Last updated: 13 June 2019

Privacy Policy of the ARGeo application

Fimesp s.r.l. - innovative startup, with registered office in Vicolo Calusca 10/C, 20123 - Milan,
Italy, ("Fimesp" or "we" or "our"), as data controller, collects and processes Personal Data in
accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"),
Legislative Decree 30 June 2003, No. 196 ("Privacy Code"), Legislative Decree 10 August 2018,
No. 101 adapting the Privacy Code to the GDPR ("Implementing Decree"), the GDPR, the Privacy
Code and the Implementing Decree all together are referred to as "Italian Privacy Legislation", in
accordance with the privacy principles and rights of the data subjects.

In accordance with articles 13 and 14 of the GDPR, Fimesp informs the user on how it collects,
processes and uses personal data provided by him/her at the time of registration on the ARGeo
application and/or during the use of said application and of the services provided through it as
described in the applicable Terms and Conditions

This Privacy Policy does not cover any other information that is published and provided to the user,
collected or used by third parties through their own applications integrated into the ARGeo
application, if those third parties do not act on our behalf.

Please read this Privacy Policy carefully before registering and using the ARGeo application.

INDEX

1. Definitions

1.1 User
1.2 Sellers
1.3 Data Subject
1.4 Personal data
1.5 Usage Data
1.6 Data Controller
1.7 Data Processor
1.8 Third Parties
1.9 ARGeo application
1.10 Services or related Services
1.11 Elements of augmented Reality
1.12 European Union (or EU)
1.13 Cookies
2. Types of Personal Data collected
3. Purpose and legal bases of the processing
4. Nature of the provision of Personal Data and consequences in case of failure to provide the
data
5. Methods of processing
6. Retention Period
7. Communication and international transfer of Personal Data
7.1 Service Providers
7.2 Third parties in accordance with a legal obligation or to establish, exercise or defend a right in court
7.3 Third parties in case of corporate transactions
8. User Rights
9. Contacts of the Data Controller
10. Response to “Do Not Track” requests
11. Changes to this Privacy Policy

1. Definitions

1.1 User: the natural person accessing the ARGeo application by registering in the name and on
behalf of himself/herself or of another natural or legal person and who uses the ARGeo application
and related Services.
1.2 Sellers: owners or representatives of affiliated business, even if they are registered as Users.
1.3 Data Subject: a natural person identified or identifiable through personal data and coinciding
with the User with respect to the use of the ARGeo application and related Services.
1.4 Personal Data: any information relating to an identified or identifiable natural person ("Data
Subject"); an identifiable natural person is one who can be identified, directly or indirectly, by
reference to an identifier such as a name, an identification number, location data, an online
identifier or one or more factors specific to his/her physical, physiological, genetic, psychic,
economic, cultural or social identity.
1.5 Usage Data: Personal Data collected automatically through the ARGeo application, including
through third-party applications integrated within the same, namely: the IP addresses of the User's
device or the domain names of the devices used by the User accessing the ARGeo application, the
URI (Uniform Resource Identifier) addresses, the time of the request, the method used to forward
the request to the server, the size of the file obtained in response, the numerical code indicating the
status of the response from the server (successful, error, etc.) the country of origin, the
characteristics of the browser and operating system used by the visitor, the various time
connotations of the visit (for example, the time spent on each page) and details of the route followed
within the ARGeo application, with particular reference to the sequence of pages viewed, the
parameters relating to the operating system and computer environment of the User.
1.6 Data Controller: the natural or legal person, public authority, service or other body which,
alone or together with others, determines the purposes and means of the processing of Personal
Data.
1.7 Data Processor: the natural or legal person, public authority, service or other body that
processes Personal Data on behalf of the Data Controller.
1.8 Third Parties: natural and/or legal persons who do not have the status of User.
1.9 ARGeo application: the hardware or software tool through which the User's Personal Data are
collected and processed.
1.10 Services or related Services: Services provided by Fimesp in accordance with clause 6 of the
Terms and Conditions applicable to the ARGeo application Terms and Conditions
Conditions].
1.11 Elements of augmented Reality: virtual objects placed in the map through augmented Reality
tools embedded in the ARGeo application and corresponding to the products being offered.
1.12 European Union (or EU): unless otherwise specified, any reference in this document to the
European Union shall be deemed to extend to all current Member States of the European Union and
the European Economic Area.
1.13 Cookies: small portion of data stored within the User's device and released by Fimesp or by
Third Parties through the ARGeo application Cookies Policy.

2. Types of Personal Data collected
Fimesp collects and processes Personal Data provided by the User when registering to the ARGeo
application and when using the Services:
Personal details: first and last name, gender (male/female), date of birth;
Contact details: email address and telephone number.
Usage Data: Personal Data as defined in clause 1.5.
Geolocation data: geographical position of the User's device through the granting of accurate
(continuous) Geolocation Permit, i.e. the User's authorisation to Fimesp to access the accurate
geographical position of the User's device.
Camera Permission: User's authorization to Fimesp to access the camera or acquire images and
videos from the device.
System log and maintenance: files that record the User's interactions within the ARGeo
application and that can also contain Personal Data, such as the IP address of the User's device.
If the User provides Third Party Personal Data, the User undertakes to ensure the corresponding
communication to Fimesp and the subsequent processing of such data in compliance with this
Privacy Policy and the Italian Privacy Legislation, in such a way that before communicating Third
Party Personal Data to Fimesp, the User (i) informs the Third Party about the processing of their
Personal Data, (ii) provides this Privacy Policy to the Third Party and (iii) obtains the relative
consent to communicate the Third Party Personal Data to Fimesp. In such circumstances, Fimesp
processes Third Party Personal Data only to allow the User to use the ARGeo application and
related Services on the basis of the User's requests.

3. Purpose and legal bases of the processing



Purposes Legal bases
A. Fimesp processes Personal Data,
including those manifestly made public by the
User to allow the User to register on the ARGeo
application and use it together with the related
Services.
 The processing is necessary for the execution
of pre-contractual measures undertaken upon
User's request and for the performance of a
contract of which the Data Subject is a party.
 The processing concerns Personal Data made
manifestly public by the Data Subject.
B. Fimesp processes Users' Personal Data to
collect, use and share information about their
geographical location in order to provide location-
based services, such as capturing Elements of
Augmented Reality on the map that can be viewed
through the application ( Geolocation).
 The User's conset.
C. Fimesp processes User's Personal Data to
ensure that the ARGeo application is up to date
and meets the User's necessities, to analyse,
review and improve this application and the
services offered through it, to provide the User
with an facilitated user-browsing experience, to
ensure compliance with the Terms and
Conditions of the ARGeo application, for
the security of the application and its users and
for the protection of the rights and/or resources of
Fimesp.
 Processing is necessary for Fimesp's
legitimate interest in protecting and
improving its business, assets and rights; or
 The processing is necessary for Fimesp to
comply with legal obligations such as the
obligation to ensure the security of
information under applicable data protection
laws.
D. Fimesp processes User's Personal Data both for
the promotion of the ARGeo application and
related Services and for marketing purposes
through automated tools (e.g. User profile on the
ARGeo application, email, SMS, Push
Notifications), such as: to send marketing
communications to the User, for example
newsletters and promotional information relating
to the ARGeo application and Services, to send
invitations to events of Fimesp and/or Sellers
and/or Third Parties (Marketing).
 The User's conset.
E. Fimesp processes User's Personal Data
automatically through the use of algorithms
developed and owned by Fimesp to track and
analyse the choices of the User during the use of
the ARGeo application and Services, allowing to
understand what are his/her consumption
preferences and the elements of potential interest
present on the ARGeo application, such as the
methods and place where the coupons are
redeemed (Profiling).
 The User's conset.
F. Fimesp processes User's Personal Data to send
notifications to the User if new offers are inserted
in line with the preferences expressed and the
elements of potential interest or if the same offers
are located nearby the User. The User can modify,
reduce the intensity and frequency and deactivate
the notifications at any time, through a special
interface within the ARGeo application
(Push-notification/profiled marketing).
 The User's conset.
G. Fimesp processes User's Personal Data to
monitor and analyse, by means of automated
tools, the traffic data used to keep track of the
User's behaviour, being able to create
databases using all or some of the User's Personal
Data and/or using second-level data derived
from the statistical processing of the data
provided or from the creation of User
profiles (Statistics/market analysis).
 The User's conset.
H. Fimesp processes User's Personal Data,
including data derived from statistical analysis, in
order to communicate them to the Sellers and to
Third Parties for their marketing purposes.
 The User's conset.
I. Fimesp processes User's Personal Data to
comply with legal obligations, laws and
regulations, and to act before judicial and
administrative authorities.
 The processing is necessary to comply with a
legal obligation to which Fimesp is subject.
 Processing is necessary for the establishment,
exercise or defence of rights in judicial
proceedings or whenever courts are acting in
their judicial capacity.

4. Nature of the provision of Personal Data and consequences in case of failure to provide the data
With regard to Personal Data whose processing is essential for compliance with laws and
regulations or to execute the contract in place between Fimesp and the User (please refer to fields
A, C and I of clause 3), the provision of User's Personal Data is mandatory, therefore failure to do
so would make it impossible for Fimesp to provide the ARGeo application and the related Services
to the User. For Personal Data whose processing is aimed at marketing activities, profiling, push-
notifications/profiled marketing, statistics/market analysis, communication to Third Parties for their
marketing purposes (please refer to fields C, E, F, G and H of clause 3), the provision of Personal
Data is voluntary and failure to do so will not prevent the User from using the ARGeo application.
Finally, the provision of geolocation data by the User through the accurate (continuous)
Geolocation Permit is voluntary (please refer to field B of clause 3) and may be revoked at any time
by using the ARGeo application interface, or by contacting Fimesp at the addresses indicated in
clause 9, although such withdrawal may make it impossible to use one or more of the ARGeo
application functions.

5. Methods of processing
Fimesp processes the User's Personal Data by means of electronic and/or telematics as well as
through non-electronic means, in an organised manner and with logics strictly related to the
purposes indicated in this Privacy Policy and in compliance with the Italian Privacy Legislation.
In particular, given the main functionality of the ARGeo application, Fimesp processes the User's
Personal Data through accurate and continuous geolocation systems. This means that if the User has
given his/her consent, the ARGeo application may collect, use and share data relating to the
geographical location of the User, in order to provide services based on the location itself. The
technology used by the ARGeo application gives each User an approximate position with respect to
existing Elements of augmented Reality in the surroundings. If the User is in the proximity of an
element of interest, the ARGeo application may send a notification regarding the existence of the
element. The continuous geolocation function can always be modified and deactivated by acting on
the relevant command available in the settings of the device used by the User. The User, however,
acknowledges and accepts that disabling this function may make it impossible to use one or more
parts of the ARGeo application.
During the processing of the User's Personal Data, Fimesp adopts appropriate security measures to
prevent unauthorised or unlawful access, disclosure, modification or destruction of Personal Data.

6. Retention Period
Fimesp retains User's Personal Data only for the time strictly necessary to allow the use of the
ARGeo application and for the other purposes for which they were collected. Fimesp will also
retain Personal Data relating to an inactive User's account, until the User deletes the account or
requests its deletion and in any case for a maximum of 12 months after inactivity. Once the User
has deleted his/her account or requested its deletion, Fimesp will proceed to delete the account
within 30 days from the request.
For marketing and profiling purposes, Personal Data are retained for the time strictly necessary to
pursue these purposes within the limits set by the Italian Privacy Legislation, in particular for no
more than 24 months for profiled marketing purposes and 12 months for profiling. In any case, if
the processing of User Personal Data is based on User's consent, if the User subsequently withdraws
his or her consent and there is no further legal basis for continuing to process Personal Data, Fimesp
will delete such Personal Data. Fimesp reserves the right to retain any information, including the
User's Personal Data, necessary to demonstrate that it has complied with the User's request of
consent withdrawal.
In any event, Fimesp will retain User Personal Data necessary to comply with a legal obligation or
to exercise our rights of defence in the context of legal proceedings. Please note that Personal Data
contained in contracts, communications and business letters may be subject to retention periods
established by law, which may provide for a retention period of up to 10 years, based on the
ordinary statute of limitations in force in Italy.

7. Communication and international transfer of Personal Data
User's Personal Data may be accessed by Fimesp personnel duly authorised to process Personal
Data. Furthermore, while making the ARGeo application available and providing related Services,
Fimesp may communicate the User's Personal Data to external subjects such as:
7.1 Service providers. In order for the User to register, access the ARGeo application and use the
Services through it, Fimesp may share the User's Personal Data with its service providers who will
act as Data Processors on the basis of Fimesp's instructions. By way of example, such service
providers may include communication agencies, technical service providers, IT companies,
companies that manage or maintain the IT infrastructure on which the ARGeo application is based
(e.g. Aruba S.p.a.).
7.2 Third parties in accordance with a legal obligation or to establish, exercise or defend a
right in court. Fimesp may disclose the Users' Personal Data to institutions, law enforcement
agencies, judicial authorities, administrative authorities or public security authorities, in the context
of a judicial or administrative procedure, or in order to comply with a legal obligation or protect its
rights.
7.3 Third parties in case of corporate transactions. The communication of the User's Personal
Data may also occur in the presence of events such as mergers, acquisitions, sales of companies (or
its assets) or other extraordinary operations in which Fimesp may have to share information with
potential buyers or counterparties and their consultants.
Some of the above parties may be established outside the territory of the European Union and the
European Economic Area in countries that do not guarantee an adequate level of protection of
Personal Data (e.g. the United States of America). In such circumstances, Fimesp will adopt the
appropriate safeguards to ensure the protection of the User's Personal Data in accordance with
article 46 of the GDPR (e.g. adherence to the US-EU Privacy Shield scheme, Standard Contractual
Clauses adopted by decision of the European Commission, currently decision 2010/87/EU of 5
February 2010). Under no circumstances the User's Personal Data will be disseminated.

8. User Rights
The User may at any time and at no cost request information on this Privacy Policy, the ARGeo
application and related Services by contacting Fimesp at the contact details indicated in clause 9.
Likewise, the User may request an updated list of our Data Processors and exercise his/her privacy
rights referred to in Articles 15 et seq. GDPR as specified below:
(i) Right of access: Under certain circumstances, the User has the right to obtain from us
confirmation as to whether or not Personal Data relating to him/her exist and, if so, request access
to such Personal Data. Access information includes, among others, the purposes of the processing,
the categories of Personal Data processed, the recipients or categories of recipients to whom
Personal Data has been or will be disclosed, the sources of Personal Data, the data retention periods
and the technical security measures adopted to safeguard Personal Data in the event of transfer
outside the European Economic Area. However, this is not an absolute right and the interests of
other people may limit the right of access.
The User has the right to request a copy of the Personal Data. If the Users requests additional
copies, we may charge him/her a reasonable fee taking into account the administrative costs
incurred.
(ii) Right to rectification: under certain circumstances, the User has the right to obtain from us the
rectification (i.e. correction) of inaccurate Personal Data concerning him/her. Depending on the
purpose of the processing, the User has the right to obtain the integration of incomplete Personal
Data, also by means of an additional declaration.
(iii) Right to erasure (right to be forgotten): under certain circumstances, the User has the right to
obtain from us the erasure of Personal Data relating to him/her. In such cases, we will take steps to
delete, or make permanently unintelligible, such Personal Data.
(iv) Right to restriction of processing: under certain circumstances, the User has the right to
obtain from Fimesp the restriction of the processing of his/her Personal Data. In such cases, the
Data will be marked and may be processed by us only for certain purposes.
(v) Right to data portability: under certain circumstances, the User has the right to receive in a
structured, commonly used and machine-readable format, commonly used and readable by
automatic device, Personal Data about him/her that he/she has provided and the right to transmit
such data to another entity.
(vi) Right to object: under certain circumstances, as provided for by applicable law, the User has
the right to object, at any time, for reasons related to his/her particular situation, to the processing of
his/her Personal Data by us and we may be required to no longer process his/her Personal Data. If
the User has the right to object and if he/she exercises this right, his/her Personal Data will no
longer be processed by us for such purposes unless Fimesp proves legitimate compelling reasons
under the GDPR. If the data are processed for marketing purposes, the User has the right to object at
any time to the processing for such purposes, including profiling to the extent that it is related to
direct marketing. The User can exercise his/her right to object by contacting us as indicated in
clause 9. This is not an absolute right and does not apply in certain situations, for example when the
processing is necessary for compliance with the applicable law of the European Union or the
Member States, or to defend a right in court.
(vii) Automated decision making: The User has the right not to be subject to a decision based
solely on automated processing that produces legal effects that affects him/her or affects his/her
person. The above prohibition does not apply if the User consents to a decision based on automated
processing of his/her Personal Data or such a decision is needed for the conclusion or execution of a
contract between the User and Fimesp, or if the decision is authorised by European Union or Italian
law..
(viii) Withdrawal of consent: The User also has the right to withdraw his/her consent when given
with regard to certain types of Personal Data processing activities, also using the appropriate
contact section within the ARGeo application in addition to sending the notice of withdrawal to the
email address specified in clause 9. Such withdrawal shall not affect the lawfulness of the
processing based on consent prior to the withdrawal.
Finally, the User has the right to lodge a complaint to the National Data Protection Authority (the
"Garante").
We inform the User that under certain circumstances pursuant to Article 2-undecies of the Privacy
Code, as introduced by the Implementing Decree, the exercise of privacy rights may be delayed,
limited or excluded. In this case, the Company will provide the User without delay with a reasoned
statement and the User may still request that the Garante ascertains that the delay, limitation and
exclusion referred to above are based on legitimate reasons.

9. Contacts of the Data Controller
Fimesp s.r.l. - innovative startup
Vicolo Calusca 10/C
20123 - Milano
Italy
Email address: info@fimesp.com

10. Response to “Do Not Track” requests
This application does not support "Do Not Track" requests. To find out if any third party services
support them, the User is encouraged to consult their respective privacy policy.

11. Changes to this privacy policy
Fimesp reserves the right to amend this Privacy Policy at any time by informing the User:
a) on the page dedicated to it on the website https://theargeo.com; or
b) on the ARGeo application if possible; or
c) by sending a notification to the Users through one of their contact details, if technically and
legally feasible.
Please therefore regularly consult the Privacy Policy available on the website https://theargeo.com,
referring to the date of the last change indicated at the bottom.
If the changes involve processing activities whose legal basis is consent, Fimesp will collect the
User's consent again, if necessary.

CONSENT FORM TO BE IMPLEMENTED FOR THE PURPOSE OF REGISTRATION
ON THE APPLICATION
□ I have understood the Privacy Policy regarding the processing of my Personal Data for
the purposes of and through the ARGeo application and Services provided through it and

1. For the collection, use, sharing of information relating to my geographical position, in order
to receive services based on the location itself, such as the acquisition of Elements of
augmented Reality featured on the map viewable through the application ( Geolocation).

2. For promotional and marketing activities in relation to the ARGeo application and related
Services, including the sending of marketing and promotional communications through
automated tools (e.g. User profile on ARGeo, email, newsletter, SMS, push notifications)
relating to the ARGeo application and Services, including invitations to events of Fimesp
and/or Sellers and/or Third Parties.

3. For the use of algorithms to track and analyse my choices during the use of the ARGeo
application and Services, allowing you to understand what are my consumption preferences
and the elements of potential interest on the application ARGeo, such as the methods and
place to redeem the coupons.

4. To receive notifications if new offers are added in line with the expressed preferences and
elements of potential interest or if the same offers are in my proximity.

5. To monitor and analyse, by means of automated tools, the traffic data used to keep track of
my behaviour, to create databases using all or some of my Personal Data and/or using

second-level data derived from the statistical processing of the data provided or from the
creation of my User profile.

6. For the communication to Sellers and Third parties of my Personal Data, including Data
derived from statistical and profile analysis, for marketing purposes of such data recipients.