Privacy Policy

Title

Layer 1

Layer 2 (+ info)

1. Definitions

Cookies, Personal Data, Events, Policy, Business Pitch, Profiling, Regulation, Services, Ancillary Services, Website, Startup, Processing, Users.

1. Cookies: cookies are text files (letters and/or numbers) that contain packages of information that are stored on the User's computer or mobile device whenever they visit a website through a browser. At each subsequent visit the browser sends cookies to the website they originated from or to another website. Cookies can be stored only for a temporary period for use by a particular website (i.e. session cookies), or for a longer period of time and independent of the session (i.e. persistent cookies).

2. Personal Data: any information relating to an individual, identified or identifiable, directly and indirectly, by reference to their name, identification number, location data, online identifier or elements characteristic of their physical, physiological, genetic, psychic, economic, cultural or social identity.

3. Events: the events and promotional initiatives organized by Digital Magics, in-house or in collaboration with third parties, intended for the User, aimed at promoting the Services offered and/or the image of Digital Magics. Policy:this document, consisting of the policy regarding the processing of Personal Data and our Policy relating to Cookies.

4. Business Pitch:presentation documents relating to innovative projects sent by Users to Digital Magics via the Website, via offline mode or email to Digital Magics’ addresses available on the Website.

5. Profiling:Personal Data Processing through the evaluation of personal aspects of Users with the use of fully or partially automated procedures.

6. Regulation: Regulation EU No 2016/679 of April 27, 2016.

7. Services: provision of acceleration and/or incubation services in favour of Startups, consultancy services for innovation, open innovation and call for innovation.

8. Ancillary Services:the right to send spontaneous applications to work at Digital Magics and to request contact information from Digital Magics, by filling in the respective forms on the Website.

9. Website: this website.

10. Startup: any company, incorporated or to be incorporated, in the form of an "innovative" startup or SME, in accordance with the provisions of, respectively, the Decreto Crescita- Bis (“Growth Bill”) converted into Law No 221 of 17 December 2012, and subsequent amendments and by Decree Law No 3/2015.

11. Processing: any operation or set of operations concerning Personal Data, such as, by way of example, the collection, organization, structuring, preservation, modification,

extraction, consultation, use, communication, interconnection, limitation, cancellation and destruction.

1.12 Users: users of the Website.

2. Data Controller

Digital Magics SpA

The Data Controller referred to in this Policy is Digital Magics SpA, with its registered office in Milan, Via Bernardo Quaranta, 40, CF/VAT and Milan Business Register No 04066730963 ("Digital Magics").

Any request of the User concerning the Processing of personal data performed by Digital Magics regarding their Personal Data (including the exercise of the rights referred to in paragraph 8 below), will be addressed to Digital Magics by post at the registered office, or by email to the

following address privacy@digitalmagics.com

3. Purposes and legalbasisof Processing

1. navigation on the Website: consent;

2. receipt of Business Pitches: consent;

3. provision of Ancillary Services: consent;

4. sending of commercial and promotional information, through Profiling, by Digital Magics: expressed consent;

5. improvement of the Website and of the Services: legitimate interest.

Digital Magics collects and uses Personal Data of Users for pursuing following purposes:

1. Enabling navigation on the Website, primarily through the use of Cookies.

   • The collection of Personal Data for the purposes referred to in letter a) is regulated in

the Cookies Policy, available at the link, of which Digital Magics recommends reading.

2. Receiving Business Pitches voluntarily and independently sent by Users to Digital Magics, via the Website, offlineor via email to the addresses of Digital Magics available on the Website;

3. To provide Ancillary Services in favour of Users.

• The collection of Personal Data for the purposes referred to in letters b) and c) is mandatory by the User for the use of the Services and/or the Ancillary Services and any refusal prevents the User from using the Services and/or of the Ancillary Services. These Processing Operations are based on the free, specific, informed and unequivocal consent of the User, expressed through a declaration or positive action (eg flag) on the Website. The withdrawalofconsent can be exercised at any time, following the instructions in point 8 letter a) of this Policy.

d) Subject to prior optional consent, performing statistical analysis and market research, sending information and advertising material, to report on, and invite to promotional initiatives or events in line with the interests expressed by Users regarding the Services, through Profiling;

• The collection of Personal Data for the purposes referred to in letter d) is optional and any

refusal by the User prevents the latter from receiving newsletters and invitations to events organized by Digital Magics. These Processing Operations are based on the free, specific,

informed and unequivocal consent of the User, expressed through a declaration or

positive action (eg flag) on the Website. The withdrawal of consent can be exercised at any time, following the instructions in point 8 letter a) of this Policy.

e) Performing statistical analysis, market research, improving the presentation of the Services and the use of the Website by Users. Where possible, in order to achieve the present purpose, we will make use of anonymous Personal Data (Personal Data that does not identify or make Users identifiable).

• The Data processing referred to in letter e) is based on the legitimate interest of Digital

Magics constituted by the benefit that the Company can obtain from offering Services more similar to the preferences expressed by its Users while browsing the Website and the use of Services, which we believe to override Users' right to privacy. Opposition tothe presentProcessing can be exercised at any time by following the indications in point 8

letter f) of this Policy.

4. Personal Datacollection Procedures

1. Personal Data entered on the Website by Users;

2. Personal Data expressly communicated to Digital Magics by Users in offlinemode;

3. Personal Data expressly communicated by Users to Digital Magics’ addresses available on the Website;

4. Personal data automatically collected by the Website (through Cookies);

5. Personal Data collected

during Events.

Digital Magics collects Personal Data in the following ways:

1. Personal Data entered on the Website by Users: this is the Personal Data provided, by way of example and not exhaustively, in order to make use of the Services and/or the Ancillary Services;

2. Personal Data expressly communicated to Digital Magics by Users in offlinemode: this Personal Data directly communicated to employees and collaborators of Digital Magics by Users through methods other than the Website itself;

3. Personal Data expressly communicated by Users to Digital Magics, via email to Digital

Magics’ addresses available on the Website (eg pitch@digitalmagics.com);

4. Personal Data automatically collected by the Website: this is the Personal Data collected by the Website through, but not limited to, Cookies (for further information, Digital Magics strongly recommends reading the Cookies Policy shown below);

5. Personal Data collected during the Events: this is the Personal Data provided by the Users during their participation in Events, including the personal image of the User.

5. Possible categories of recipients of Personal Data

Employees, collaborators, Startups that have a service relation with Digital Magics, third party IT service providers,

third parties contractually

Personal Data is processed by Digital Magics and/or third parties, selected for reliability and competence, and to which such Personal Data may be disclosed as necessary or appropriate, provided that they are located within Italy or the European Union. In particular, Digital Magics informs Users that Personal Data may be processed by, and/or communicated to:

1. employees and/or collaborators of Digital Magics;

2. The Doers S.r.l., with registered office in Piazza Solferino 20, 10121 Turin, PIVA 10766230014, as data processor in compliance with article 28 of the Regulation;

linked to Digital Magics (for the provision of the Services), third parties with whom Digital Magics organizes some Events, technical and commercial third parties.

2. Startups that have a service relation with Digital Magics;

3. third parties suppliers of services necessary to guarantee the functioning of the Website (by way of example: a company that deals with hosting services);

4. third parties, contractually linked to Digital Magics, necessary for the provision of the Services (eg territorial partners of Digital Magics);

5. third parties that provide analysis services of the Website navigation data;

6. third parties with whom Digital Magics organizes several Events;

7. subject to the User's optional consent, third parties providing automatic services for sending newsletters and/or any other type of commercial communication, marketing services, promotion, analysis of habits and consumption choices, also by means of

Profiling.

6.Retention period ofPersonalData(orcriteria for

determination)

1. Personal Data for the purpose of Business Pitches Evaluation: 5 years from receipt of Pitch;

2. Personal Data for the provision of the Ancillary Services: 6 months from receipt of the request;

3. Data for commercial purposes: 12 months from the last interaction of the User with the Company.

Personal Data are kept by Digital Magics for the period of time strictly necessary to achieve the purposes for which they were collected, as indicated in point 3 above. In particular, except for the exercise of the right of withdrawal of the consent referred to in the following point 8 letter

a) or the right of opposition referred to in point 8 letter f), Digital Magics retains Personal Data for the following duration terms:

1. Cookies: for the purpose referred to in point 3 letter a), Users are strongly advised to read the Cookies Policy, available at the link;

2. Personal Data for the evaluation of Business Pitches: for the purpose referred to in point 3 letter b), for the period of 5 years from receipt of the Business Pitch spontaneously sent by the User, without prejudice to the provisions of point 6 letter e);

3. Personal Data for the provision of Ancillary Services: for the purpose referred to in point 3 letter c), for a period of 6 months from receipt of the request for Ancillary Services, sent by the User by filling in the appropriate forms on the Website and/or communicated spontaneously by the User to Digital Magics through the email addresses available on the Website or offline mode. By way of derogation from this deadline, in case of a grievance or a complaint being sent via the "contact" form, the User's Personal Data will be kept for the period referred to in letter e) below;

4. Personal Data for commercial communications: for the purpose referred to in point 3 letter d), for a period of 12 months following the last interaction with Digital Magics by the User, suitable to demonstrate an interest in receiving communications relating to Digital Magics, such as gathering consent, opening newsletters, joining the Services and/or participating in the Events;

5. in any case, Digital Magics is authorized to keep, in whole or in part, Personal Data for a

maximum period of 10 years from their collection, limited to the information necessary to

comply with legal obligations and enable Digital Magics itself to investigate, exercise and defend, where applicable, its own right in court.

Once these terms have expired, Digital Magics will automatically delete the Personal Data collected, or transform them into an irreversible anonymous form.

7. Profiling

Automated processing of Personal Data of Users for evaluative and/or predictive purposes.

Profiling performed by Digital Magics has the following characteristics:

1. object: Personal Data of Users collected on the Site and/or during the Events, suitable to reveal essentially the geographical origin, as well as tastes, behavioral tendencies and preferences regarding the adherence to the Services;

2. purpose: improving the promotion and advertising of Digital Magics and the Services, by sending commercial communications in line with the interests expressed by the Users regarding the services and the reporting of targeted Events organized by Digital Magics in the area closer to the User;

3. Logic of the Processing: the profiles of Users are defined on a statistical basis through the analysis and processing of Personal Data of all Users of the Site and the creation of homogeneous categories of Users;

4. effects for Users: receipt of commercial communications relating to the Services andinvitations to Events in line with the preferences expressed by the Users in navigating the Website and in the use of the Services. In no way, does Profiling of Digital Magics: i) constitute an automated decision-making process from which derive legal or similarly significant effects for Users; ii) prejudice the behaviour and the purchase choices of the Users; iii) have a prolonged and permanent impact on Users, considering that the Personal Data collected by Digital Magics can be independently updated at any time by Users; and iv) by reason of the type of Services offered by Digital Magics and the category

of Users affected by such Processing, determine any discrimination of Users.

8. Users’Rights

Withdrawal of consent, access to Personal Data, correction or integration of Personal Data, deletion of Personal Data, limitation of Processing, opposition to Processing, portability of Personal Data, data breach, complaint to competent authorities

Pursuant to and for the purposes of the Regulation, for the period referred to in paragraph 6 of this Policy, each User has the right to:

1. with reference to Data Processing referred to in point 3 letter d), withdraw the consent at any time, without prejudice to the lawfulness of the Processing based on consent before its withdrawal, by sending an email to Digital Magics or by opting out from the commercial communications of Digital Magics (see Article 7 of the Regulation);

2. ask Digital Magics for access to Personal Data and information regarding the related Processing and any copy in electronic format, unless otherwise specified by the User (see Article 15 of the Regulation);

3. request the correction and/or integration of Personal Data, without undue delay (see Article 16 of the Regulation);

4. for specific reasons (for example, unlawful processing, withdrawal of consent, non- existence of the purpose of the Processing), request cancellation of Personal Data, without unjustified delay (see Article 17 of the Regulation);

5. with reference to specific cases (for example, inaccuracy of Personal Data, unlawful Processing, exercise of a right in court), request the limitation of Processing (Article 18 of the Regulation);

6. with reference to the Processing referred to in point 3 letter e), to object at any time to the Processing of Personal Data by sending an email to Digital Magics (see Article 21 of the Regulation);

7. in case of automated Processing, to receive Personal Data in a readable format, in order to consent their communication to a third party, or, where technically feasible, to request the transmission of Personal Data by Digital Magics directly to such third party (so-called portability of Personal Data – see Article 20 of the Regulation);

8. be informed by Digital Magics without undue delay of any violations or unauthorized access by third parties to their systems containing Personal Data (so-called databreach – see Article 34 of the Regulation);

9. propose a complaint to the supervisory authority of the EU country in which the User resides, works or in which they believe the violation of their rights has occurred (see Article 77 of the Regulation);

For further information on the terms and conditions for the exercise of the rights granted to the User, the latter may consult the text of the EU Regulation published at the link, or contact Digital

Magics in the forms provided for in point 2 of this Policy.