PRIVACY POLICY

Data Processor:
AXACTOR ITALY SERVICING SRL (hereinafter the "Company"), with its registered office in Milan (MI) at Via Santa Marta no. 25, Postal Code 20123—acting under the Authorization of the Grosseto Police Headquarters (Questura), P.A.S.I. Division – Cat. 13/B2025, Ref. no. 13203/25, pursuant to Art. 115 of TULPS (Royal Decree no. 733 of June 18, 1931, as amended)—acts as the Data Processor for data related to the management of individual accounts entrusted to it for the purpose of debt recovery activities on behalf of individual creditor companies (Clients), who act as the Data Controllers for said data.

Titolare del Trattamento:
At the same time, AXACTOR ITALY SERVICING SRL also acts as the Data Controller for all data concerning its employees/collaborators and suppliers, as well as a joint controller for the personal data of users collected on this website and its related sections, in accordance with and for the purposes of EU Regulation 679/2016 (GDPR).

Applicable Legislation:
The processing of personal data is governed by European legislation—Regulation (EU) 2016/679—and current national legislation regarding personal data protection, as well as the rulings of the Italian Data Protection Authority (Garante per la protezione dei dati personali). This regulation aims to ensure that the processing of "personal data" is carried out in compliance with the rights, fundamental freedoms, and dignity of natural persons, with particular regard to privacy and personal identity.

For these reasons, and in compliance with Articles 13 et seq. of EU Regulation 2016/679, the Company is required to provide comprehensive information regarding:

• The use of personal data concerning individuals with whom the Company has come into contact during debt recovery activities—specifically, debtors from whom payment of a claim has been requested via telephone call, written communication, and/or home visit.

• The processing of personal data of individuals accessing the restricted area of ​​the portal dedicated to making payments (the "Payment Portal").

• The processing of personal data used for aggregated Business Intelligence analysis activities.

To ensure high quality standards and compliance with industry regulations—including supranational ones—the Company collaborates with and maintains active membership in the trade association UNIREC (National Union of Credit Protection Companies), working closely with them to develop and stay updated on issues concerning the debt recovery sector.

Data provided by the user:
The optional, explicit, and voluntary sending of messages to contact addresses, private messages sent by users to social media profiles (where this option is available), and the completion and submission of forms on this site entail the acquisition of the sender's contact details—necessary for a response—as well as any personal data included in the communications. Specific notices will be published on the relevant pages.

Browsing data:
The IT systems and software procedures responsible for the operation of this site acquire, during their normal course of operation, certain personal data the transmission of which is implicit in the use of Internet communication protocols. This category of data includes the user's IP address, the date and time of access, and the name and version of the browser and operating system. The system temporarily stores the IP address to enable the delivery of the website to the user's computer. This requires the user's IP address to be stored for the duration of the session. Data is stored to ensure the functionality of the website. This data is also used to prevent fraud, secure evidence in the event of cyberattacks or fraud attempts, optimize services, review security standards, correct website errors, and ensure the security of our IT systems. The data will not be analyzed for marketing purposes in this context. Browsing data is not retained for longer than 12 months.

Rights of data subjects:
Regarding the processing activities described in this Notice, as a data subject you may—subject to the conditions set forth in the GDPR—exercise the rights enshrined in Articles 15 to 21 of the GDPR, and in particular:

• Article 15 Right of access by the data subject

  obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, obtain access to your personal data—including a copy thereof—and information regarding, among other things: the purposes of the processing, the categories of personal data concerned, the recipients to whom the data have been or will be disclosed, the data retention period, and the rights of the data subject.

• Article 16 Right to rectification

  obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data.

• Article 17 Right to erasure (‘right to be forgotten’)

  obtain, without undue delay, the erasure of personal data concerning you.

• Article 18 Right to restriction of processing

  obtain the restriction of processing.

• Article 20 Right to data portability

  receive the personal data concerning you in a structured, commonly used, and machine-readable format, transmit them to another controller without hindrance, and—where technically feasible—have your personal data transmitted directly by the other controller, provided that the processing is based on consent and is carried out by automated means.

• Article 21 Right to object

  object to the processing of personal data concerning you, unless the Controller has legitimate grounds to continue the processing.

• Article 77 Right to lodge a complaint with a supervisory authority

  lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza di Montecitorio no. 121, 00186, Rome (RM).

• Article 82 Right to compensation

  claim compensation for damages resulting from a breach of the regulations.

Form for Exercising Rights Regarding Personal Data Protection

Personal Data of Minors:
Please be advised that AXACTOR ITALY SERVICING SRL does not process the personal data of minors.
Therefore, individuals under the age of 18 are requested not to provide their personal data under any circumstances. AXACTOR ITALY SERVICING SRL. reserves the right to block access to services and does not guarantee the successful completion of requested activities/services for anyone who has concealed the fact that they are a minor.

Privacy Sanctions:
Article 83 of the GDPR, titled "General conditions for imposing administrative fines," lists the criteria that individual supervisory authorities must apply when deciding whether to impose an administrative fine and when determining the amount.
Regarding other sanctions, including criminal penalties, Article 84 of the GDPR delegates to Member States the authority to adopt all measures necessary to ensure their enforcement.

Data Protection Officer:
Requests should be addressed to the Data Protection Officer at the email address privacy@axactor.com. Providing a privacy notice is a general obligation that must be fulfilled before, or at the latest at the time of, commencing the direct collection of personal data. In cases where personal data is not collected directly from the data subject, the notice must be provided within a reasonable timeframe or at the time the data is communicated (not when it is recorded) to third parties or the data subject. Privacy notices for the various categories of data subjects follow below.

+ NOTICE ON THE PROCESSING OF PERSONAL DATA

+ PAYMENT PORTAL NOTICE

+ NOTICE FOR JOB INTERVIEW CANDIDATES

+ WHISTLEBLOWING NOTICE