Privacy Policy – App Service Users

Information pursuant to Chapter III of Regulation (EU) 2016/679 Dear Sir/Madam, We wish to inform you that Chapter III of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data provides for the protection of individuals. According to the aforementioned regulation, such processing will be based on principles of correctness, lawfulness, transparency, and protection of your privacy and rights. Therefore, Labware Spa (hereinafter referred to as the “Company"), as the Data Controller, is required to provide you with certain information regarding the processing of your personal data. 1) Data controller operated by the Company The Data Controller is: Labware Spa Via Enzo Ferrari, 3 62012 Civitanova Marche (Mc) VAT number 01424730438 Contact details Tel. 0733 829696 Email info@labware.it 1.1 Data Protection Officer The Data Protection Officer (hereinafter also referred to as “DPO”) is Dr. Dellabiancia Stefano, who can be contacted at the following email address: s.dellabiancia@hotmail.it 2) Personal data subject to processing Complete personal details, contact details 3) Purpose of the processing carried out by the Company The Data Controller will process personal data for the following purposes:

• Registering for the application by creating a personal account

The Data Controller will process the user's personal data to allow the use of services reserved for registered users. To access the restricted areas of the service, you must authenticate yourself by entering an authentication credential consisting of a username and password. In addition, your first name, last name, and cell phone number must be provided to complete the registration. The legal basis for this processing is the fulfillment of the contract or, depending on the case, the execution of pre-contractual measures taken at the request of the data subject. For this purpose, the data will be processed for the time strictly necessary to carry out the individual processing activities. However, the Data Controller may retain the data for a longer period of time in order to comply with specific obligations established by Regulations and/or Laws in force to which the Data Controller is subject. For this purpose, the Data Controller will process users' personal data for:

• Allow the user to access the app;
• Allow the user to access and use the service as a logged-in user, recognizing the user regardless of the device used;
• Maintain, recover, and manage the user account;
• Store data and information in the account;
• Allow users to send feedback and requests regarding service quality, the status of distributors, credit management, and any malfunctions.
• The processing of the login credentials and personal data of the data subject is necessary to allow access to the service and/or the provision of services provided by the Data Controller, including account management and maintenance. Failure to provide data will make it impossible for the user to register, access the reserved area of the service, and use the services reserved for registered users.
• Geolocation

The Data Controller will process the user's geolocation personal data to enable payment monitoring and use such data and information in the event of fraud, illegal or unauthorized use, or unauthorized access to the system. The legal basis for this processing is the legitimate interest of the Data Controller. Failure to provide the device's geolocation data will make it impossible for the user to purchase credit for the use of the services and to access the application, even if already correctly registered, and therefore to use all the services reserved for registered Users.

• Marketing

Information and promotional activities relating to products or services similar to those already sold will be published in a specific section of the app. The optional, specific, and voluntary completion of additional fields in the account section (date of birth, user gender, country, location, address, and profile photo) will give access to additional promotional activities relating to products or services similar to those already sold. Voluntary completion of the fields will result in the processing of the aforementioned information by the Data Controller. Failure to provide additional optional data will not have any consequences for the data subject in terms of use of the service. This processing does not require the specific consent of the data subject (Article 130, paragraph 4 - Legislative Decree 196/2003 as amended by Legislative Decree 101/2018), as it is based on a legitimate interest of the Data Controller. The data subject is informed that they may object to the processing at any time by sending an email to: info@labware.it

• Maintenance and troubleshooting of technical issues with the software (app)

Software support and maintenance activities. Any processing that could accidentally lead our representative to come into contact with the data contained in the app is therefore carried out by the Company in order to fulfill the contract entered into between your organization and Labware.

• Sales statistics and analysis

The Data Controller will compile statistics and sales analyses based on anonymous and aggregated data. Therefore, this purpose does not involve associating such data with the data subject. 4) Legitimate minor interests No processing of minors' data is envisaged. 5) Categories of subjects to whom the data may be disclosed In relation to the first two purposes indicated in point 3 above, the Company may communicate your personal data to the following public (non-economic) entities:

• Police forces, armed forces, and other public administrations, in compliance with obligations under laws, regulations, or EU legislation;
• Financial Administration and Public Officials.

The Company also discloses your personal data to private individuals and/or public economic entities only if necessary for mutual legitimate interests, and in particular to the following parties:

• Entities authorized to file tax returns, intermediaries such as banks, post offices, tax assistance centers, trade associations, professionals, etc.;
• Credit institutions that may be responsible for collections and/or payments;
• Carriers responsible for deliveries and/or pickups of goods or services.

6) Transfer of data to third countries The data will not be transferred, communicated, or disseminated to entities, associations, or companies outside the European Community. The data is stored on servers owned by the Company or on third-party servers located in the Italian Republic, which are used for this specific purpose and are appropriately protected. Should servers located outside the European Community be used in the future, only those systems that comply with Article 28 of the GDPR will be used, which requires the data controller to “only use processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that the processing meets the requirements of the Regulation and ensures the protection of the rights of the data subject” in accordance with standard practice. 7) Data retention period Personal data will be kept for the entire duration of the customer-supplier relationship and will be deleted at the request of the person concerned. Please note that accounting data, whether in paper or digital form, must be kept for at least 10 years and that, therefore, at the request of the person concerned, the only data that can be deleted are contact details, once all outstanding financial matters have been settled. In any case, when the deletion is carried out, the persons concerned will receive a confirmation email or SMS. 8) Rights of the data subject The data subject may request the Data Controller

• access to personal data
• the correction or deletion of the same (see considerations in point A2).

The rights of the data subject may be exercised by sending a request directly to the Data Controller. The data subject may also request the restriction of processing or object to it. These rights may be exercised provided they do not violate the law or the legitimate interests of the Company. 9) Right to withdraw consent It is not provided for in this case. 10) Right to lodge a complaint with a supervisory authority The person concerned has the right to lodge a complaint with a supervisory authority, which is currently the Italian Data Protection Authority, on whose website http://www.garanteprivacy.it The complaint procedures to be used are indicated. 11) Mandatory or optional nature of data provision and consequences of failure to provide data With reference to the purposes of processing indicated above: The provision of data is mandatory, as failure to provide it would prevent us from recording VAT documents in our accounts and therefore complying with tax regulations. 12) Existence of automated decision-making No profiling activities are planned. 13) Date of validity This policy came into effect on November 27, 2024.