GDPR / PRIVACY RULES

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (GDPR)

T.M.I. Srl Special Services, with registered office in Viale Ercole Marelli, 352 – 20099 Sesto San Giovanni (MI), Italy, and operational headquarters in Viale Ugo Foscolo, 82 – 20900 Monza (MB), Italy (VAT / Tax Code: IT 02553550969), e-mail: fanelli@tmisrl.net (hereinafter, "Data Controller"), in its capacity as Data Controller, informs you that your personal data will be processed in compliance with current privacy laws and according to the principles of correctness, lawfulness, transparency, and data protection.

1. Categories of Data Processed

The Data Controller collects and processes the following personal data:

• Identification and contact details: Name, surname, company name, address, phone number, email address.

• Administrative and billing data: Tax ID/VAT number, bank and payment details.

• Email interaction data (Newsletter/Marketing): Technical data on opening emails, dates, times, and link clicks collected via tracking technology.

• Browsing data: IP addresses, browser specifications, and navigation logs collected through cookies.

2. Purposes and Legal Bases for Processing

Your personal data are processed for the following purposes:

A) Contractual and Service Purposes (Legal Basis: Performance of a contract / Legal Obligation)

• Concluding and managing service contracts with the Data Controller.

• Fulfilling pre-contractual, contractual, accounting, and tax obligations.

• Complying with obligations established by laws, regulations, EU legislation, or orders from competent authorities.

• Exercising the Data Controller's rights, including the right of defense in court.

B) Marketing and Commercial Communications (Legal Basis: Consent)

Subject to your specific, explicit, and separate consent:

• Sending newsletters, promotional communications, advertising material, and customer satisfaction surveys concerning services offered by the Data Controller via email or automated messaging systems.

• Soft Spam Exception: If you are already a customer, we may send you commercial communications relating to products or services similar to those you have already purchased, provided you do not object (pursuant to applicable privacy regulations).

C) Email Tracking and Analytics (Legal Basis: Consent)

• Measuring the effectiveness of our marketing campaigns sent via automated platforms (e.g., Brevo) through invisible tracking tools (such as web beacons or tracking pixels). This allows us to gather statistical insights regarding email opens, click-through rates, and interaction metrics.

3. Processing Methods and Third-Party Service Providers

Processing is carried out using both paper and electronic/automated tools under strict security protocols.

To manage and deliver marketing communications and newsletters, the Data Controller uses third-party email platforms, specifically Brevo (Sendinblue GmbH / Sendinblue SAS), which operates as an external Data Processor. Brevo processes data (such as email addresses, IP addresses, and email interaction data) strictly on behalf of the Data Controller and in accordance with GDPR requirements.

4. Data Retention Period

• Contractual and administrative data: Kept for the duration required by law (typically 10 years after termination of the contractual relationship).

• Marketing data and email tracking data: Kept until consent is revoked, or for a maximum period of 24 months from collection, whichever comes first.

5. Nature of Provision and Choice

• Contractual Purpose (Section 2.A): Mandatory. Failure to provide data makes it impossible to fulfill contractual obligations or provide requested services.

• Marketing and Tracking Purposes (Sections 2.B and 2.C): Optional. You can refuse or withdraw consent for marketing or tracking pixels at any time without impacting your ability to access our core services.

6. Data Transfer Outside the EU

Personal data are stored on servers located within the European Union. If data are transferred to non-EU countries, the Data Controller guarantees that such transfers will take place in compliance with standard contractual clauses approved by the European Commission or other recognized GDPR legal frameworks.

7. Rights of the Data Subject

Pursuant to Articles 15–22 of the GDPR, you have the right to:

1. Request access to your personal data and information regarding its processing.

2. Request rectification of inaccurate data or completion of incomplete data.

3. Request erasure of your personal data ("right to be forgotten").

4. Request restriction of processing under certain legal conditions.

5. Request data portability to receive your data in a structured, commonly used format.

6. Object at any time to the processing of your data for direct marketing purposes or tracking.

7. Withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal.

8. File a complaint with a competent Data Protection Supervisory Authority (such as the Garante per la protezione dei dati personali in Italy).

8. How to Exercise Your Rights and Manage Preferences

You can exercise your rights or manage your email tracking preferences at any time by:

• Sending a registered letter to: T.M.I. Srl Special Services – Viale Ugo Foscolo, 82 – 20900 Monza (MB), Italy

• Sending an email to: fanelli@tmisrl.net

• Clicking the "Unsubscribe" or "Update Preferences" links located at the footer of every promotional email sent via Brevo.

9. Security Measures

The Data Controller implements technical and organizational security measures (including SSL encryption and access controls) to prevent data loss, unauthorized access, or improper disclosure.

Last Updated: October 2026