PERSONAL DATA PROCESSING NOTICE

This notice explains which personal data we collect, why we process them, who we share them with, how long we keep them, and which rights you can exercise when you use the Rox Pay platform, the collection and payment services, the wallet, the POS terminals and the ancillary invoicing and support services, or when you visit our websites.

Rox Pay S.p.A.

Registered office: Via G. Marconi, 67/A - 53036 Poggibonsi (SI), Italy

Tax Code and VAT No.: 01524770524

Email: info@roxpay.eu

Certified email (PEC): roxpay@namirialpec.it

Rox Pay S.p.A. has appointed a Data Protection Officer, whom you may contact on any matter concerning the processing of your personal data and the exercise of your rights.

DPO: Marco Franchi - marco.franchi@roxpay.eu

Alternatively, you may contact the Data Controller using the details in section 15.

This notice addresses:

• (a) individuals who register and use a personal or business account;
• (b) the legal representatives, directors, authorised signatories, authorised employees and beneficial owners of the companies using the services, whose data we receive from the company itself or from public sources pursuant to Article 14 GDPR;
• (c) individuals who make a payment to a merchant using our services, within the limits described in section 8;
• (d) visitors to our websites and recipients of our communications.

A company that provides us with data concerning its representatives, employees or beneficial owners must inform them of this processing and make this notice available to them.

Depending on the services used, we process:

• (a) identification and contact data: name and surname, date and place of birth, tax code, residence or domicile, email address, telephone number;
• (b) account and security data: credentials stored in encrypted form, second authentication factor, access and activity logs, IP address, identifiers and characteristics of the device used;
• (c) corporate data: information about the business, ownership and control structure, beneficial ownership, powers of representation, constitutional documents, licences and authorisations;
• (d) due diligence data: identity document, proof of residence, information on the activity carried out and on the source of funds, screening against international restrictive measures lists, politically exposed persons lists and public sources. Identity checks are performed by Adyen and may include a comparison between the document and an image of the face where the law requires it;
• (e) payment and transaction data: amounts and currencies, IBAN, masked identifiers of the payment instruments, authorisation outcomes, wallet balances and movements, refunds, disputes and chargebacks;
• (f) tax and invoicing data, receipts and accounting documents;
• (g) the content of communications with support, of requests and of complaints;
• (h) browsing data and information collected through technical cookies (section 16).

Full payment card data are not stored on our systems: they are collected and processed directly by the PCI DSS certified providers that execute the transaction.

We process special categories of data (Article 9 GDPR) only where strictly necessary and on the basis of your explicit consent or of a legal obligation.

We collect data directly from you, when you register, complete activation, use the services or contact us. We also receive data from the company you act for, from public registers and sources (companies register, beneficial ownership registers), from restrictive measures and politically exposed persons lists, from databases used for fraud prevention, from Adyen and the other providers executing the payments and, where you reach the platform through a white-label brand, from the partner that introduced the service to you.

We process your data for the following purposes:

• (a) to activate and manage the account, provide the services, execute payment transactions, manage balances and provide contractual support: performance of a contract (Article 6(1)(b) GDPR). Providing the data is necessary; without it we cannot activate the services;
• (b) to identify customers, carry out due diligence and restrictive measures screening, keep records of transactions and make the communications and reports owed to the authorities: compliance with legal obligations (Article 6(1)(c) GDPR) under Italian Legislative Decree 231/2007, as amended. Providing the data is mandatory;
• (c) to prevent, detect and handle fraud, abuse, disputes and chargebacks, and to protect the security of the platform and the continuity of the service: legitimate interest (Article 6(1)(f) GDPR) and obligations imposed by the payment schemes;
• (d) to comply with accounting, tax and invoicing obligations: legal obligation (Article 6(1)(c) GDPR);
• (e) to handle complaints, disputes and debt recovery: legitimate interest (Article 6(1)(f) GDPR);
• (f) to send commercial communications about services similar to those already used: legitimate interest for customers, who may object at any time and without formalities; consent (Article 6(1)(a) GDPR) for contacts who are not yet customers;
• (g) to carry out commercial profiling, market research and personalisation of offers: consent (Article 6(1)(a) GDPR), optional and revocable at any time. Refusal does not affect access to the services.

To comply with anti-money laundering obligations and to prevent fraud we use automated checks: a preliminary filter on activation requests, a risk score assigned to each customer, and rules and thresholds that analyse transactions, including in real time.

These checks may lead to a request for additional documentation, the rejection or closure of an activation request, the refusal or blocking of an individual transaction, the establishment of a security reserve, the suspension of the services or the termination of the relationship. The legal basis is compliance with legal obligations and the performance of the contract.

Decisions producing significant effects are not taken solely by automated means: they are reviewed by a member of staff. You are in any case entitled to obtain human intervention, to express your point of view and to contest the decision by writing to the contacts in section 15.

We cannot disclose information whose communication is prohibited by anti-money laundering law, in particular the existence and content of any suspicious transaction reports.

We do not use your payment transaction data for advertising purposes and we do not transfer them to third parties for their own marketing purposes.

When a person makes a payment to a merchant using our services, we process the data needed to execute, reconcile and document the transaction. In respect of those data we are an independent controller for anti-money laundering obligations, fraud prevention, dispute handling and our own accounting records.

The data the merchant enters or uploads into the platform for its own business (customer records, payment references, documents, receipts) are processed on its behalf as a processor: the merchant remains the controller of that processing and must provide its own customers with its own notice and verify that a legal basis exists.

Adyen processes the data needed to hold the funds and execute the payments as an independent controller, as set out in section 9.

Authorised persons within our organisation: employees, collaborators and directors, acting on our instructions with access limited to what is necessary.

Data processors: infrastructure, hosting and cloud providers, email and SMS delivery services, support and electronic signature tools, consultants, auditors and couriers, all bound by agreements under Article 28 GDPR.

Adyen N.V. (payment institution): receives the identification data, documents, and transaction data needed to open the payment account, run identity (KYC) checks, hold the funds, and execute payments. For those processings Adyen acts as an independent controller under its own notice (adyen.com).

Banks, payment institutions and card schemes: for the execution of transactions, settlements and the handling of disputes.

White-label partners: the party that introduced the service to you, limited to the data needed to manage the commercial relationship.

Recipients authorised by law: judicial authorities and law enforcement, the Financial Intelligence Unit, the Italian Revenue Agency, supervisory and control bodies.

An up-to-date list of the data processors is available on written request to the contacts in section 15. The data are neither sold nor disseminated.

Data are stored on servers located in the European Union. Some providers may process data outside the European Economic Area: in that case the transfer takes place only where an adequacy decision of the European Commission applies or where appropriate safeguards under Article 46 GDPR are in place (standard contractual clauses, binding corporate rules, certifications), supplemented where necessary by additional measures.

A copy of the safeguards adopted may be requested using the contacts in section 15.

We keep the data for as long as needed for the purposes described and, in particular:

• (a) contractual, accounting and tax data: ten years from the end of the relationship;
• (b) due diligence and transaction data and documents: ten years from the end of the relationship or from the execution of the occasional transaction, under Italian Legislative Decree 231/2007, as amended;
• (c) activation requests that were not accepted: for as long as needed to demonstrate that the assessment was sound and to comply with anti-money laundering obligations, and in any case no longer than ten years from the decision;
• (d) technical and security logs: twelve months, unless needed to investigate incidents or unlawful conduct;
• (e) communications with support: twenty-four months from the closure of the request;
• (f) data processed for marketing and profiling: twenty-four months from the last contact and, in any event, until consent is withdrawn or an objection is raised.

Once those periods expire the data are deleted or anonymised, unless they must be kept for pending litigation or for a further legal obligation.

We adopt appropriate technical and organisational measures under Article 32 GDPR: encryption of data in transit and of confidential information, pseudonymisation where possible, access control with multi-factor authentication and least privilege, activity logging, backups and restore procedures, vulnerability and patch management, staff training, periodic reviews, and contractual confidentiality obligations for suppliers.

Every personal data breach is documented and assessed without delay. Where it entails a risk to people's rights and freedoms we notify the supervisory authority within seventy-two hours of becoming aware of it and, where the risk is high, we also inform the data subjects, describing the nature of the breach, its likely consequences and the measures taken to address it.

You may at any time exercise the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), portability (Art. 20) and objection (Art. 21), withdraw any consent given without affecting the lawfulness of processing already carried out, and lodge a complaint with the supervisory authority.

Some rights are subject to limits set by law: we cannot erase or restrict the processing of data we are required to retain for anti-money laundering, accounting and tax purposes; access may be narrowed where disclosure is prohibited by anti-money laundering law or where it would affect the rights and freedoms of others; portability covers only the data you provided to us and that we process on the basis of the contract or of consent.

Email: info@roxpay.eu

DPO: marco.franchi@roxpay.eu

PEC (certified email): roxpay@namirialpec.it

Registered letter (A/R): Via G. Marconi, 67/A - 53036 Poggibonsi (SI), Italy

Please state your full details, the right you wish to exercise and an address for our reply. We may ask for an identity document only where we are unable to identify you with certainty.

We reply within one month of receiving the request; that period may be extended by two months for complex or numerous requests, with reasons given. Exercising your rights is free of charge, unless the request is manifestly unfounded or excessive.

Within the authenticated area we use only technical cookies and identifiers needed for authentication, session management, language preferences and security: the platform cannot work without them, which is why no consent is required.

On the public websites, any use of non-technical cookies, including third-party ones, is subject to the consent collected through the dedicated banner, which also allows you to change your choices at any time.

We may update this notice to reflect new legislation, changes to the services or improvements to our security measures. The version in force is always published on this page together with its update date; material changes are communicated at least thirty days in advance by email, notice on the website or message in the authenticated area.

Rox Pay S.p.A. - Via G. Marconi, 67/A - 53036 Poggibonsi (SI), Italy

Email: info@roxpay.eu

PEC: roxpay@namirialpec.it

If you believe that the processing of your personal data infringes the Regulation, you may lodge a complaint with the supervisory authority of the country where you live or work or where the alleged infringement took place, or bring the matter before the courts.

Italian Data Protection Authority (Garante per la protezione dei dati personali): Piazza Venezia, 11 - 00187 Rome, Italy - www.garanteprivacy.it