The information provided below is drafted, pursuant to art. 13 of the EU Regulation 2016/679 ("Regulation"), by Solarplace s.r.l. ("Solarplace"), in relation to the personal data of users collected on the occasion of:

• a) accessing and/or registering on the online platform (“Platform”), available at the domain https://solarplace.net;
• b) making a purchase on the Platform or requesting a quote;
• c) assistance and customer care services;
• d) the use of other services offered by Solarplace srl.

Collectively, points a), b), c) and d) are referred to as the “Services”.

Solarplace operates on the Platform, of which it is the owner, as the provider of the registration and sales service. The Platform, designed and managed by Solarplace, allows third-party sellers ("Sellers"), other than Solarplace, to connect with buyers (“Users”) for the purpose of online sale of goods and/or services. The Platform hosts the virtual space created and managed by Solarplace, within which it is possible to receive quotes on behalf of the Sellers and to enter into sale contracts between the Sellers and Users. The User's personal data are thus processed by Solarplace and, in the case of a purchase or quote request from a Seller. In such case, Solarplace and the Seller act as independent data controllers, each of them processing the personal data of Users for their own purposes, as detailed in this information notice. Therefore, the following information is provided, pursuant to art. 13 of the Regulation, with reference to Solarplace and, in the case of a purchase from a Seller, also with reference to said Seller.

Solarplace s.r.l., headquartered at Via Tramontana 1 in Carbonia (09013), is the data controller of the personal data of Users collected during the use of the Services. In the case of purchasing a product or requesting a quote from a Seller, the Seller is also a data controller, limited to the data necessary for the execution of the purchase contract concluded through the Platform and of any additional data collected during the exercise of the rights arising from such contract (specifically, the right of withdrawal and the legal guarantee of conformity).

Users can contact the Data Protection Officer (also called "DPO") for all matters related to the processing of their personal data and the exercise of their rights derived from the Regulation. The contact details of Solarplace's Data Protection Officer are as follows:

• email address: dpo@solarplace.net
• phone number: 389 936 0699
• postal address: mirko@solarplace.net

Solarplace will process the user's personal data to:

• enable registration on the Platform and use of the Services reserved for registered users, including the ability to purchase online through the Platform;
• enable and/or facilitate the conclusion of the purchase contract between Seller and User and the correct execution of the obligations arising from such contract, such as, by way of example but not limited to, the delivery and/or payment, including online, of the products and/or services purchased;
• execute requests sent by the User.

The legal basis for this processing is the fulfillment of the contract or, as appropriate, the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b) of the Regulation).

For this purpose, Solarplace will process the User's data for the time strictly necessary for the performance of the individual processing activities (e.g., registration data will be processed until the account is closed, taking into account the necessary technical times; data required for the execution of the purchase contract will be processed until the product is delivered or, in the case of non-delivery, until the resolution of the contract), without prejudice to the fact that, upon expiry of this period, Solarplace may retain the data for the purposes and for the maximum retention periods referred to in sections 9, 10, 11, 12, 13, and 14 of this information notice and/or, in any case, in the cases established by the Regulation and/or by law.

In the event that the User purchases one or more products from a Seller, the Seller will process the User's personal data in order to fulfill the sales contract. The legal basis for this processing is the fulfillment of the contract (art. 6.1.b) of the Regulation).

For this purpose, the Seller will process the User's data for the time strictly necessary for the execution of the contract (for example, the data necessary for the execution of the purchase contract will be processed until the delivery of the product or, in case of non-delivery, until the resolution of the contract), it being understood that, after this period, the Seller may retain such data for the purposes and for the maximum retention periods of which in sections 12, 13, and 14 of this notice and/or, in any case, in the cases established by the Regulation and/or by law.

With the User's express consent, Solarplace will process the User's personal data to send them informative and promotional communications, including newsletters, discount coupons, and special offers, related to its or third parties' products and/or services as well as for direct sales purposes and market research, via e-mail, postal service, and/or telephone contact. The legal basis for this processing is the User's express consent (art. 6.1.a) of the Regulation).

The User may revoke their consent at any time and/or oppose, at any time, the processing of their data for marketing purposes:

• by contacting Solarplace at the following address: dpo@solarplace.net;
• via the appropriate link in every promotional communication sent by Solarplace.

Providing data for general marketing purposes is optional: there is no legal or contractual obligation on the user to provide such data for this purpose and/or to consent to the processing of their personal data for this purpose. For the purpose of general marketing, Solarplace will process the User's data until the consent is withdrawn and/or the right of opposition is exercised and in any case no longer than four years from the data collection, reserving the right, before the expiration of this period, to ask the User to renew their consent and/or update the data.

Solarplace will process the email contact details (i.e., the email address) provided by the User in the context of purchasing a product and/or service offered and sold directly by Solarplace, to allow Solarplace to directly sell similar products or services (and therefore send promotional communications by email to the User concerning such products and/or services) without the need for the express and prior consent of the data subject, as provided by art. 130, paragraph IV, of the Privacy Code, and provided that the User does not exercise their right to object as outlined below (so-called soft-spam). The legal basis for this processing is art. 130, paragraph IV, of the Privacy Code, which expressly allows such processing.

The User can object to receiving soft-spam communications:

• by contacting Solarplace at the following address: dpo@solarplace.net;
• via the appropriate link in every promotional communication sent by Solarplace.

For the purpose of soft-spam, Solarplace will process the User's data until the right of objection is exercised and in any case no longer than four years from data collection, except for purchase details which will be retained and processed for soft-spam purposes for a period of 24 months from data collection.

With the explicit consent of the User, Solarplace will process Users' personal data, automatically, for:

• monitoring and tracking user behavior on the Platform, collecting and recording navigation data (e.g., visited pages, viewed product categories, whether the user purchased or not, abandoned carts, access device) and purchase data (e.g., type of product purchased, purchase frequency, amounts spent, payment methods);
• analyzing and processing such data, together with other information related to Users (such as, but not limited to, gender, order status, ZIP code, date of birth, IP address), to identify correlations between user behaviors and categorize them into various "clusters," i.e., groups of customer types that may have common characteristics;
• sending customized offers via email, mail, phone, and/or displaying them on the Platform to users based on the cluster they belong to, presumed to be of specific interest to them.

All processing phases, including the final decision regarding the promotional communication to be sent or displayed to the User based on their clusters, are fully automated without human intervention, based on an algorithm with parameters previously set by Solarplace. The decision solely based on automated processing, including profiling, produces legal effects concerning the data subject (i.e., limiting their freedom of choice) and is allowed by the exemption clause referred to in art. 22.2.a) of the GDPR, as it is necessary for the execution of the contract between the data controller and the data subject and/or related to such contract and its validity and effectiveness.

The User thus has the right, at any time, to:

• obtain human intervention from Solarplace;
• express their opinion;
• contest the decision made by Solarplace (e.g., being placed in a specific cluster).

To exercise this right, the User can:

• contact Solarplace at the following address: dpo@solarplace.net

The legal basis for this processing is the explicit consent of the data subject (art. 21.1.c) of the Regulation).

The User can withdraw their consent at any time and/or object, at any time, to the processing of their data for profiling purposes for marketing:

• by contacting Solarplace at the following address: dpo@solarplace.net;
• via the appropriate link in each promotional communication sent by Solarplace.

For profiling purposes for marketing, Solarplace will process the User's data until the consent is withdrawn and/or the right to object is exercised and, in any case, no later than 12 months from the collection. Providing data for profiling purposes for marketing is optional: there is no legal or contractual obligation for the User to provide such data for this purpose and/or to give consent for such data processing for this purpose.

Solarplace will process Users' data for generic assistance and customer care activities and thus to respond to information requests from Users or to respond to complaints, notifications, disputes, or similar.

The legal basis for this processing is the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b, last paragraph, of the Regulation) or, depending on the case, the legitimate interest of Solarplace (art. 6.1.f) of the Regulation).

It constitutes a legitimate interest of Solarplace to respond to information requests and/or reviews and/or notifications and/or disputes and/or complaints from Platform Users. This legitimate interest of Solarplace also coincides with the legitimate interest of the same Platform Users who make the requests and/or notifications and/or disputes and/or complaints in question and who, therefore, in the context of the relationship with Solarplace, can reasonably expect their personal data to be used by Solarplace to provide a response.

Therefore, the legitimate interest of Solarplace identified here can be considered to prevail over the rights and fundamental freedoms of the data subject, also due to such reasonable expectations and the existing relationship between the data subject and Solarplace, as well as considering the nature of the processed data and the coinciding interest of the data subjects themselves.

The User has, in any case, the right to object, at any time, for reasons related to their personal situation, to the processing of personal data concerning them for the purpose in question (i.e., assistance and customer care).

To exercise this right, the User can contact Solarplace at the following address: dpo@solarplace.net.

Solarplace and, in case of purchase from a Seller, such Seller, will process the users' data for the execution of administrative and/or accounting and/or tax obligations related to the provision of Solarplace's Services and/or the purchase contract concluded through the Platform, such as, by way of example, the keeping of accounting records and the issuance of the sales invoice.

The legal basis for this processing is the fulfillment of legal obligations to which Solarplace and/or, in case of purchase from a Seller, the Seller are subject (art. 6.1.c) of the Regulation).

The provision of data for the aforementioned purpose is mandatory because its processing is necessary to allow Solarplace and/or the Seller to comply with legal obligations incumbent upon them. The refusal to provide data for this purpose will result in the impossibility for the User to avail themselves of the Services and, in particular, to conclude the purchase contract.

For this purpose, Solarplace and/or the Seller will process the user's data until the expiry of the legal terms provided for the performance of each administrative-accounting and tax obligation and/or for the retention periods provided by law for the conservation of related documentation.

Solarplace or, in case of purchase from a Seller, such Seller will process users' data in order to:

• respond to requests for exercising the right of withdrawal and/or requests for exercising the legal guarantee of conformity and/or other rights arising from the purchase contract concluded on the Platform and/or provided by law in relation to such contract and/or, as far as Solarplace is concerned, in relation to the provision of Services;
• carry out the activities that prove necessary as a consequence of the exercise of such rights and proceed, where appropriate, with the relevant refunds;
• receive and respond to requests for exercising rights regarding the protection of personal data provided by the Regulation and carry out all consequent activities.

The legal basis for this processing is the fulfillment of legal obligations to which Solarplace and/or, in case of purchase from a Seller, the Seller are subject (art. 6.1.c) of the Regulation).

The User may exercise specific rights, including the right to request the data controller to:

• confirm whether or not the processing of their personal data is ongoing and, if so, gain access to it (right of access);
• rectify inaccurate personal data or complete incomplete personal data (right of rectification);
• delete the data, if one of the reasons provided for in the Regulation applies (right to erasure);
• restrict the processing of their personal data, if one of the reasons provided for in the Regulation applies (right to restriction);
• receive the personal data provided in a structured, commonly used, and machine-readable format, and to transmit it to another data controller (right to data portability).

The User has the right to withdraw consent to the processing of their personal data (where this has been given) at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Furthermore, the User has the right to object to direct promotional activities carried out by Solarplace, including any segmentation for marketing purposes.

To exercise their rights, the User may write to the email address dpo@solarplace.net.

Solarplace may not always be able to provide all the requested information and follow up the User's requests. In any case, Solarplace will do its best to follow up on User requests.

In accordance with the Regulation, Solarplace is not authorized to charge fees to comply with any of the requests listed in this paragraph unless they are manifestly unfounded or excessive, and particularly if they are repetitive. In cases where the User requests more than one copy of their personal data or in cases of excessive or unfounded requests, Solarplace may (i) charge a reasonable fee considering the administrative costs incurred in fulfilling the request or (ii) refuse to satisfy the request. In these eventualities, Solarplace will inform the User of the costs before fulfilling the request.

Solarplace may request further information before fulfilling requests if it needs to verify the identity of the individual making the requests.

Without prejudice to any other administrative or judicial action, the Data Subject may lodge a complaint with the competent supervisory authority in Italy (Data Protection Authority) or with the authority that performs its duties and exercises its powers in the member state where the GDPR violation occurred. Any updates to this Notice will be communicated promptly and by appropriate means, and it will also be communicated if the Data Controller processes the Data Subject's data for purposes other than those set out in this Notice before proceeding and following the manifestation of the relevant consent of the Data Subject where necessary.

In any case, Solarplace is interested in being informed of any reasons for complaints and invites the use of the contact channels indicated above before approaching the supervisory authority, in order to prevent and resolve any disputes amicably and promptly, with the utmost courtesy, seriousness, and discretion.