the CMP may - as autonomous data controllers - process the personal data collected by means of the cookies installed on the App from a location outside the European territory and, therefore, we recommend that you carefully read their above-mentioned policies for more details on the matter.

Your personal data will be stored for as long as is strictly necessary to fulfil the primary purposes set out in this notice, or as necessary to protect the rights and interests of both you and the Company.

F. Your rights

To exercise your rights, or to obtain any further information or clarification in relation to this Cookie Policy, please contact the Company by the following means:

- By sending a registered letter with return receipt to the Controller's registered office at Via Berardi 8, Taranto 74123;

- By sending an e-mail to: privacy@fyne.it

The Data Controller has not identified the figure of the Data Protection Officer (DPO), since it is not subject to the designation obligation provided for in Article 37 of the Regulation.

Pursuant to the Regulation, the Company informs Users that they have the right to obtain information on (i) the origin of their personal data; (ii) the purposes and methods of processing; (iii) the logic applied in the event of processing carried out with the aid of electronic instruments; (iv) the identification details of the data controller and data processors; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as data processors or persons in charge of processing.

Furthermore, Users have the right to obtain:

(a) access, update, rectification or, where interested, integration of the data;

b) the cancellation, transformation into anonymous form or blocking of data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed;

c) certification that the operations referred to in points a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, unless this proves impossible or involves a manifestly disproportionate effort compared with the right protected.

In addition, Users have:

(a) the right to withdraw consent at any time, if the processing is based on their consent;

(b) (where applicable) the right to data portability (the right to receive all personal data concerning them in a structured, commonly used and machine-readable format), the right to restriction of the processing of personal data and the right to erasure ('right to be forgotten');

(i) in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if they are relevant to the purpose of the collection;

ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;

d) if they consider that the processing concerning them is in breach of the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they have their habitual residence, in the Member State in which they work or in the Member State in which the alleged breach occurred). The Italian supervisory authority is the Garante per la

Protection of Personal Data, with registered office in Piazza Venezia, no. 11, 00187 - Rome (RM) (http://www.garanteprivacy.it/)

***

The Company is not responsible for updating all links displayed in this Cookies Policy, therefore whenever a link is not working and/or updated, Users acknowledge and accept that they should always refer to the document and/or section of the websites referred to by such link.