PRIVACY NOTICE
pursuant to Articles 13 and 14 of EU Regulation 2016/679 (“GDPR”)

Pursuant to and for the purposes of the provisions of the GDPR, we hereby inform you that your personal data will be processed using both electronic and manual tools, innovative technologies and other relevant software.
This notice, which was drawn up in accordance with the principle of transparency and all requirements of the GDPR, is divided into individual sections, each of which deals with a specific topic in order to make it quicker, easier and more straightforward to read and understand (hereinafter the “Notice”). 

Data Controller
The Data Controller is Beintoo S.p.A., with registered office in Via Paleocapa no. 3, Milan (“Data Controller”).

Data Protection Officer
The Data Controller has appointed a Data Protection Officer (hereinafter “DPO”) with registered office in Viale Europa no. 48 – 20093 Cologno Monzese (MI).
Pursuant to Article 38, par. 4 of the GDPR, you may contact the DPO regarding any matters relating to the processing of personal data and the exercise of your rights under the GDPR using the following email address infoprivacy.dpo@mediaset.it

Purposes of processing
Personal data will be processed for the following purposes:

The provision of data is necessary for the purposes set out in points (a), (b), (c) and (e), and failure to provide such data, or the provision of incomplete or inaccurate data, may make it impossible to achieve the aforementioned purposes; whereas it is optional for the purposes set out in point (d). You may withdraw your consent, including partially, without this affecting the lawfulness of the processing based on your consent prior to withdrawal, in accordance with the procedures set out in the section ‘Withdrawal of consent’.

Legal basis for processing
The legal basis for the processing is:

• the implementation of pre-contractual measures, taken at the data subject’s request, and/or the contract entered into with the Data Controller for the purposes referred to in point (a);
• compliance with legal obligations for the purposes set out in point c);
• the consent you have given, for the purposes set out in point (d);
• the legitimate interest pursued by the Data Controller, for the purposes set out in points (b) and (e).

Disclosure of data
Personal data will be processed exclusively by authorised persons (Art. 29 of the GDPR) and by any third parties designated as Data Processors (Art. 28 of the GDPR) or who act as independent Data Controllers (e.g.commercial information companies; credit institutions responsible for the payment of fees; third-party companies that may become assignees, including through ‘factoring’, of receivables arising from the agreement between the parties), in order to carry out all processing activities necessary to achieve the purposes detailed in this Notice. The data may also be disclosed to public bodies or to judicial and law enforcement authorities, where required by law or to prevent or suppress the commission of a criminal offence.

Retention period
All data collected will be processed for the period necessary to achieve the purposes set out in this Notice and, in particular:

• 10 years from the end of the relationship for the purposes referred to in points (a) and (b);
• for the period necessary to fulfil the legal obligation for the purposes referred to in point c);
• until consent is withdrawn for the purposes referred to in point d);
• 10 years from the date of the dispute or the date on which a judgment becomes final for the purposes referred to in point (e).

Withdrawal of consent
You have the right to withdraw the consent given to the Data Controller at any time, in whole and/or in part, without this affecting the lawfulness of the processing based on the consent given prior to withdrawal.

To review and/or withdraw your consent, you may contact the Data Controller at any time at the address indicated in the section ‘Rights of data subjects’.

Territorial scope of processing
Personal data will be processed by the Data Controller within the territory of the European Union. Should it become necessary, for technical and/or operational reasons, to engage parties located outside the European Union, we hereby inform you that any such transfer will take place in compliance with the rights and safeguards provided for by current legislation. Therefore, the transfer of personal data to such parties will be governed in accordance with the provisions of Chapter V of the GDPR. In any event, should personal data have been processed outside the European Union, you may request further details from the Data Controller, including evidence of the specific safeguards adopted.

Rights of data subjects
We would like to remind you that you may exercise the rights set out in Articles 15 et seq. of the GDPR and, in particular, request:

• confirmation as to whether personal data concerning you is being processed and obtain access to the data and the following information: the purposes of the processing, the categories of personal data, the recipients and/or categories of recipients to whom the data has been and/or will be disclosed, and the retention period;
• the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data, including through a supplementary statement;
• the erasure of personal data, in the cases provided for by the GDPR;
• the restriction of processing, in the cases provided for by the GDPR;
• the portability of data concerning you and/or the direct transfer of data to another data controller, where the processing is based on consent or is necessary for the performance of a contract and is carried out by automated means;
• the right to object to processing at any time, on grounds relating to your particular situation, in the cases provided for by the GDPR.

You may exercise your rights by writing to the following email address infoprivacy@mediaset.it. In any event, should you consider that the processing of your data infringes applicable data protection legislation, we inform you that you may, at any time, lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority), pursuant to Article 77 of the GDPR.

Last updated: July 2026