Thermowatt S.p.A. (hereinafter also “Thermowatt”), with registered offices in Via San Giovanni Battista, 21, 60011 Arcevia (AN), Italy, as Data Controller and Data Holder (hereinafter also the "Company"), in the person of the Legal Representative, provides you with the following information on the processing of your personal data and of the data generated by the connected product in connection with the provision of the related services.

Categories of personal data

The Data Controller will process your personal data. Below is an exemplifying and non-exhaustive list of the categories of data that will be subject to such processing:

• name, surname;
• e-mail address, country, telephone number;
• gateway serial number and other information related to the product associated with you;
• data relating to and/or derived from the operation of the equipment;
• characteristics of the inhabited building (size of the house, number of rooms type of heating) and the family unit;
• data of your choice transmitted by social platforms in case you make use of the social log-in function.

In particular, through the Thermowatt Apps (hereinafter “Apps”) and/or the WebApps (hereinafter “WebApps”) the following information will be processed by the Data Controller:

• the IP address or ID of your device;
• the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the computer environment of your device;
• the model and brand of the appliance managed through the App/WebApp, as well as how the system is managed;
• data relative to the physical quantities (for example, temperature) measured by the sensors of the appliance;
• consumption data;
• data related to the status and parameter settings of the functions performed by the appliance;
• information on the interactions carried out by you with the App/WebApp, including commands for the activation of the appliance;
• e-mail addresses or telephone numbers used to send notifications following events;
• geolocation of the device on which the application is installed where this function is enabled, as further described in the Google Privacy Policy at https://www.google.com/policies/privacy/;
• location of the appliance communicated by the Internet connection device in the initial configuration.

The Company, in fulfilment of the contract stipulated with you, will also collect information regarding the product installed (including, but not limited to, advanced technical details, heating settings and operation, etc.).

Through use of the connected product and the related services provided through the App/WebApp, non-personal data may also be generated relating to:

• Status variables (including heating cycles and duration, water withdrawals, antibacterial function activation, Wi-Fi signal strength, …).

The data generated by the connected product in your possession, and shared with Thermowatt S.p.A. through the App and WebApp, as well as the data generated by the use of the same App and WebApp (hereinafter, also "readily available data") as services related to the connected product, will be collected by Thermowatt S.p.A., as Data Holder ("Data Holder") at an estimated average volume of 2MB/month, and at a frequency continuously once per hour.

Readily available data may be used by the Company to pursue the purposes set out in this notice as well as in the Service Terms and Conditions of the App and WebApp.

App Required Authorizations

Upon installation of the App, you will be asked for authorization to access to the location (based on GPS and network).

In this moment, some authorizations are also issued to allow the operation of the app in relation to the operating system running on the mobile device.

The details of these authorizations may change depending on system and app updates and are always available, upon download in the section dedicated to the app information in the mobile app store and in the settings area of the device itself.

Purposes and legal basis of the Data Processing

The Company will process the above-mentioned personal data, according to the principles of necessity, fairness, lawfulness and transparency as dictated by the GDPR, for the following purposes:

• 1)   Creation of an account on the App/WebApp;
• 2)   Provision of remote control and/or remote diagnosis services;
• 3)   If necessary, in order to ascertain, exercise or defend the rights of the Data Controller in judicial and/or extra-judicial proceedings.

The purposes listed in points 1) and 2) find their legal basis in the execution of the contract to which you are a party.

Instead, the processing activities described in point 3) are conducted in accordance with a legitimate interest of the Data Controller: in particular, the interest to improve its service and to protect its rights in judicial and/or extrajudicial proceedings.

• 4)   Direct marketing: sending of promotional and commercial communications relating to the Company's services/products/events (with automated contact methods such as e-mail or SMS and with traditional contact methods such as telephone calls with operator and traditional mail), and/or carrying out market surveys, customer satisfaction activities and statistical analysis;
• 5)   Profiling: Analysis of your preferences, habits, interests, in order to send you personalized commercial offers that suit your needs (by means of tracking tools, e.g. 'pixels').

The processing of your personal data for the above-mentioned purposes (listed in points 4) and 5)) will be carried out only upon your specific and unambiguous consent, expressed for each purpose.

In relation to the specific authorizations requested upon installing the App, the following processing purposes are specified:

• PositionAccess to this data is necessary in order to provide the service;
• Storage spaceThis access is necessary for the sole purpose of installing the App on the mobile device;
• Other

Access to the described functionalities is only necessary for the proper technical functioning of the App.

Permitted use of non-personal data

Without prejudice to the provisions on personal data, the Company, as Data Holder, undertakes to use non-personal data only for the following purposes agreed with you:

• a)   performance of a contract with the User or activities related to that contract (e.g. generation and provision of reports or analyses);
• b)   to provide assistance, warranties or similar activities, or to assess claims of the User, the Data Holder or third parties (e.g. regarding Product malfunctions) relating to the Product or the Service;
• c)   to monitor and maintain the functioning, safety and protection of the Product or Service and to ensure quality control;
• d)   to improve the functioning of any related product or service offered by the Data Holder;
• e)   development of new products or services by the Data Holder, or by third parties acting on behalf of the Data Holder;
• f)   to aggregate these Data with other data or create derived data, for any legitimate purpose.

It is understood that, pursuant to Articles 4.12 and 6.2(e) of Regulation (EU) 2023/2854, the data will not be used to gather information about your economic situation, your goods and your production methods, or your use of the Product or Service in any other way that could undermine your commercial position in the markets where the User is active.

Data retention

The Data controller, in relation to the purposes of creation of an account, will process your personal data until your unsubscription request.

With regard to the processing activities related to the provision of remote control and/or remote diagnosis services, the Data Controller will process your personal data (related to equipment operation and personal data derivable on the basis of the equipment operation) until the end of the contract and, thereafter, for two years.

The data processing related to the purposes of direct marketing and profiling activities will be carried out until your withdrawal of consent.

The data related to the direct marketing activities will be retained for 24 months; the data related to the profiling activities, instead, will be retained for 12 months.

These retention periods shall begin to run from the time the personal data are collected.

If the Data Controller exercises or defends its rights in judicial and/or extra-judicial proceedings, your data will be processed for the entire duration of the dispute, until the terms of the appeal have been exhausted.

Readily available data of a non-personal nature generated by the use of the connected product in your possession, as well as by the related services provided by the Company in relation to the connected product, will be retained in the cloud, from the date the product is registered, consistent with the foregoing, for a maximum of 2 years. In the event of your request to unsubscribe from related services offered via the App/WebApp, your data will be deleted.

Once the above-mentioned retention terms have expired, the Data will be destroyed, deleted, or made anonymous, compatibly with the technical procedures for deletion and backup and for the accountability needs of the Data Controller.

In particular, following your possible withdrawal of consent, the Company will continue to process your Data in order to be able to have evidence that you will no longer want to receive marketing information and promotional material.

Provision of Data

In order to create an account on the Platform, the provision of your personal data is optional, however within the online registration form you will find fields marked with an asterisk: without this information it will not be possible for the Data Controller to create such account and, therefore, to allow you to access the remote control and/or remote diagnosis services.

In relation to the fields not marked with an asterisk, your refusal to provide the data will in no way affect the creation of the account and the access to the service requested.

Regarding direct marketing and profiling activities, the provision of your data is fully discretional: the Data Controller will process your personal data only upon your express and unambiguous consent.

You may withdraw the consent given at any time: such withdrawal shall not affect the lawfulness of the processing based on consent before such withdrawal.

Data communication

Your Personal Data may be communicated to external parties operating as independent data controllers, for example: authorities and supervisory bodies and, in general, public or private parties entitled to request and/or access to such Data (e.g. banks, insurance companies).

Furthermore, your personal data may be communicated, subject to your express authorisation, which may also be provided when subscribing to an additional service, to third parties who may provide the aforementioned service also through their own instruments.

These third parties would be considered as independent data controller of your personal data.

If the appliance for which you are activating the remote control and remote diagnosis service has not been directly purchased by you, but is already present in the house because it has been installed by the owner, your personal data may be communicated to this very owner also by means of special digital interfaces (API).

This owner is considered to be an independent data controller and will therefore provide you with his own privacy notice regarding the processing of your personal data, which he will carry out for his own purposes.

Your Data may also be processed by external parties designated as Data Processors (pursuant to art. 28 of the GDPR), who carry out specific processing activities on behalf of the Data Controller, such as, by way of example:

• Technical assistance centres
• Database providers;
• Call-centre services providers;
• Domestic consulting firms;
• Companies that provide management and/or maintenance services for the Company's mobile and desktop applications;
• Parties that provide services for the management of the information system and telecommunications networks, including e-mail;
• Marketing and market research companies;
• Public relation companies.

For the provision of its services, Thermowatt is assisted at national and international level by individual local entities and commercial organizations operating locally.

These local entities and commercial organizations process personal data on behalf of Thermowatt and therefore qualify as Data Processors pursuant to art. 28 of the GDPR.

Your personal data will not be disseminated.

Readily available data of a non-personal nature may be shared by the Company with third parties for:

• Assisting the Data Holder in achieving the permitted purposes of use;
• Achieving, in cooperation with the Data Holder or through special purpose entities, the permitted purposes of use.

Transfer of personal data to countries outside the European Union

The Data might be processed by Data Processors that are based also in non-EU countries, whose level of data protection has been considered adequate by the European Commission pursuant to art. 45 of the GDPR.

The transfer of your personal data may also be carried out following the signing of Standard Contractual Clauses as provided for by art. 46(2)(c) of the GDPR.

A copy of the guarantees may be requested by contacting the Data Controller at the e-mail address info.connectivity@thermowatt.com.

Personnel authorized to process personal data

The data may be processed by employees and/or collaborators of the Data Controller and/or the Data Processor assigned to the fulfilment of the above-mentioned purposes, who have been expressly authorised to the processing and have received adequate operating instructions.

Processing Methods

The Processing activities may include, besides data collection, also data registration, storage, amendment, communication, cancellation, circulation, etc. and will be carried out both through hardcopies and through digital, informatic and telematic tools, and with suitable tools in order to guarantee the security and confidentiality of the data.

Within the limits of the above-mentioned specific purposes, data processing is carried out through manual, digital and telematic tools.

The Data Controller adopts organization and technical procedures to guarantee personal data security and confidentiality.

Rights of the data subjects

By contacting the Privacy Office by ordinary mail sent to the address Via San Giovanni Battista, 21, 60011 Arcevia (AN), Italy or by e-mail at info.connectivity@thermowatt.com, you can ask the Company, as Data Controller, for access to your data, their rectification, deletion, or the restriction of their processing in the cases provided for by Article 18 GDPR, as well as the opposition to the processing, for reasons related to their particular situation, in the hypothesis of legitimate interest of the Data Controller.

Furthermore, the data subjects, in the event that the processing is based on consent or contract and is carried out by automated means, have the right to receive the data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit them to another data controller without hindrance.

Data subjects have the right to withdraw at any time the consent given for marketing and/or profiling purposes. This is without prejudice to the possibility for the data subject who prefers to be contacted exclusively through traditional methods, to oppose the processing for marketing purposes only in relation to the receipt of communications through automated means.

Data subjects are entitled to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement occurred, and to lodge a complaint for breach of the provisions of Chapter II of Regulation (EU) 2023/2854 to the competent authority designated pursuant to Article 37 of the same Regulation (EU) 2023/2854.

Data subjects may also modify the consent given by e-mail sent to info.connectivity@thermowatt.com.

Please note that the user can delete his/her user account autonomously via the App or WebApp, in the 'user profile' section:

• If the user has associated products the deletion of the user account will be completed after 30 days;
• If the user has no associated products, the deletion will be completed after 1 day.

For further information regarding the details of the service, please refer to the Terms&Conditions.

Pursuant to Regulation (EU) 2023/2854, you may submit a request to the Company for access to the readily available data by contacting the Privacy Office by post sent to Via San Giovanni Battista, 21, 60011 Arcevia (AN), Italy or by e-mail sent to info.connectivity@thermowatt.com.

The same channels may be used to request the deletion of readily available data held by the Company, as well as to:

• Request the sharing of readily available data with third parties identified by you and authorised for this purpose, on the basis of a contract concluded between them and you;
• Put an end to the sharing of data with these third parties.

If the data sharing request concerns data classified as personal, the third party with whom the sharing is requested must have a valid legal basis pursuant to Articles 6/9 of the GDPR.

The Company may reject, suspend or deny the request to share data, or require the application of specific technical and organisational safeguards, if the data of which the sharing is requested constitute trade secrets held by Thermowatt S.p.A.

The data will be provided in the commonly used ".xlsx" format.

It is understood that, pursuant to Articles 4.10 and 6.2(e) of Regulation (EU) 2023/2854, the data may not be used to develop products in competition with those of the Company, and no coercive means and/or loopholes in the Company's technical infrastructure may be used to obtain access to them.

Data Controller

The Data Controller is Thermowatt S.p.A., with registered offices in Via San Giovanni Battista, 21, 60011 Arcevia (AN), Italy.

Thermowatt S.p.A. also acts as Data Holder ("Data Holder") pursuant to Regulation (EU) 2023/2854 for data obtained from the connected product and related service (App/WebApp) that you are entitled to use.

Data Protection Officer

The Data Controller has appointed a Data Protection Officer, who can be contacted at the following e-mail address: DPO.Thermowatt@thermowatt.com.