INFORMATION ON THE PROCESSING OF PERSONAL DATA - NEWSLETTER SERVICES

PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 ("GDPR")

La Sportiva S.p.A., with registered office at Via Ischia no. 2, 38030 - Ziano di Fiemme (TN), ITALY, wishes to inform you about the processing of your personal data carried out to manage your request to subscribe to the newsletter services (the "Service").

This subscription can occur (i) by filling out the "Newsletter" form available at https://www.lasportiva.com/it/newsletter; (ii) when creating a new user account on the website www.lasportiva.com, by filling out the "Create new customer account" form and selecting the specific consent flag; (iii) when registering for one of the events organized and promoted by the Company, also through third parties; as well as (iv) when registering at one of the stores owned by the Data Controller, also to access dedicated discounts, or (v) by using the dedicated section within your personal account.

In all the above cases, personal data will be processed exclusively to follow up on your subscription request and to enable the sending of communications related to the Service.

1. Identity and contact details of the Data Controller

The data controller is La Sportiva S.p.A., with registered office at Via Ischia no. 2, 38030 - Ziano di Fiemme (TN), ITALY. Tax code and VAT number 01039930225, email gdpr@lasportiva.com (hereinafter the "Company" and/or the "Controller").

2. Purpose of processing, legal basis, and retention period

3. Type and Source of Data Processed

The activities mentioned in the previous paragraph involve the processing of personal and contact data provided by you when filling out the subscription form for the Service. Additionally, data acquired in relation to the interaction of individual recipients with the emails received (e.g., opening messages and clicking on links) will also be processed.

Finally, the Company may process information related to your outdoor activities of interest, should you choose to indicate them by filling out the appropriate section of your personal data, which you can access via the link provided by the Data Controller via email, following confirmation of your subscription to the Service.

The provision of data marked with an asterisk is mandatory; therefore, any refusal to provide them will make it impossible to follow up on your request.

4. Subjects Who Access the Data and Scope of Communication

Data may be processed:

• by the Company's employees and collaborators of any kind expressly authorized based on their respective profiles and who have received adequate operational instructions;

• by the Data Controller's suppliers, who perform activities functional to the achievement of the purposes for which the data are processed, such as IT service providers, designated as Data Processors pursuant to Article 28 of the GDPR;

• by external subjects authorized to receive them acting as independent data controllers, such as public authorities and professional firms.

5. Transfer of Data Outside the EU

The data will be transferred outside the EU, particularly to the United States of America, based on the following guarantees:

1. adherence of the relevant supplier to the EU-US Data Privacy Framework;

2. signing of standard contractual clauses.

6. Rights of Data Subjects

All data subjects (i.e., the individuals to whom the data refer) can exercise the rights provided for in Articles 15-22 of the GDPR by writing via email to: gdpr@lasportiva.com. In particular, data subjects can:

• obtain from the Company confirmation as to whether or not personal data concerning them are being processed and, if so, request access to the data and the information referred to in Article 15 of the GDPR;

• obtain the rectification of inaccurate data or the completion of incomplete data pursuant to Article 16 of the GDPR;

• request the erasure of personal data in the cases provided for by Article 17 of the GDPR;

• obtain the restriction of processing (i.e., the temporary submission of data to the sole operation of storage), in the cases provided for by Article 18 of the GDPR;

• object at any time, for reasons related to their particular situation, to the processing of personal data concerning them carried out based on the legitimate interest of the Company, pursuant to Article 21 of the GDPR;

• where the processing is based on consent, contract, or for the execution of pre-contractual measures adopted at the request of the data subjects and is carried out by automated means, request to receive the data in a structured, commonly used, and machine-readable format, and, if technically feasible, to transmit them to another Data Controller without hindrance, pursuant to Article 20 of the GDPR ("right to data portability").

Data subjects have the right to withdraw, at any time, the consent given for the purposes mentioned above, without prejudice to the processing carried out by the Data Controller before such withdrawal, which was based on consent.

Finally, data subjects have the right to lodge a complaint with the supervisory authority competent in the Member State where they usually reside or work or of the State where the alleged violation occurred.