Privacy Policy

ZANOTTA S.P.A. - PRIVACY POLICY FOR THE PROCESSING OF CUSTOMERS' PERSONAL DATA

1. SUBJECT OF THE PRIVACY POLICY

This information concerns the processing of your personal data for purposes related to the sale and promotion of the products and services of the company Zanotta S.p.A., part of the Life Style Design group, in accordance with Legislative Decree no. 196/2003 as subsequently amended and supplemented, and with the European Regulation on the protection of personal data no. 679/2016 (hereinafter, "GDPR").

2. DATA CONTROLLER

Data Controller is Zanotta S.p.A. (hereinafter "Zanotta" or the "Data Controller") with registered office in Nova Milanese (MB) via Vittorio Veneto 57, VAT number 00695980961, which can be contacted at the following email address to privacy@poltronafraugroup.com.

3. DATA PROTECTION OFFICER

The Controller has appointed a Data Protection Officer ("DPO"), who can be contacted at the following address: dpo.poltronafrau@dpoprofessionalservice.it

4. DATA COLLECTION SOURCE

The personal data described in the following sections (the "Personal Data" or the "Data") are automatically collected or provided through browsing or use of the Zanotta website www.arredocasa.live (the "Website") or on the occasion of your visit to one of our showrooms (the "Showroom"), at one of our events (for example during the Salone del Mobile) or for the purchase of one of our products or services (the "Products").

***

5. PURPOSES OF PROCESSING

5.1. MANAGEMENT OF SALES

DATA CATEGORIES - PERSONAL AND CONTACT DATA name, surname, tax code, e-mail, address, telephone number, billing address, data required for invoicing - PURCHASE DATA type and price of Products purchased.

PROCESSING PURPOSE - To carry out the sale of Products at our Showrooms and to manage after-sales services (for example, returns, refunds, repairs).

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not wish to provide your Data, the Controller will not be able proceed with the corresponding order or to manage the related Product after-sales services.

LEGAL BASIS OF PROCESSING - The need to perform a contract or to take steps prior to entering into a contract to which you are party, as well as the need to comply with legal obligations.

DATA STORAGE PERIOD: The Controller undertakes to erase your Data from its systems provided for the execution of the sale and management of the after-sales services 10 years after the date of the last purchase or from the last interaction with the Controller.

5.2. DATA PROCESSING CARRIED OUT FOR MARKETING PURPOSES FOLLOWING A SALE

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, e-mail - PURCHASE DATA type of Products purchased

PURPOSE OF PROCESSING - The sending of communications containing marketing offers related to Products similar to those already purchased (soft spam).

LEGAL BASIS OF PROCESSING - The Controller's legitimate interest in developing relationships with its customers and increasing the volume of requests and sales of the Products. You can exercise your right to object to the receipt of these communications at any time, immediately or at a later date, by clicking the unsubscribe button contained in the emails or newsletters you receive or by writing to privacy@poltronafraugroup.com..

DATA STORAGE PERIOD - The Controller will erase the Data processed for the purposes of sending communications containing marketing offers related to Products similar to those already purchased (soft spam), 24 months after the date of each purchase, unless any objection is made before that period elapses and without prejudice to their storage for 10 years for the purposes of executing the sale and for the management of after-sales services.

5.3 CONTACT REQUESTS

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, type of clientele (private, professional), country, city, postal code, e-mail, telephone number - OTHER DATA Personal data communicated in the specific text form on the Website or to the mailbox of the Controller.

PURPOSE OF PROCESSING - To manage contact requests made via the specific Website page ("contacts") or by email to the Controller.

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not provide these Data, it will not be possible for the Controller to process the requests sent.

LEGAL BASIS OF PROCESSING - The need to perform a contract or to take steps prior to entering into a contract to which you are party, as well as the need to comply with legal obligations.

DATA STORAGE PERIOD - The Controller undertakes to erase your Data from its systems provided in relation to requests submitted via the Website or by email 1 year after the date of provision.

5.4. REGISTRATION IN THE RESERVED AREA ON THE WEB SITE OR FOR ACCESS TO OUR EVENTS

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA First name, last name, company, email, city, postal code, state.

PURPOSE OF PROCESSING - To allow you to register as a customer on the Website and to access one of the reserved contents or to be able to access our events (e.g. the Salone del Mobile).

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not wish to provide your Data, you will not be able to register as a customer or access the related content in the reserved areas of the Website or to access our events.

LEGAL BASIS OF PROCESSING - The need to perform a contract or to take steps prior to entering into a contract to which you are party, as well as the need to comply with legal obligations.

DATA STORAGE PERIOD - The Controller undertakes to erase your Data from its systems provided for your registration and access to the reserved areas of the Website, 10 years after the date of the last access to the Website or after the date of cancellation of the relevant registration or after the date of the event.

5.5. MARKETING

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, email, country, preferred language, profession title, region, city.

PURPOSE OF PROCESSING - To send you marketing information about collections, exhibitions, and events, including through our newsletter, or allow you to participate in any customer satisfaction surveys and market research to improve the Products. These communications will be sent by email or telephone, including by automated means (SMS, social media messaging systems), and may contain tracking pixels that allow us to detect, at the level of the individual recipient, the opening of e-mails and the related interactions, in order to measure their effectiveness. We will carry out communications by automated means approximately no more than 2 times a month or on the occasion of particular initiatives (eg Salone del Mobile). You can also choose to be contacted exclusively via traditional methods, expressing your opposition to receiving communications through automated methods, by writing to privacy@poltronafraugroup.com.

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your Data, the Controller will be unable to keep you constantly updated on the special offers and promotions for its customers, or use the Data for market research, and statistical and customer satisfaction analyses.

LEGAL BASIS OF PROCESSING - Your explicit consent to the processing of Data for this purpose. If you have given your consent, you can withdraw it at any time by clicking on the unsubscribe button contained in the emails or newsletters received or sending an email to privacy@poltronafraugroup.com. Tracking through tracking pixels is subject to your distinct and explicit tracking consent, separate from the consent referred to above and independently withdrawable in the same manner.

DATA STORAGE PERIOD - The Controller will erase the Data processed in order to send you marketing information, including customised information following classification based on the parameters described above, about collections, exhibitions, and events, as well as for the participation in customer satisfaction surveys and market research, 10 years after the collection of the Data, or until you object. To that end, the Controller has taken into consideration the type of goods offered for which it considers an average frequency of purchase by customers of one or a maximum two products per capita every 6-7 years. Therefore, shorter timescales for data analysis would prevent the offer of customised services. In any case, the Data will be stored for 10 years for the purposes of sales management and after-sales services.

5.6. COMMUNICATE DATA TO OTHER COMPANIES OF THE GROUP FOR MARKETING PURPOSES

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, email, country, preferred language, profession title, region, city. PURPOSE OF PROCESSING - To communicate your Data to other companies of the Group to which the Controller belongs, so that they can send you marketing information about collections, exhibitions, and events, including through newsletters in relation to its products and services, and to participate in any customer satisfaction surveys and market research to improve the Products.

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your Data, the Controller will not be able to communicate the Data to the other group companies for such purposes.

5.7. CUSTOMER CATEGORIZATION

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, email, country, preferred language, profession title, region, city.

PURPOSE OF PROCESSING - Classification of customers based upon a series of parameters, for the purposes of sending targeted commercial communications relating to the requirements of a certain category or bracket of which you form part (e.g. residents of a specific region etc.).

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you wish to object to the processing of your Data, it will not be possible for the Controller to keep you constantly updated on offers and promotions dedicated to certain categories of customers. If you have given your consent to receive promotional information in any case, you may therefore only receive generic newsletters.

LEGAL BASIS OF PROCESSING - The legitimate interest of the Controller in achieving the maximum efficiency of its marketing activities. We will send promotional communications taking account of your bracket or category only with your prior consent, which may be withdrawn at any time and without prejudice. You can exercise your right to object to the receipt of these communications at any time, immediately or at a later date, by clicking the unsubscribe button contained in the emails or newsletters you receive or by writing to privacy@poltronafraugroup.com.*

5.8. PROFILING OF CUSTOMERS

CATEGORIES OF DATA - PERSONAL AND CONTACT DATA name, surname, date of birth, age bracket, email, telephone number, country of residence - OTHER DATA profession, frequency and Product purchase channels (e.g., web, showroom), products viewed, catalogues requested, interests and data relating to your behaviour on our Website.

PURPOSE OF PROCESSING - Profiling of customers to assess your preferences, interests, characteristics, and consumption habits based upon a series of parameters, for the purposes of sending customised promotional communication or for a personalised purchasing experience in our Showrooms. In particular, the Controller uses Meta Pixel and Google Ads for conversion measurement, remarketing and the creation of customised audiences, based on your consent given through the Website's cookie banner. With regard to the processing of data relating to interactions with the Website through Meta Pixel, the Controller and Meta Platforms Ireland Limited may act as joint controllers pursuant to Article 26 GDPR. For further details on the cookies used, please refer to the Website's cookie policy.

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your Data, it will not be possible for the Controller to keep you constantly updated on offers and targeted promotions with respect to your preferences, interests, characteristics, and consumption habits or to offer you a personalised purchase experience at our Showrooms. If you have given your consent to receive promotional information in any case, you may therefore only receive generic newsletters.

LEGAL BASIS OF PROCESSING - Your explicit consent to the processing of Data for this purpose. If you have provided consent, you may withdraw it at any time by writing to privacy@poltronafraugroup.com.

DATA STORAGE PERIOD - The Controller will erase the Data processed in order to send you marketing information, including customised information, following classification or profiling based on the parameters described above, about collections, exhibitions, and events, as well as for the participation in customer satisfaction surveys and market research, 10 years after the collection of the Data, or until you object. To that end, the Controller has taken into consideration the type of goods offered for which it considers an average frequency of purchase by customers of one or a maximum two products per capita every 6-7 years. Therefore, shorter timescales for data analysis would prevent the offer of customised services. In any case, the Data will be stored for 10 years for the purposes of sales management and after-sales services.

6. DATA PROCESSING METHODS AND ANY FURTHER STORAGE OF DATA

The Data will be collected and processed in compliance with the principles of fairness, lawfulness, and transparency, through manual or automated methods, always within the limits of the processing purposes described above and, in any case, in order to ensure the security and confidentiality of the Data. With respect to the storage of the data, the Controller has indicated the respective timescales in correspondence with each processing activity and it undertakes, in any case, to base the Data processing on principles of adequacy and minimisation, checking annually the need to store the Data for a period of time not exceeding what is necessary for the achievement of the purposes for which they were collected and processed. The Controller may store the Data to fulfil regulatory obligations, or to establish, exercise or defend a legal claim. Upon achieving the purposes for which the Data were collected and processed, the Controller will take the appropriate measures to make the Data anonymous, so as to prevent your identification, notwithstanding its right to continue using the Data anonymously for statistical purposes.

7. ANY AUTOMATED DECISION-MAKING PROCESSES

As indicated above, the Controller carries out, based upon its legitimate interest, a classification of its customers for the purpose of sending information of a commercial nature on collections, exhibitions and events targeted relative to the needs of a certain category or bracket of which you form part. That process is carried out by breaking down the data subjects into non-invasive and non-discriminatory categories, such as country of residence (residents in the Lombardy region when, for example, identifying a category of data subjects interested in the opening of a new store in Milan). Following this analysis, which may also be carried out in automated form, the user may be classified into one or more groups with different characteristics and may receive from the Controller communications dedicated to that category which the Controller believes are in line with its requirements. In relation to this processing, the Controller has successfully conducted a balancing test in order to determine that the processing linked to the classification in question is carried out on the legal basis of the legitimate interest of the Controller in achieving maximum efficiency in its marketing activities.

The Controller may also, with your consent, analyse your consumer habits over time, to assess in more depth what may be possible with a simple categorisation, such as products or initiatives responding to your tastes and preferences (for example, if, during a timeframe of 2 years, you demonstrate interest in one of our particular products or the line created by one of our designers, we will send you offers dedicated to that type of product and not others in which you are not interested or that do not meet your tastes and preferences). In this way we will be able to offer you a unique and customised purchasing experience even if you come to see us at one of our showrooms. In that case, our sales assistant will be able to recognise you and direct you in the most efficient manner to the product that you prefer. Of course, you can always ask our sales staff to show you different proposals. It is noted that the Controller has carried out a specific impact assessment of the personal data processing necessary for the profiling activities to guarantee respect of the principles of the GDPR, including non-discrimination, effectiveness, and absence of harmful consequences for the data subject.

8. PERSONS AUTHORISED TO PROCESS THE DATA

The Data may be processed by persons appointed by the Controller who have been expressly authorised and have received adequate operating instructions in relation to the processing purposes set out above.

9. POSSIBLE DATA RECIPIENTS

The Data will not be disseminated. The following entities may become aware of the Data in relation to the processing purposes outlined above and may process them, independently, as separate Data Controllers or as Data Processors duly appointed by the Controller (the list of those entities can be requested from the Controller by writing to privacy@poltronafraugroup.com):

• Retailers or commercial partners of the Controller which will receive, at your request, the configuration of Products selected by you for the purpose of finalising the purchase; those entities will act in the capacity of autonomous controllers and we refer you to their own privacy policies.

• Retailers or commercial partners of the Controller or Companies of the group to which the Controller belongs which will act as processors;

• Companies of the group of which the Controller is part to which we will communicate your Data for sending marketing information on collections, exhibitions, and events, by the aforementioned companies, in relation to their products and services; those entities will act as autonomous

• Data controllers and they will receive the same only where you have provided consent to the communication of Data.Companies of the group to which the Controller belongs for administrative and accounting purposes; those entities will act in the capacity of processors.

• Entities that may access the Data by virtue of EU law or the law of the Member State to which the Controller is subject; those entities will act in the capacity of autonomous controllers.

• Companies that carry out and provide additional services related to the processing purposes, banking operators, electronic payment carriers, credit card issuers, internet providers, couriers and shipping agents, companies that manage events or carry out newsletter mailing or market research activities, companies that offer data analysis services, companies that offer IT infrastructures and IT support and consulting services, legal or accountancy firms, and auditors; those entities will act in the capacity of processors or in some cases autonomous controllers;

• Purchasers or successors of the Controller in cases of merger, transfer, restructuring, reorganisation, dissolution or other sale or transfer of some or all of the assets of the Controller, in which the Data may be transferred; those entities will act as autonomous controllers and we will only communicate to them the Data necessary for the assessment of the operation based upon our legitimate interests.

10. TRANSFER OF PERSONAL DATA ABROAD

All Data processing is carried out in countries of the European Union.

If the Data need to be transferred to a Third Country, for example, to manage relationships with customers that have interests in countries other than the European Union, or in connection with the use of online advertising tools such as Meta Pixel and Google Ads, which may involve the transfer of Data to Meta and Google, respectively, in the United States, the Controller undertakes to:

• Retailers or commercial partners of the Controller or Companies of the group to which the Controller belongs which will act as processors;
• Companies of the group of which the Controller is part to which we will communicate your Data for sending marketing information on collections, exhibitions, and events, by the aforementioned companies, in relation to their products and services; those entities will act as autonomous Data controllers and they will receive the same only where you have provided consent to the communication of Data.

• Companies of the group to which the Controller belongs for administrative and accounting purposes; those entities will act in the capacity of processors.

• Entities that may access the Data by virtue of EU law or the law of the Member State to which the Controller is subject; those entities will act in the capacity of autonomous controllers.

• Companies that carry out and provide additional services related to the processing purposes, banking operators, electronic payment carriers, credit card issuers, internet providers, couriers and shipping agents, companies that manage events or carry out newsletter mailing or market research activities, companies that offer data analysis services, companies that offer IT infrastructures and IT support and consulting services, legal or accountancy firms, and auditors; those entities will act in the capacity of processors or in some cases autonomous controllers;

• Purchasers or successors of the Controller in cases of merger, transfer, restructuring, reorganisation, dissolution or other sale or transfer of some or all of the assets of the Controller, in which the Data may be transferred; those entities will act as autonomous controllers and we will only communicate to them the Data necessary for the assessment of the operation based upon our legitimate interests.

TRANSFER OF PERSONAL DATA ABROAD

All Data processing is carried out in countries of the European Union.

• Ensure that the country to which the Data will be sent guarantees an adequate level of protection, as provided under Article 45 of the GDPR; or

• Comply with the standard contractual clauses for Data protection approved by the European Commission as to the transfer of personal Data outside the EEA in accordance with Article 46.2 of the GDPR.

For further information on the entities and countries involved, please send a request to the following email address: privacy@poltronafraugroup.com

YOUR RIGHTS IN THE CAPACITY OF DATA SUBJECT - COMPLAINT TO A SUPERVISORY AUTHORITY

In relation to the above Data processing, you can exercise at any time, by sending an email to privacy@poltronafraugroup.com, the following rights under the conditions and within the limits indicated in Articles 12 and 13 of the GDPR:

• Right of access (Art. 15 GDPR);

• Right of rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)

• Right to erasure of Data (Art. 17 GDPR).

• Right to restriction of processing (Art. 18 GDPR).

• Right to object to processing carried out in accordance with Art. 6, paragraph 1, letters e) or f) GDPR.

You also have the right to lodge a complaint with the Supervisory Authority, i.e., the Italian Data Protection Authority (known as (“Privacy Guarantor”) and/or other competent supervisory authorities (Art. 77 GDPR).Moreover, if the processing is based on consent or a contract and is carried out by automated means, you have the right to receive your Data in a structured, commonly used, and machine-readable format and, if technically feasible, to transmit those Data to another Data Controller without hindrance under Article 20 of the GDPR.You also have the right to object at any time to the processing of the Data, immediately or after the transfer of the Data, in relation to the sending by the Controller of unsolicited communications containing marketing offers related to Products similar to those already purchased (soft spam) directly to the email address provided during the purchase of Products, pursuant to Art. 130, paragraph 4 of Italian Legislative Decree no. 196/2003, as amended by Italian Legislative Decree no. 101/2018.
You can also choose to be contacted for marketing purposes exclusively via traditional methods, expressing your opposition to receiving communications through automated methods.You have the right to withdraw the consent provided for marketing and/or profiling purposes at any time.

MINORS

The Website and the Products are in no way intended for minors under the age of 18; therefore, the Controller does not carry out any collection and/or processing of personal data relating to such minors. In the event that personal data relating to minors are entered on the Website, the Controller will erase them.

POLICY UPDATES

This Privacy Policy is valid from the date of publication (latest update: October 28, 2026). The Controller may make changes and/or additions to this Privacy Policy, including as a result of any subsequent regulatory changes and/or additions.