GDPR INF 11 - USE OF SOFTWARE AND WEBSITE APPS (rev. 03-2025)

PRIVACY POLICY

(Article 13 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data – “GDPR”)

In compliance with the provisions set out by the General Data Protection Regulation, the Data Controller hereby provides the data subject with the following information regarding the processing of their personal data.

Data Controller:

CALEFFI S.P.A., with registered office in SR 229 No. 25 - 28010 Fontaneto d'Agogna (NO), Italy – VAT No. IT04104030962

Contact details:

privacy@caleffi.com

Processing activity: Management of data relating to the use of software and web applications.

• Categories of data subjects: Clients who use and/or benefit from the Services through the software and web applications of Caleffi S.p.A.

• Purpose of processing:

  • Provision of the Service to Clients (namely: the use of Software Applications, Web Applications and the Supplier’s

    devices enabling the intelligent management of products related to hydro-thermal-sanitary systems);

  • Management of after-sales support activities;

  • Carrying out anonymous statistical analyses (which do not allow the identification of the users concerned) relating to the sale, installation and use of the product.

• Legal basis: Performance of a contract and/or pre-contractual measures.

• Types of mandatory data: Consumption data, identification and contact details, personal identification data. The data are mandatory for the provision of the Service.

• Security measures: Such data will be processed exclusively by electronic means and protected by appropriate security measures.

Disclosure of data and categories of recipients:

• Google Actions: if integrated with this system, the gateway name and data of the rooms in which the system operates, the room name, rapid functions, current, set temperature and current mode are transferred to Google Inc. Google Inc. logs the operations carried out by the user via the voice assistant. Google needs this information to guarantee some of the functions linked to the services offered. We wish to remind you that once your data has been transferred, Google Inc. becomes the Data Controller, so please read their privacy policy;

• Amazon Alexa: if integrated with this system, the gateway name and room data in which the system operates, the room name, rapid functions, current, set temperature and current mode are transferred to Amazon Inc. Amazon Inc. logs the operations carried out by the user via the voice assistant. Amazon needs this information to guarantee some of the functions linked to the services offered. We wish to remind you that once your data has been transferred, Amazon Inc. becomes the

  Data Controller, so please read their privacy policy;

• Siri IOS: if integrated with this system, Apple Inc. has access to the following data: the gateway name, name of the rooms in which the system operates, the rapid functions, current and set temperature and current mode. Apple Inc. needs this information to guarantee some of the functions linked to the services offered. We wish to remind you that once the data has been transferred, Apple Inc. becomes the Data Controller, so please read their privacy policy.

• Your data may be collected and communicated to any other third party when required by the statutory legislation in force.

  Your processed personal data in question may be communicated to any Data Processing Supervisors, if deemed necessary or useful to handle your contractual relationship.

  No other contexts of communication are envisaged, except for those required to use third party services or systems to archive data and those to providers of third party services, with which the Service may be integrated on the initiative of the Data Subject, where possible.

  Communication of your data is mandatory if you decide to use one of those services, although it only occurs in order to fulfil any contractual obligations or actions requested by the Data Subject, and only where and when you consent on the App to the use of those services, if they are available. Your data will be transferred only to the provider of your choice and we wish to remind you that once your data has been transferred, the provider becomes the Data Controller:

Data retention period:

The data will be retained until the date of deletion by the user and, in any case, for no longer than 5 years from the last activity.

Automated decision-making:

The processing is not based on automated decision-making.

Data transfers outside the EEA Personal data will be stored at the Company’s headquarters and on the Group’s servers located within the European Economic Area (“EEA”):

The data will also be processed and disclosed to the recipients of the processing. Such data may be processed through IT systems that could also be located outside the European Union, while ensuring in any case the adoption of appropriate safeguards as provided for under EU Regulation 679/2016.

Data subject’s rights (Articles 15 to 22 and Article 13 of the GDPR):

• Right of access: Pursuant to Article 15 of the GDPR, the data subject has the right to request access to his/her personal data from the controller.

• Right to rectification: Pursuant to Article 16 of the GDPR, the data subject has the right to request the rectification of his/her personal data from the controller.

• Right to erasure (“right to be forgotten”): Pursuant to Article 17 of the GDPR, the data subject has the right to request the

  erasure of his/her personal data from the controller.

• Right to restriction of processing: Pursuant to Article 18 of the GDPR, the data subject has the right to request the restriction of the processing of personal data concerning him/her.

• Right to object: Pursuant to Article 21 of the GDPR, the data subject has the right to object to the processing of his/her personal data.

• Right to data portability: Pursuant to Article 20 of the GDPR, the data subject has the right to exercise the right to data portability.

Without prejudice to your right to file a claim with the Italian Authority for the protection of personal data, with head office in Piazza Venezia No. 11, 00187 ROME, www.garanteprivacy.it

If you have any questions about this Privacy Policy or wish to contact the undersigned company regarding any legal questions concerning the processing of your Personal Data, please contact the Caleffi S.p.A. Privacy Team at the following e-mail address: privacy@caleffi.com