NOTICE ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Regulation (EU) 679/2016 (“GDPR”)

1. DATA CONTROLLERS, JOINT CONTROLLERS, AND DATA PROCESSORS

The company Venchi S.p.A., with its registered office at 8 Via V. Monti, 20123, Milan (Milan) and administrative office at 1 Via Venchi, 12040, Castelletto Stura (Cuneo), VAT ID 05744670968 (hereinafter referred to as the "Data Controller" or "Venchi") processes, based on the specific purposes pursued and indicated in this policy, your personal data pursuant to European Regulation 2016/679 (hereinafter referred to as the "GDPR").

The aforementioned company acts as an autonomous Data Controller as per paragraph 2 below.

Additionally, the company Venchi S.p.A. and the company Venchi US Inc., with its registered office at 16 W 36th St. New York, New York, 10018 (hereinafter referred to jointly as the "Joint Data Controllers")

The aforementioned companies act as independent data controllers with respect to the data processing described in Section 2 below.

They also act as joint controllers with respect to the data processing described in Section 3 below, having jointly determined the purposes and means of processing through the execution of a specific agreement pursuant to Article 26 of the GDPR.

2. PROCESSING CARRIED OUT BY VENCHI S.P.A. AS AN AUTONOMOUS DATA CONTROLLER; PURPOSE OF PROCESSING AND LEGAL BASIS

Specifically, personal data may be acquired by the Data Controller via the following channels:

A. the Venchi.com website, via the Italy (https://it.venchi.com/), Europe (https://eu.venchi.com/) and United Kingdom (https://uk.venchi.com/) sections, (hereinafter referred to as the "Website"), if the data subject decides to create their own e-commerce account and simultaneously join the European "V-CLUB" Loyalty Programme (the "Loyalty Programme" or "Programme"), or to purchase products without registering and therefore without using their own e-commerce account or V-CLUB profile (through a so-called "Guest Profile"). Please note that, with regard to the personal data acquired by the company Venchi US Inc. via the USA section https://us.venchi.com/ of the Venchi.com website and simultaneous enrolment in the US "V-CLUB" Loyalty Programme, Venchi US Inc. acts as an autonomous data controller as per the privacy policy drawn up by the latter and present on the https://us.venchi.com/ website;

B. the Venchi shops located in Italy, Europe and the United Kingdom (hereinafter referred to as the "Shops"), if the data subject decides to join the European "V-CLUB" Loyalty Programme ("Loyalty Programme" or "Programme") or to purchase product without registering. Please note that, with regard to the personal data acquired by the company Venchi US Inc. through the shops located in the USA and the associated enrolment in the US "V-CLUB" Loyalty Programme, or the purchase of products without registration, Venchi US Inc. acts as an autonomous data controller as per the privacy policy drawn up by the latter and present on the https://us.venchi.com/ website;

C. the use of the "Contact" and "Working with Venchi" sections and the use of the Venchi Chatbot within the Website ("Contact, Working with Venchi and Venchi Chatbot");

D. subscription to the newsletter to receive the Data Controller's commercial communications ("Newsletter");

hereinafter collectively referred to as the "Channels".

With respect to each Channel, the Data Controller collects and processes certain personal data for the following purposes, in accordance with the indicated legal bases for processing.

A. Website Registration

By registering on the Website, the user creates their own personal e-commerce account, with which their purchases on the Website will be associated, and simultaneously registers in the Programme (for further information on the latter, please refer to paragraph 2.C below). In this regard, Venchi may collect the following personal data:

a)   identifying data (name, surname);
b)   email address;
c)   country of residence (in the case of e-commerce account creation carried out in a Shop);
d)   domicile or residence post code;
e) date of birth;
f) telephone number.

The provision of the data referred to in points a), b), c) above is compulsory for the purposes of completing registration on the Website and, therefore, the creation of your e-commerce account. In the absence of such data, it will therefore not be possible to complete registration on the Website and thus place orders with your personal e-commerce account. The data referred to in points d), e) and f), on the other hand, is provided at the user's discretion. Said data is used by the Data Controller for the sole purpose of organising the type of users who register on the Website in a more granular manner, as well as for the following purposes, in compliance with the relevant legal basis. With regard to the data required to enrol in the Loyalty Programme, please refer to paragraph 2.C below. With specific reference to telephone numbers, the Data Controller specifies that, should the user freely decide to indicate their telephone number and also consent to receiving commercial communications (as better defined in paragraph "2.E.1. Commercial Communications (Generic Marketing, Profiled Marketing and Third Parties)" below), this data will be used to send SMS Commercial Communications (as better defined in paragraph 2.E.1 below).

Furthermore, when products are ordered, the following additional information will be requested, which is required in order to complete the order:
a)   delivery address;
b)   payment data, credit/debit card number and associated name and surname, date of expiry of the credit/debit card, billing address.

If the user wishes to receive an electronic invoice after making a purchase, the personal data provided to request electronic invoicing (including the tax code) will be processed by Venchi with the same methods as those set forth above in order to proceed with such invoicing. The provision of invoicing data is optional, but refusal to provide them will make it impossible to proceed with electronic invoicing.

Venchi will process the personal data mentioned above for the following purposes and on the following legal bases:
(i)   to create your profile and perform the contract to which you are party (in order to complete a product order and, possibly, request electronic invoicing) or precontractual measures at your request, as well as meet the legal obligations and/or the accounting purposes connected to the contract in addition to allowing the Data Controller to exercise its right to defence. The legal basis of the processing is therefore the performance of the contract, the fulfilment of a legal obligation and the pursuit of a legitimate interest pursuant to art. 6.1, letters b), c) and f) of the GDPR.
(ii)   to enrol the user in the Loyalty Programme, to send you, as a registrant, communications linked to the Programme and to enable you to take advantage of any correlated benefits, pursuant to art. 6.1, letter b) of the GDPR, as described in more detail in Section 3.C below;
(iii) should you provide your autonomous and specific consent, we may send you general marketing communications (as further described under paragraph 2.E.1.a below). The legal basis for this processing is therefore the user’s consent, pursuant to Article 6(1)(a) of the GDPR;
(iv) where you give your independent and specific consent via the Italy (https://it.venchi.com/), Europe (https://eu.venchi.com/) and United Kingdom (https://uk.venchi.com/) sections of the Website, to analyse your consumption habits and related purchasing choices and consequently to carry out personalised marketing activities, either by Venchi sending you commercial communications in line with your preferences (as better described in paragraph 2.E.1.b) below), or through your inclusion in advertising campaigns relating to Venchi carried out on other platforms (e.g. social networks) by Venchi's suppliers, duly appointed as data processors by Venchi and to whom Venchi has communicated your data in this capacity, for the purpose of you receiving targeted advertising relating to Venchi. The legal basis for the processing is therefore the consent of the user pursuant to Article 6.1(a) of the GDPR;
(v) should you provide your autonomous and specific consent, Venchi may send you marketing communications aimed at promoting and/or advertising products or services of Venchi’s commercial partners (as further described under paragraph 2.E.1.c below). The legal basis for this processing is therefore the user’s consent, pursuant to Article 6(1)(a) of the GDPR;
(vi) to send you, based on the Controller’s legitimate interest, marketing communications consistent with your previous purchases (as further described under paragraph 2.E.2 below), pursuant to Article 6(1)(f) of the GDPR.

Personal data will be stored and shared in accordance with the provisions set forth in the following paragraphs: “5. Recipients of Personal Data and Data Processing Location” and “6. Duration of Processing and Data Retention Period.”

You may cancel your subscription to the Loyalty Program at any time, in accordance with its terms and conditions. In such cases, your personal data will be processed by the Controller solely for purposes related to your registration on the Website (through the creation of your e-commerce account) and for any purchases made through the Website. In any case, you may at any time (i) delete your personal e-commerce account created for the purpose of registering on the Website, and/or (ii) to revoke consent previously given under points (iii), (iv) and (v) above by contacting the Data Controller at privacy@venchi.com or customercare@venchi.com; subsequently, you will receive a communication confirming that your consent has been withdrawn/revoked.

Please read our cookie policy at eu.venchi.com/cookie-policy to understand in detail how the cookies and similar tools we use work, their purpose, and other relevant information.

B. Purchases through the Website using a “Guest Profile”

Users who wish to purchase products without creating a profile on the Website may proceed in guest mode. In this regard, it will be necessary to enter personal data (name and surname), contact data (email address), a telephone number, the necessary delivery information and payment data.

Unless you provide your autonomous consent, the information entered will be processed only for the purposes pursuant to section 3.A, point (i), limited to the completion and fulfilment of the purchase order placed and the fulfilment of the associated legal obligations, and point (vi); with respect to the purposes pursuant to point (vi), please note that only the email address provided by the user in relation to the purchases made will be used.

The personal data will be stored and shared in accordance with what is set forth below in sections “4. Recipients of personal data and processing location” and “5. Duration of processing and data retention period”.

C. Registration in the Loyalty Programme

Within the framework of the Programmes/each Programme, the Data Controller will process the following personal data associated with each data subject:

a) personal data (first name, last name);

(b) email address;

c) country of residence (in the case of registration under paragraph 2.A above, Programme joined in a Shop);

(d) postcode of domicile or residence;

(e) date of birth;

f) telephone number.

The provision of the data referred to in points a), b) and c) above is compulsory for the purposes of completing registration in the Loyalty Programme and, therefore, the creation of your loyalty profile. In the absence of such data, it will therefore not be possible to finalise enrolment in the Loyalty Programme. The data referred to in points d), e) and f), on the other hand, is provided at the user's discretion.

Within the framework of the Loyalty Programme, the Data Controller will process the aforementioned personal data for the following purposes and legal bases:

(i) to complete registration in the Loyalty Programme, to send you, as a registrant, communications linked to the Programme, and to enable you to take advantage of any correlated benefits, pursuant to art. 6.1, letter b) of the GDPR;

(ii) should you provide your autonomous and specific consent at the time of enrollment in the European Program, we may send you general marketing communications (as further described under paragraph 2.E.1.a below), pursuant to Article 6(1)(a) of the GDPR;

(iii) if you give your independent and specific consent when enrolling in the European Programme, to analyse your consumption habits and related purchasing choices and consequently to carry out personalised marketing activities, either by Venchi sending you commercial communications in line with your preferences (as better described in paragraph 2.E.1.b) below), or through your inclusion in advertising campaigns relating to Venchi carried out on other platforms (e.g. social networks) by Venchi's suppliers, duly appointed as data processors by Venchi and to whom Venchi has communicated your data in this capacity, for the purpose of you receiving targeted advertising relating to Venchi, pursuant to Article 6.1(a) of the GDPR;

(iv) if you give your independent and specific consent when enrolling in the European Programme, Venchi S.p.A., the Data Controller, may send you commercial communications in order to promote and/or advertise the products/services of Venchi's business partners (as better described in paragraph 2.E.1.c) below), pursuant to Article 6.1(a) of the GDPR.

In the event of registration in the Loyalty Programme, consent for the receipt of the Commercial Communications mentioned above is optional, You may in any case enrol in one of the two Programmes even without providing this consent and may in any event, at any subsequent time, revoke the consent previously provided, without this jeopardising the lawfulness of the processing performed based on the consent provided prior to revocation. If such consent is not provided or is revoked, you will continue to receive only emails relating to the Programme and the benefits accrued in relation to registration in the Programme.

By enrolling in the Loyalty Programme, either in-store or online, you will also create your own e-commerce account (i.e. registration on the Site), in relation to which, for further information, please refer to Section 3.A above.

You may cancel your membership of the Loyalty Programme at any time, in accordance with its terms and conditions. In this case, your personal data shall be processed by Venchi solely for the purposes related to your registration on the Site and related purchases made through the Site. In any event, you may at any time delete your personal profile created for the purpose of registering on the Site by contacting the Data Controller at privacy@venchi.com.

Deletion of your personal profile on the Site also entails, per se, your withdrawal from the Loyalty Programme and unsubscription from the service of receiving Commercial Communications, as described in more detail in paragraphs 3.E.1. and 3.E.2.

D. Use of the Contact Us and Careers sections

The user may contact the Controller through the “Contact” section available on the Website. The personal data provided by the user—such as first name, last name, and email address (mandatory for submitting the request), as well as telephone number (optional), along with the reason for the contact and any additional personal data included in the message submitted via the contact form on the Website—will be processed for the purpose of responding to the user’s request. The legal basis for the processing is the performance of a contract to which the user is a party, or the implementation of pre-contractual measures taken at the user’s request, or compliance with legal obligations, pursuant to Article 6(1)(b) and (c) of the GDPR.

The user may also contact the Controller through the Venchi Chatbot in order to request and obtain assistance, for example, to receive information regarding an order, or with respect to the products and services provided by Venchi. The personal data collected and processed through the use of this tool are exclusively those that may be contained within the interactions between the user and the Venchi Chatbot, i.e., data voluntarily provided by the user at the time of using the Venchi Chatbot for the purpose of enabling the Controller to manage the user’s request. In this respect, the Controller collects only the information entered by the user as input in order to provide a response. It should be noted that only for the management of certain requests will it be necessary to provide personal data (for example, in the case of requests relating to an order placed by the user, the user will be required to indicate the corresponding order number). In any case, the provision of personal data is not mandatory. However, the failure to provide, partial provision of, or inaccurate provision of such personal data may result in the impossibility for the Controller to provide the requested services or to process the user’s requests through the use of this tool. The user, therefore, should he/she wish to do so, will have to contact the Controller through alternative communication channels. The personal data provided will be processed for the purpose of responding to the request submitted by the user, and the legal basis for such processing is the performance of a contract to which the user is a party, or the execution of pre-contractual measures taken at the user’s request, or compliance with legal obligations, pursuant to Article 6(1)(b) and (c) GDPR.

Furthermore, the interactions between the user and the Controller through the Venchi Chatbot may also be processed in anonymized form for the purpose of improving the effectiveness of the Venchi Chatbot, so that, over time, it may provide increasingly accurate, comprehensive, and relevant responses to users’ requests.

Users may also contact Venchi by sending a job application and their CV to the email address specified in the “Careers” section of the Website. The personal data transmitted (contact data, data relating to professional qualification and other data contained in the CV) will be processed only for recruitment purposes, to enable the Data Controller to evaluate job applications from users and to contact users when necessary. Although the provision of the data is optional, the failure to provide such data will make it impossible for us to take your application into consideration. If the user provides us with special categories of data (included on the list pursuant to art. 9 of European Regulation no. 679/2016, such as data relating to health, racial or ethnic origin or trade union membership) to process your request such data will be processed pursuant to art. 9, par. 2, letter B). The legal basis of the processing of common personal data consists of the performance of precontractual measures adopted at the request of the user pursuant to art. 6, paragraph 1, letter b) of the GDPR while, for the processing of special categories of personal data, the legal basis is the need to meet obligations and exercise the specific rights of the data controller or the data subject concerning labour law and social security and social protection law, in compliance with article 9, paragraph 2, letter b) of the GDPR.

E.1. Marketing Communications (General Marketing, Profiling, and Third-Party Marketing)

When registering in one of the Programmes and simultaneously registering on the Website, users may also, at their own discretion, and therefore on an entirely optional basis, give their consent to receive Commercial Communications from Venchi and/or targeted advertising relating to Venchi, including – for the purposes of clarity – through their inclusion in advertising campaigns carried out on other platforms (e.g. social networks) that imply an analysis of their consumption habits and associated purchasing choices.

a) In this regard, users may give their express consent to receive generic commercial communications ("Generic Marketing") from Venchi, including newsletters containing informational, promotional, commercial, and advertising material related to Venchi products, invitations to events, notifications of extraordinary store openings/closings, catalogs, and event or special promotion postcards from Venchi S.p.A. The processing of personal data for the purpose of sending General Marketing communications will only take place with the user’s explicit consent, given by ticking the appropriate checkbox, pursuant to Article 6(1)(a) of the GDPR. Providing an email address for this purpose is optional; however, without it, the user’s request to subscribe to the general marketing communications service cannot be fulfilled. It should be noted that if the user has consented to receiving Generic Marketing communications and has also decided to give their telephone number when registering in the Loyalty Programme, this data will also be used for the implementation of the aforementioned Generic Marketing activities, allowing the aforementioned commercial communications to be sent via SMS. At any time, the user may request that their telephone number no longer be used for such purposes by exercising their right to delete this specific data in the manner described below.

b) The user may also provide explicit consent to profiling activities (analysis of consumption habits and purchasing choices, categorization based on homogeneous characteristics, and automated processing for such purposes) and to receipt of profiled Commercial Communications , distinct from those described in paragraph 2.E.2 below. This includes newsletters personalized according to the user’s preferences, characteristics, consumption, and purchasing habits, as well as behavioral data (for example, if a user shows interest in a specific product, we may suggest similar content in the future or provide targeted offers, in order to offer a more personalized experience aligned with the user's tastes and, for the sake of clarity, the receipt of targeted advertising, through the inclusion of the user's profile within advertising campaigns relating to Venchi carried out on other platforms (e.g. social networks) by Venchi's suppliers, duly appointed as data processors by Venchi and to whom Venchi has disclosed the user's data in this capacity, for the purpose of the user receiving targeted advertising, including on other platforms, relating to Venchi ("Profiled Marketing"). The processing of personal data for profiling purposes and the subsequent receipt of profiled commercial communications will only occur with the user’s explicit consent, given by ticking the appropriate checkbox, pursuant to Article 6(1)(a) of the GDPR. Providing an email address for this purpose is optional; however, without it, the user’s request to subscribe to personalized marketing communications cannot be fulfilled. It should be noted that if the user has consented to receiving Profiled Marketing communications and has also decided to give their telephone number when registering in the Loyalty Programme, this data will also be used for the implementation of the aforementioned Profiled Marketing activities, allowing the aforementioned commercial communications to be sent via SMS. At any time, the user may request that their telephone number no longer be used for such purposes by exercising their right to delete this specific data in the manner described below.

We would also like to clarify that, with regard to all Profiled Marketing activities, including the analysis activity inherent in said activities, you will not be required to provide new and specific data, as Venchi will pursue this further purpose, where necessary, by processing data already collected for the pursuit of other purposes deemed compatible with this purpose (including your possible registration in the Loyalty Programme).

c) The user may also give their explicit consent to the sending of commercial communications by the Data Controller that promote or advertise products/services of Venchi’s third-party commercial partners (“Third-Party Marketing”). The processing of personal data for the purpose of sending Third-Party Marketing communications will only occur with the user’s explicit consent, given by ticking the appropriate checkbox, pursuant to Article 6(1)(a) of the GDPR. Providing an email address for this purpose is optional; however, without it, the user’s request to subscribe to third-party marketing communications cannot be fulfilled. It should be noted that if the user has consented to receiving Third Party Marketing communications and has also decided to give their telephone number when registering for the Loyalty Programme, this data will also be used for the implementation of the aforementioned Third Party Marketing activities, allowing the aforementioned commercial communications to be sent via SMS. In the event that the user wishes for their telephone number to no longer be used for such purposes, they should contact the aforementioned Third Parties in the manner described in their respective privacy policies.

The user may revoke at any time any previously given consent for General Marketing, Profiling Marketing, and/or Third-Party Marketing, using one of the following methods:

by accessing their personal account area on the Website and individually revoking each of the previously provided consents for such Marketing Communications;

by unsubscribing via the unsubscribe link found at the bottom of the communications received (further instructions may be provided directly within the communications sent by the Controllers). By using this unsubscribe method, the user will simultaneously revoke all consent previously given for commercial communications, unless otherwise specified;

by sending a request to the following email addresses: privacy@venchi.com and customercare@venchi.com , indicating which specific consent(s) they wish to revoke.

In any case, the revocation will not affect the lawfulness of processing carried out by the Controller prior to such withdrawal, nor the lawfulness of processing based on any other consent not expressly revoked.

Revoking consent to receive marketing communications does not, in itself, result in the deletion of the user’s personal profile on the Website. Profile deletion must be carried out separately, following the procedures outlined in the preceding paragraph “2.A Website Registration.”

E.2. Commercial Communications in line with purchases already made

Venchi may also send you emails concerning Venchi brand products analogous to those you have already purchased, on the basis of Venchi’s legitimate interest in this regard, as set forth in art. 130, par. 4 of the Personal Data Protection Code - Italian Legislative Decree no. 196/2003 (“soft spam”). The interest of the Data Controller is linked to a company’s general interest in promoting its products and is considered legitimate provided it is aligned with the reasonable expectations of the data subjects, taking into account the relationship between them and the Data Controller.

Therefore, as this processing is based on the legitimate interest of the Data Controller pursuant to art. 6.1, letter f) of the GDPR, no explicit user consent is required for this processing. In any event, at any moment you may express your desire to no longer receive the communications mentioned above by exercising, pursuant to the law, the right to object, by sending a request in this regard to the address privacy@venchi.com or customercare@venchi.com .

Any objection to processing by the user shall not jeopardise the lawfulness of the processing carried out until that moment, nor will it have any effect on the future purchase of Venchi brand products.

3. JOINT CONTROLLERSHIP PROCESSING ACTIVITIES

The Joint Controllers, as identified in paragraph 1 of this Privacy Notice, have entered into a Joint Controllership Agreement pursuant to Article 26 of the GDPR. Through this agreement, Venchi S.p.A. e Venchi US Inc., have agreed to jointly process the data collected in the course of their respective activities. Specifically, these activities relate to the creation of a joint CRM database containing the personal data of individuals participating in the European or US Programmes, which may be accessed and managed by each Joint Controller.

The CRM database will also include, as additional categories of data subjects, (i) individuals who have subscribed solely to the newsletter, and/or (ii) individuals who, in the past, have created an account on the website without engaging in further interactions.

These joint processing activities are aimed at enabling each Joint Controller to analyze user information in connection with their participation in the respective Programs. This allows for the delivery of targeted promotions and benefits, improves the management of each Program, facilitates customer interactions, and enhances the overall user experience. Moreover, the joint processing of data makes it possible for Program members to accumulate points through purchases made in the territory of the other Program, thereby supporting a seamless cross-border loyalty experience.

Data subjects may consult a summary of the main provisions of the Joint Controllership Agreement in the annex at the end of this Privacy Notice.

The legal basis for this processing lies in the legitimate interest of the Joint Controllers in creating a shared CRM database to allow each Controller to analyze user information, optimize the Programs, offer personalized benefits, and improve the overall experience. This legitimate interest does not override the rights and freedoms of data subjects, as it is balanced by the data subjects' interest and reasonable expectation to benefit from an optimized and personalized experience within the Programs.

For the above purpose, the Joint Controllers have also jointly determined, within the framework of the agreement, the methods of data processing and have clearly and transparently defined the procedures for providing you with a timely response should you wish to exercise your rights, as provided for in Articles 15, 16, 17, 18, and 21 of the GDPR, as well as in cases of data portability under Article 20.

4. METHODS OF PROCESSING

The processing of personal data, as described in the preceding paragraphs, may be carried out using both paper-based and digital means, following organizational and logical methods strictly related to the purposes indicated.

Personal data will be processed by Venchi employees specifically trained in personal data protection, as well as by third-party providers and companies within the Venchi Group or service providers acting on behalf of the Controller as Data Processors, duly appointed pursuant to Article 28 of the GDPR.

Data subjects may request, at any time, information regarding the data processors engaged, by contacting the Controller using the contact details provided in paragraph 8 below.

5. RECIPIENTS OF PERSONAL DATA AND PROCESSING LOCATION

Your personal data may be shared with:

o Venchi Group companies;

o the personnel of Venchi and service providers for the processing and management of your orders;

o the personnel of Venchi, providers of logistics services, couriers and shippers in order to deliver the products;

o banks and providers of payment services for the management of collections and payments deriving from the performance of contracts with the user;

o the personnel of Venchi and service providers for the creation and maintenance of the Website;

o the personnel of Venchi and service providers for the management and hosting of databases;

o the personnel of Venchi and service providers for the assessment of job applications from users and to recontact them if necessary;

o legal, administrative and tax consultants, banks, companies, entities, consortia or credit protection associations;

o in the required cases, the personnel of Venchi, service providers and collaborators linked to marketing and advertising, such as social media websites, networks, advertising agencies or advertising partners.

The processing of your personal data may also be carried out by entities (whether internal or external to the Controller) whose headquarters or data processing locations are not situated in a Member State of the European Union or in another country that is party to the Agreement on the European Economic Area. In such cases, we ensure prior to the transfer that, unless otherwise permitted by law, the entity carrying out the processing guarantees an adequate level of data protection (for example, by operating in a country recognized as providing an adequate level of protection by the European Commission under an adequacy decision pursuant to Article 45 of the GDPR, by implementing appropriate safeguards pursuant to Article 46 of the GDPR—such as the signing of the European Union’s Standard Contractual Clauses (SCCs) with the data importer, pursuant to Article 46(2)(c) of the GDPR—or, alternatively, by fulfilling the obligations and implementing the protections set out in Article 49(1) of the GDPR) or that you have provided your consent to such transfer pursuant to Article 49(1)(a) of the GDPR.

Specifically, with regard to processing carried out under joint controllership, the Joint Controllers process the personal data of data subjects for the purposes described above, with the possibility of sharing and transferring such data from the European Union to the United States and vice versa.

In this context, each Joint Controller may act both as a data exporter and as a data importer, ensuring an adequate level of protection pursuant to Article 45 of the GDPR. To this end, data transfers will be governed by the Standard Contractual Clauses (SCCs) in the controller-to-controller format (Module 1), as approved by European Commission Decision (EU) 2021/914 of 4 June 2021.

In accordance with Clause 14 of the SCCs, a data protection impact assessment (DPIA Loyalty) has been conducted to assess the risks associated with cross-border data transfers and to adopt the necessary security measures.

Each Joint Controller undertakes to ensure compliance with the applicable data protection laws within its respective jurisdiction and to cooperate with Authorities and data subjects in order to respond to any inquiries related to the transfer of personal data.

In the event of regulatory changes that invalidate the SCCs or otherwise impact the legal basis for data transfers, the Joint Controllers will promptly adopt alternative safeguards to ensure continued compliance with the GDPR and to minimize any potential impact on the operation of the Programs.

6. DURATION OF PROCESSING AND PERSONAL DATA RETENTION PERIOD

User personal data will be stored only for the period necessary to achieve the purposes for which they are processed, or for any different period set forth by regulations in force. Specifically:

A. Registration on the Website and online purchases and

B. Purchases through the Website using a “Guest Profile”

With the exception of data processed in relation to registration in the Loyalty Programme, for which what is set forth in section 5.C below will apply, the personal data provided for registration on the Website and the resulting creation of a personal profile will be stored until the user requests the cancellation of the personal profile, without prejudice to any longer term required to permit the Data Controller to meet its legal obligations, accounting purposes and/or to exercise its right to defence.

The personal data provided in order to purchase a product (through registration on the Website or by means of a Guest Profile) or a service will be stored for the entire duration of the contract and for a period of 10 years subsequent to its termination.

C. Programme Registration

Personal data processed in connection with registration in the Programme will be kept for a period of time not exceeding that which is strictly necessary for the purposes for which it was collected. In particular, the data will be retained for the duration of the user's membership in the Programme and, following termination, for the ordinary limitation period of 10 years.

D. Use of the Contact Section, Careers at Venchi, and the Venchi Chatbot

The personal data provided by users who contact us through the “Contact” section or via the Venchi Chatbot will be retained for 12 months, or for a longer period if necessary to resolve the request or if required by law.

The information and personal data provided by users who submit their application/CV through the “Careers at Venchi” section will be retained for purposes beyond those for which they were initially collected, and in any case for no longer than 24 months from the date of submission.

E.1. General, Profiling, and Third-Party Marketing Communications

The personal data voluntarily entered by the user on the Website will be retained—for the purposes of General, Profiling, or Third-Party Marketing—until the withdrawal of each of the consents provided and, in any case, for no longer than 36 months from the date of the user's last explicit expression or modification of consent.

By way of example: if the user decides to withdraw consent for Profiling Marketing and Third-Party Marketing, the consent not expressly withdrawn for General Marketing communications will be considered renewed for an additional 36 months, without prejudice to the user’s right to withdraw any of the consents at any time.

The user may withdraw, at any time, any previously given consent for General Marketing, Profiling Marketing, and/or Third-Party Marketing using one of the following methods:

by accessing their personal account area on the Website, where they may individually withdraw each of the previously provided consents for such Marketing Communications;

by unsubscribing via the unsubscribe link included at the bottom of the communications received (further instructions, if any, will be provided directly within the communications sent by the Controller). By following this method of unsubscribing, the user will simultaneously revoke all consent previously given for commercial communications, unless otherwise specified;

by sending a request to privacy@venchi.com and customercare@venchi.com , specifying which previously given consent they wish to withdraw.

In any case, the withdrawal of consent will not affect the lawfulness of processing carried out by the Controllers prior to such withdrawal, nor the lawfulness of processing based on any consents not expressly withdrawn.

E.2. Commercial Communications in line with purchases already made

For the processing associated with sending commercial communications in line with purchases already made by the user, the user’s personal data will be retained until the user exercises their right to object by sending a request to privacy@venchi.com or customercare@venchi.com, through which the user may indicate that they no longer wish to receive such Marketing Communications based on past purchases.

At the end of the retention periods indicated above, your personal data will be permanently deleted, aggregated, or anonymized so that it may be used in a non-identifiable manner for statistical analysis purposes.

7. RIGHTS OF THE DATA SUBJECTS

In your capacity as “Data Subject”, at any time and when the conditions laid out by regulations are met, you may exercise the rights set forth in arts. 15 et seq. of the GDPR.

In particular, you may exercise:

- the right of access: you may request information concerning the processing of your data, as well as receive a copy of the data processed;

- the right of rectification: you may verify the accuracy of your data, as well as request their rectification or updating;

- the right to erasure: you may request, when specific conditions are met, the erasure of your data;

- the right of restriction: you may request, when specific conditions are met, the restriction of the processing of your data;

- the revocation of consent: in all cases in which the legal basis of the processing is consent, you may revoke such consent at any time, without prejudice in any event to the lawfulness of the processing performed prior to such revocation;

- right to submit a complaint to the Personal Data Protection Authority: without prejudice to any other administrative or legal action, you may submit a complaint to the Personal Data Protection Authority, according to the procedures and instructions published on the Authority’s website, available at the address https://www.garanteprivacy.it/.

8. CONTACTS

To exercise the rights set forth above or obtain additional information on processing, you may contact the Data Protection Officer (DPO) of the Data Controller directly at the email address privacy@venchi.com or send a registered letter for the attention of the Privacy Office of Venchi S.p.A., Via V. Monti 8, 20123 Milan (MI).

9. AMENDMENTS TO THE PRIVACY POLICY

This policy is valid as of the date specified in the header.

Where deemed appropriate, we may modify and/or supplement the information contained in this Privacy Notice, including—but not limited to—as a result of any subsequent amendments and/or additions to the GDPR. Any such updates and/or changes will be communicated to you in various ways via the Website (e.g., through a banner, pop-up, or push notification), or through other methods identified by each Controller, so that you may review the changes, assess them, and, if necessary, object to or cancel any services or features.

In any case, we encourage you to regularly review this Privacy Notice to check for any minor changes or improvements to interactivity, as this Notice is always available on our Website.

Date of most recent update: 19/08/2025

ESSENTIAL CONTENT OF THE JOINT CONTROLLERSHIP AGREEMENT BETWEEN VENCHI S.P.A. AND VENCHI US INC.

pursuant to Article 26(2) of Regulation (EU) 2016/679 (“GDPR”)

Venchi S.p.A. and Venchi US Inc. (hereinafter referred to as the “Joint Controllers”) have entered into a Joint Controllership Agreement (the “Agreement”) under which they jointly determine the purposes and means of the processing of personal data of customers (the “Participants” or “Data Subjects”) who take part in each V-CLUB EU/USA loyalty program (the “Programs”).

The essential provisions of the Agreement are described below:

Processing: The processing involves the creation of a joint CRM database containing the Personal Data of Data Subjects, to which each Joint Controller will have access and may view, collect, and manage. The CRM will also include the Personal Data of individuals who have subscribed exclusively to the Venchi newsletter and/or those who have, in the past, created an account on the website without engaging in any further interaction, as additional categories of Data Subjects.

Purpose of the processing: The processing activities are carried out to allow each Joint Controller, acting as an independent controller, to analyze the information relating to the Data Subjects in connection with their participation in each Program, in order to provide specific promotions and benefits; to optimize Program management, streamline customer interactions, and improve the overall Participant experience

Personal Data processed: Through the Programs and in performance of the Agreement, the Joint Controllers collect and process the following categories of personal data: (i) identifying data (first name, last name, date of birth); (ii) contact data (postal code, email address, telephone number); (iii) data relating to purchases and participation in the loyalty programs (purchase history, points earned, benefits received), collected at the time of the Data Subjects’ registration in one of the Programs and during purchases of the Controllers’ products at their points of sale (collectively, the “Personal Data”).

Method of processing: The processing may be carried out manually and through automated means designed to store, process, and transmit Personal Data. These activities will be conducted using appropriate technical and organizational measures to ensure the security, confidentiality, integrity, availability, and resilience of the information systems, as well as reasonable measures to promptly rectify or erase inaccurate data with respect to the purposes for which it is processed.

Responsibilities of the Joint Controllers: Complaints and requests to exercise rights submitted by Data Subjects will be handled by the Joint Controllers in accordance with their respective responsibilities and in compliance with the GDPR and other applicable data protection laws. Data Subjects may exercise their rights against either of the Joint Controllers pursuant to Article 26(3) of the GDPR, by contacting the competent authority and/or one of the Joint Controllers at the following addresses:

Venchi S.p.A. :

E-mail: privacy@venchi.com

Via Vincenzo Monti 8 - 20123 - Milan (MI), Italy

Venchi US Inc.:

E-mail: venchi-usa@venchi.com

16 W 36th St. New York, NY 10018, USA

Transfer of Personal Data: For the purposes of the Agreement, the Personal Data of the Data Subjects will be shared and transferred between the European Union and the United States, and vice versa. The Joint Controllers adopt the Standard Contractual Clauses issued by the European Commission to ensure the protection of the rights and freedoms of Data Subjects in the context of the transfer of Personal Data;

Technical and Organizational Security Measures: The Joint Controllers ensure the security of Personal Data, as required by Article 32 of the GDPR, taking into account the nature of the processing and the information in their possession. The measures must ensure the confidentiality, integrity, availability, and resilience of systems and services processing the data, enabling prompt restoration in the event of physical or technical incidents. Any updates to the security measures, following regulatory changes or technological advancements, must be implemented after a risk assessment. Furthermore, the Joint Controllers must establish procedures to regularly verify the effectiveness of the security measures.

Data Retention: Personal Data will be processed for the duration of each Data Subject’s participation in the relevant Programs

Confidentiality: The Joint Controllers also undertake to treat all exchanged materials with the utmost confidentiality and to use such information solely for the purposes set out in the Agreement and/or for compliance with legal obligations or instructions issued by the competent Authorities.