Miropass s.r.l. ("Miropass" or "TuPassi"), as Data Controller, informs you in accordance with applicable national legislation and European Privacy Regulation no. 679/2016 ("GDPR") that your data will be processed as follows.

Privacy is very important to us and we want you to always feel protected. For this reason, we invite you to read the privacy policy carefully. By using our services, you provide us with certain information that enables us to provide the service.

In this document we would like to explain:

• which data we use;

• why and on what legal basis we collect your data;

• how your data is used;

• which data is mandatory and which data is optional;

• how long your data is stored;

• who can have access to your data;

• to whom your data may be disclosed;

• where your data can be transferred;

• what are your rights;

• who is the Data Controller of your data and who is the Data Protection Officer.

What data do we use?

In TuPassi we use your personal data (hereinafter "personal data" or also "data"), that are:

• the data provided by you, identifying and non-sensitive such as: name, surname, email, telephone number. These are the data you provided us when you registered at www.tupassi.com and/or the TuPassi App;

• the navigation data, IP address or domain names of the computers used by users connecting to the site, the devices and connectivity used. This data may also be collected by means of cookies and metadata;

Why and on what legal basis do we collect your data?

The data you provide allows us to provide the appointment booking service at our customer facilities. Specifically, your personal data is processed for the following purposes:

• to allow you to register on the website and the TuPassi App;

• to manage and maintain the websites and your account within them;

• allow you to use, update and maintain the TuPassi App on supported devices;

• provide you with technical support;

• aggregate statistical analysis on an anonymous basis;

• manage complaints and disputes, prevent fraud and illegal activities;

• exercise the rights and protect the legitimate interests of the Owner, i.e. Miropass s.r.l. or Miropass s.r.l. customers.

How is your data used?

Your personal data is used for the following purposes: registration, appointment booking service, appointment cancellation service, storage, consultation, modification, selection, extraction, communication, cancellation and destruction of data. Your personal data is electronically and automatically controlled and stored in databases.

Other purposes

MIROPASS will use your Personal Data, collected through the Site and the Application, also for the following purposes:

• to send you marketing communications, promotions and advertising, market research and surveys, by e-mail, SMS, paper mail, by telephone, through banners, instant messaging, through an operator, through the official MIROPASS social media pages related to MIROPASS and third party products and services ("Marketing Purposes");

• to create your profile by collecting and analysing information about your general activities on the Site/App. This profile will be used to provide you with information about other products and/or services that MIROPASS believes may be of interest to you and to show you advertising that may be relevant to your tastes. All algorithms involved in this automated or semi-automated process are regularly tested to ensure that you are not offered products that do not interest you ("Profiling Purpose");

• comply with legal obligations that require MIROPASS to collect and/or further process certain types of Personal Data ("Compliance");

• prevent or detect any abuse in the use of the Website, or any fraudulent activity and therefore allow MIROPASS to protect itself in court ("Abuse/Fraud").

Which data are mandatory and which are optional?

Your personal data such as your name, surname, email, telephone number are required to use the services requested through the Miropass Website and App.

How long is your data stored for?

Miropass stores and uses your personal data for the purposes of providing the booking service. You can delete them independently from the EDIT PROFILE section of the www.tupassi.com website. The data linked to a booking is saved in the database of the Miropass s.r.l. customer who provides the booked service and automatically deleted 3 months after the service has been provided.

Your account, registration data and your personal address book will be automatically deleted after 60 months of not using the TuPASSI system.

Who can have access to your data?

We value your privacy and do everything we can to protect you.

For this reason we share your data only when strictly necessary and only with those who help us to offer you a better service every day.

Your data is in fact accessible to:

• employees and/or collaborators of Miropass, who help to create, maintain and improve all services

• service providers that outsource activities on behalf of Miropass - in their capacity as external data processors - carrying out activities related, instrumental or supporting those of Miropass, for example: management and maintenance of the contents of websites and the TuPassi App, customer care, customer care and call centre services, management of Information Technology systems, etc.

To whom can your data be communicated?

Miropass may communicate your data without your express consent for service purposes:

• to the judicial authorities, at their request;

• to other parties to whom it is necessary to communicate it, by law or to allow the purposes of providing the service to be carried out following your booking (such as, for example, municipalities, healthcare companies and third parties using the TuPassi reception system). These subjects will keep your data in their capacity as autonomous data controllers. In any case, we want to reassure you that your personal data will not be diffusion.

Where can your data be transferred?

Your personal data are stored on servers hosted in the European community and are transferred, only after a reservation, to the servers of the structure that provides the service booked. The transfer of personal data takes place on HTTPS encrypted protocol.

What are your rights?

Until now we have talked about how we treat your data and how we behave; now we will show you what your rights are, so that you can always have control over your privacy and your information. If you do not have the limitations provided by law, you have the right to:

• have confirmation of the existence or not of your personal data, even if not yet registered, and request that such data be made available to you in a clear and comprehensible way;

• ask for indications and, if necessary, a copy:

  • the origin and category of your personal data;

  • the logic of use, if your information is processed by electronic means;

  • the purposes and methods of processing;

  • the identification details of the Data Controller and the persons in charge;

  • the subjects or categories of subjects to whom your personal data may be communicated or who may become aware of them;

  • the period in which your data is stored or the criteria used to determine that period, when possible;

  • the existence of an automated decision-making process, including profiling. In this case you can ask about the logic used, the importance and the consequences expected for you;

  • the existence of adequate safeguards in case of transfer of your data to a non-EU country or to an international organisation;

• to obtain, without there being a justifiable delay, the updating, modification, rectification of your incorrect data or the integration of your incomplete data, should you have an interest in doing so;

• obtain the cancellation, blocking of your data or, where possible, transformation into anonymous form:

  • if processed unlawfully;

  • if no longer necessary in relation to the purposes for which they were collected or subsequently processed;

  • in case of revocation of the consent on which the processing is based and in case there is no other legal basis;

  • if you have opposed the processing and there are no further legitimate reasons to continue using your data;

  • if we are required to do so by law;

The Data Controller, i.e. Miropass, may refuse to delete your data in the event of:

• fulfilment of a legal obligation, performance of a task carried out in the public interest or exercise of public authority;

• for reasons of public health interest;

• archiving in the public interest, scientific or historical research or for statistical purposes;

• establishment, exercise or defence of a right in court;

• obtaining a limitation of treatment in the case of:

  • challenge the accuracy of personal data;

  • unlawful processing by the Data Controller, i.e. Miropass, to prevent their deletion;

  • exercise of your right in court;

  • verify whether the legitimate reasons of the Data Controller prevail over those of the data subject;

• receive, if the processing is carried out by automatic means, without hindrance and in a structured, commonly used and readable format, the personal data concerning you that you have provided us with prior consent to transmit them to another Data Controller or - if technically feasible - to obtain direct transmission by the Data Controller to another Data Controller;

• oppose at any time all or part of it:

  • for legitimate and prevailing reasons, related to your particular situation, to the processing of personal data concerning you;

  • to the processing of personal data concerning you for marketing and/or profiling purposes where this is carried out

For all cases mentioned above, Miropass will, if necessary, inform the third parties to whom your personal data is disclosed of the possible exercise of your rights, except in specific cases (e.g. when this proves impossible or involves the use of means that are manifestly disproportionate to the protected right).

You may at any time modify and revoke your consent and exercise your rights by sending a request to Miropass s.r.l. - Via Riva Fredda, 3 - 26013 Crema (CR) or by sending an email to dpo@miropass.com. Finally, for the treatments referred to in this information, you have the right to lodge a complaint with the Guarantor for the Protection of Personal Data (www.garanteprivacy.it).

Who is the Data Controller of your data? Who is the Data Protection Officer?

Remember, for any need, that the Data Controller of your personal data is Miropass s.r.l. with registered office in via Riva Fredda 3, 26013 Crema (CR). You can contact our Data Protection Officer at dpo@miropass.com. The updated list of our Data Protection Officers is available at the offices of Miropass s.r.l. This information may be subject to change. For any updates, please consult our websites and other channels made available by Miropass s.r.l.