Information on personal data processing for users of the payment service

Pursuant to articles 13 and 14 of EU Regulation 2016/679 (hereinafter, the “Regulation”) and to articles 13 and 14 of the UK GDPR (hereinafter, the “UK Regulation”), Fabrick S.p.A. (hereinafter, the “Data Controller”) provides you with the following information regarding the processing of your personal data.

1) Who is the Data Controller?

The Data Controller is Fabrick S.p.A.  with registered office in Biella (BI) - 13900, Piazza Gaudenzio Sella, no. 1.

2) How can you contact the Data Protection Officer?

The Data Protection Officer (hereinafter, "DPO – Data Protection Officer") can be contacted at the following addresses:

• Postal address of Fabrick S.p.A.:  Piazza Gaudenzio Sella, 1 - 13900, Biella - DPO;
• Email address: privacy@fabrick.com.

3) What data are or may be processed and what are the data sources?

The processing involves the personal data of the user of payment services (hereinafter, "Data Subject") and is carried out within the scope of the authorization, processing, and settlement of payment services through any payment instrument between the merchant where an online purchase is made (hereinafter, the "Merchant") and the Data Subject making the purchase, enabling the Merchant to accept and receive electronic payments (hereinafter, the "Service").

Specifically, the Data Controller processes personal data belonging to the following categories:

• Identifying, contact, and contractual data (such as: name, surname, e-mail address);
• Data related to payment transactions (such as: card details used for payment, transaction purpose, beneficiary, and amount).

The aforementioned data is provided by the Data Subject by filling out specific forms for entering payment transaction details, either on the Data Controller’s or the Merchant’s system, and is subsequently communicated by the latter to the Data Controller.

4) On what legal grounds and for what purposes are the data processed?

The processing of personal data is carried out by the Data Controller and/or third parties on its behalf only in the presence of one of the following legal bases and is limited to the pursuit of the related purposes:

• Execution of a contract in which the Data Subject is a party or execution of pre-contractual measures requested by the Data Subject, pursuant to Article 6, paragraph 1, letter b) of the Regulation and of the UK Regulation, in order to provide the Service;
• Compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6, paragraph 1, letter c) of the Regulation and of the UK Regulation, in particular to fulfill obligations related to the Service (e.g., where applicable: complaint management, anti-money laundering and counter terrorism financing etc.).

If the Merchant has subscribed to the fraud prevention service, the legitimate interest of the Data Controller or third parties in preventing fraud in payments, pursuant to Article 6, paragraph 1, letter f) of the Regulation and of the UK Regulation, to analyze the fraud risk level of transactions.

Regarding the above purposes, providing data is mandatory, and the Data Subject's consent is not required for processing. Failure to provide one or more data items will make it impossible to perform the Service.

5) To whom may personal data be disclosed?

Personal data may be accessed by personnel authorized by the Data Controller to process the data as part of their job duties, or by entities acting as processors – specifically appointed under Article 28 of the Regulation and of the UK Regulation – or independent data controllers. Below are the various categories of recipients involved:

• Public authorities within the scope of legally mandated communications (e.g. supervisory authorities);
• Independent entities (so-called acquirers) managing payments with credit or debit cards belonging to national and international circuits;
• Companies within the Sella Group, in the case of detecting suspicious transactions;

Companies providing the technological infrastructure for the Service and technical support activities; if the Merchant has subscribed to the fraud prevention service offered by Riskified Ltd., whose privacy policy can be found at the following link https://www.riskified.com/privacy/.

6) Can data be transferred to countries outside the European Economic Area?

For technical support activities aimed at investigating and resolving anomalies and testing applications, the Data Controller may allow access to data, in a tracked manner, to Sella Group companies based in India. Personal data is not stored at the foreign company but is accessed remotely while remaining within the Data Controller's information system. The transfer occurs based on standard contractual clauses approved by the European Commission.

Additionally, if the Merchant has subscribed to the fraud prevention service, certain data will be transferred outside the European Economic Area, specifically to Israel, to Riskified Ltd. for fraud risk analysis purposes. The transfer is permitted since the European Commission has recognized Israel as a third country that provides an adequate level of personal data protection.

7) How long will the data be retained?

Personal data are processed and stored for the period of time necessary to achieve the purpose of providing the Service, without prejudice to retention periods provided for by law and for own or third party defence purposes and until the expiry of the applicable statutory limitation period. In particular,  where required by applicable legal obligations concerning the retention and availability of documents, data, and information for anti‑money laundering and counter‑terrorism financing, the data relating to the performance of the Service (identification and contact data and data relating to payment transactions) are retained for 10 years from the termination of the relationship with the Merchant.

At the end of the storage period, personal data relating to Data Subjects will be stored in a form that does not allow them to be identified (e.g. irreversible anonymisation), unless their processing is necessary for one or more of the following purposes:

• Resolution of pre-litigation and/or litigation initiated before the retention period expires;
• Compliance with internal control function investigations/audits and/or external authority inspections initiated before the retention period expires;
• Responding to requests from Italian and/or foreign public authorities received/notified to the Data Controller before the retention period expires.

8) What rights do Data Subjects have?

Data Subjects may exercise specific data protection rights, listed below:

Please note that the above rights are not absolute, and the Data Controller may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply. For example, it can refuse your request if it is manifestly unfounded or excessive.

To exercise your rights and for any information regarding the processing of your personal data, you can send a request to the following addresses:

• Postal address of Fabrick S.p.A,: Piazza Gaudenzio Sella no. 1, Biella (BI) – 13900;
• Email address: privacy@fabrick.com .

The Data Controller shall provide information about the action taken on the request without undue delay and at the latest within one month of receipt thereof (unless an exception under the Regulation and the UK Regulation applies).