INFORMATION PURSUANT TO ART. 13 OF REG. (EU) 2016/679 ("GDPR") - ONLINE SALE

Below is the information required by the GDPR relating to the processing of personal data provided for the purpose of purchase on the e-commerce website www.Carpisa.com (hereinafter, "Site") of Carpisa products (hereinafter, "Products"), as better described in the general conditions of sale.

1. Identity and contact details of the data controller

Kuvera S.p.a., c.f. and VAT number 07563710636, with registered office in Piazza dei Martiri n. 30, 80100 – Naples (NA) and operational headquarters in Interporto Lotto C, A19 – A20 – A2, 80035 - Nola (NA), e-mail address privacy@pianofortegroup.com,P.E.C address. kuvera@pec.it (hereinafter, "Data Controller").

2. Purpose of the processing, legal bases and data retention times

why are personal data processed?
a) To allow the purchase of products on the Site.
b) For the performance of administrative-accounting, tax and any further legal obligations.
c) For the possible assessment, exercise or defense of the rights of the Data Controller in court and out of court (including credit protection).
d) To keep the data relating to the credit card and, therefore, facilitate the carrying out of further purchase operations of the Products
e) To send promotional communications on Products similar to those being sold to the customer's e-mail address.
f) To carry out profiled marketing activities: analysis of the behavior and preferences of the interested parties derived from the data provided by them in combination with the data relating to online navigation on the Site (collected through cookies), in order to receive from the Data Controller promotional content more adherent to their interests, through automated contact methods (such as e-mail, instant messaging systems) and/or online advertising banners.

what is the legal basis that makes the processing lawful?
a) The execution of a contract to which the interested party is a party.
b) The fulfillment of a legal obligation to which the Data Controller is subject.
c) The legitimate interest of the Data Controller.
d) The consent of the interested party
e) The cd. "soft spam" referred to in art. 130, c. 4 of d. lgs. 196/2003 ("Privacy Code").
f) The consent of the interested party

How long do we keep personal data?
a) For the entire duration of the contractual relationship and for the following 10 years, as an ordinary limitation period.
b) In the event of litigation, for the entire duration of the same and until the deadlines for the appeal actions are exhausted.
c) Until the expiration date of the card, without prejudice to the right of the interested party to request the cancellation of the data at any time
d) Until the interested party objects (by clicking on the "unsubscribe" link at the bottom of each communication).
e) For 4 years, without prejudice to the right of the interested party to revoke the consent at any time

Once the retention periods indicated above have elapsed, the data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backup.

3. Provision of data

The data marked with asterisk are necessary for the purchase of the Products, while the others are optional.

4. Categories of recipients.

The data may be communicated to other third parties also operating as independent data controllers, such as public authorities and professional firms. The data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, as natural and / or legal persons who carry out activities functional to the purposes indicated above (eg IT services, communication and marketing services, customer care), also operating outside the Union Europea.In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (a third country deemed adequate by the European Commission pursuant to Article 45 of the GDPR by decision of 28 June 2021), as well as may be transferred to its sub-processors established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, letter .c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. In addition, the data are processed by the employees of the Data Controller - belonging to the company functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions.

5. Rights of the

interested party The interested party may exercise the rights referred to in articles 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him or her is being processed and, in this case, access to them and to the information referred to in Article 15, the correction of inaccurate data, the integration of incomplete data, the cancellation of data in the cases provided for by art. 17, the limitation of processing in the cases provided for in Article 18 GDPR, as well as to oppose, for reasons related to their particular situation, to the processing carried out for the legitimate interest of the owner. Furthermore, the interested party, in the event that the processing is based on consent or on the contract and is carried out with automated tools, has the right to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). In addition, the interested party, at any time, has the right to revoke the consent given for marketing purposes, as well as to oppose the processing for this purpose, including the profiling connected to it. In the case of communications sent by e-mail, the interested party may also object by clicking on the "unsubscribe" link at the bottom of each e-mail. To exercise the rights, the interested party may contact the Data Controller at the contact points indicated in paragraph 1.The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation occurred.

INFORMATION PURSUANT TO ART. 13 OF REG. (EU) 2016/679 ("GDPR") – REGISTRATION / USE OF THE WEBSITE

The following is the information required by the GDPR relating to the processing of personal data provided for the purpose of purchasing on the e-commerce website www.Carpisa.com (hereinafter, "Site") of Carpisa products (hereinafter, "Products"), as better described in the general conditions of sale.

1. Identity and contact details of the data controller

Kuvera S.p.a., c.f. and VAT number 07563710636, with registered office in Piazza dei Martiri n. 30, 80100 – Naples (NA) and operational headquarters in Interporto Lotto C, A19 – A20 – A2, 80035 - Nola (NA), e-mail address privacy@pianofortegroup.com,P.E.C address. kuvera@pec.it (hereinafter, "Data Controller").

2. Purpose of the processing, legal bases and data retention times

why are your personal data processed?
To allow the user to register on the Site and use the related services.
what is the legal basis that makes the processing lawful?
The execution of a contract to which the interested party is a party.
How long do we keep your personal data?
For the entire duration of the contractual relationship and for the following 10 years, as an ordinary limitation period.

Once the retention periods indicated above have elapsed, the data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backup.

3. Provision of data

The data marked with asterisk are necessary for the purchase of the Products, while the others are optional.

4. Categories of recipients.

The data may be communicated to other third parties also operating as independent data controllers, such as public authorities and professional firms. The data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, as natural and / or legal persons who carry out activities functional to the purposes indicated above (eg IT services, communication and marketing services, customer care), also operating outside the Union Europea.In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (a third country deemed adequate by the European Commission pursuant to Article 45 of the GDPR by decision of 28 June 2021), as well as may be transferred to its sub-processors established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, letter .c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. In addition, the data are processed by the employees of the Data Controller - belonging to the company functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions.

5. Rights of the interested party

The interested party may exercise the rights referred to in articles 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him or her is being processed and, in this case, access to them and to the information referred to in Article 15, the correction of inaccurate data, the integration of incomplete data, the cancellation of data in the cases provided for by art. 17, the limitation of processing in the cases provided for in Article 18 GDPR, as well as to oppose, for reasons related to their particular situation, to the processing carried out for the legitimate interest of the owner. Furthermore, the interested party, in the event that the processing is based on consent or on the contract and is carried out with automated tools, has the right to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). In addition, the interested party, at any time, has the right to revoke the consent given for marketing purposes, as well as to oppose the processing for this purpose, including the profiling connected to it. In the case of communications sent by e-mail, the interested party may also object by clicking on the "unsubscribe" link at the bottom of each e-mail. To exercise the rights, the interested party may contact the Data Controller at the contact points indicated in paragraph 1.The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation occurred.

INFORMATION PURSUANT TO ART. 13 OF REG. (EU) 2016/679 ("GDPR") – NEWSLETTER

The following is the information required by the GDPR regarding the processing of the e-mail address (hereinafter, "Data") provided in order to subscribe to the newsletter service, i.e. the periodic sending of communications via e-mail containing updates on products, offers and initiatives of the Carpisa world (hereinafter, "Newsletter Service").

1. Identity and contact details of the data controller

Kuvera S.p.a., c.f. and VAT number 07563710636, with registered office in Piazza dei Martiri n. 30, 80100 – Naples (NA) and operational headquarters in Interporto Lotto C, A19 – A20 – A2, 80035 - Nola (NA), e-mail address privacy@pianofortegroup.com,P.E.C address. kuvera@pec.it (hereinafter, "Data Controller").

2. Purpose of the processing, legal bases and data retention times

why are personal data processed?
To provide the Newsletter Service
what is the legal basis that makes the processing lawful?
The execution of a contract to which the interested party is a party.
How long do we keep personal data?
Until your withdrawal from the Newsletter Service in the manner indicated in point 5 below.

Once the retention periods indicated above have elapsed, the Data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backup.

3. Provision of data

The user is required only the e-mail address, necessary for the provision of the Newsletter Service; therefore, any refusal to provide it will make it impossible to use the Newsletter.Il provision of a discount voucher on the first order of the user is a mere incentive for users to subscribe to the Newsletter Service and to make the activities of the Data Controller better known. It is understood that the user is always allowed to withdraw from the Newsletter Service, without this making it impossible for the same to benefit from this discount voucher.

4. Withdrawal from the Newsletter Service

To stop receiving the e-mails referred to in the Newsletter Service, the user can click on the unsubscribe link at the bottom of each e-mail.

5. Categories of recipients.

The Data may be communicated to third parties operating as independent owners, such as public authorities and professional firms. The Data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, such as natural and / or legal persons who carry out activities functional to the purposes indicated above (eg IT services, mass sending of communications) also operating outside the European Union ("EU"). In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (a third country deemed adequate by the European Commission pursuant to Article 45 of the GDPR by decision of 28 June 2021), as well as may be transferred to its sub-managers established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, letter .c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. In addition, the Data is processed by the employees of the Data Controller - belonging to the company functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions.

6. Rights of the

interested party The interested party may exercise the rights referred to in articles 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him or her is being processed and, in this case, access to them and to the information referred to in Article 15, the correction of inaccurate data, the integration of incomplete data, the cancellation of data in the cases provided for by art. 17, the limitation of processing in the cases provided for in Article 18 GDPR. Furthermore, the interested party, in the event that the processing is based on consent or on the contract and is carried out with automated tools, has the right to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). To exercise the rights, the interested party may contact the Data Controller at the contact points indicated in paragraph 1.The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation occurred.

INFORMATION PURSUANT TO ART. 13 OF REG. (EU) 2016/679 ("GDPR") - FORM "CONTACT US"

Below is the information required by the GDPR regarding the processing of personal data provided by filling out the online form "Contact us" and taking advantage of the related customer care service.

1. Identity and contact details of the data controller

Kuvera S.p.a., c.f. and VAT number 07563710636, with registered office in Piazza dei Martiri n. 30, 80100 – Naples (NA) and operational headquarters in Interporto Lotto C, A19 – A20 – A2, 80035 - Nola (NA), e-mail address privacy@pianofortegroup.com,P.E.C address. kuvera@pec.it (hereinafter, "Data Controller").

2. Purpose of the processing, legal bases and data retention times

why are personal data processed?
To respond to your request for information or assistance
what is the legal basis that makes the processing lawful?
The execution of a contract to which the interested party is a party.
How long do we keep personal data?
The data will be kept for the time necessary to process the request and in any case no later than 1 year, unless further terms required by law.
Once the retention periods indicated above have elapsed, the Data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backup.

3. Provision of data

The provision of data marked with an asterisk is necessary for the correct management of the request; therefore, failure to provide it will not allow the sending of the same.

4. Categories of recipients.

The data may be disclosed to third parties operating as independent data controllers, such as public authorities and professional firms. The data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, such as natural and / or legal persons who carry out activities functional to the purposes indicated above (eg IT services, customer care), also operating outside the European Union ("EU").
In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (a third country deemed adequate by the European Commission pursuant to Article 45 of the GDPR by decision of 28 June 2021), as well as may be transferred to its sub-managers established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, letter .c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. In addition, the data are processed by the employees of the Data Controller - belonging to the company functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions.

5. Rights of the interested party

The interested party may exercise the rights referred to in articles 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him or her is being processed and, in this case, access to them and to the information referred to in Article 15, the correction of inaccurate data, the integration of incomplete data, the cancellation of data in the cases provided for by art. 17, the limitation of processing in the cases provided for in Article 18 GDPR. Furthermore, the interested party, in the event that the processing is based on consent or on the contract and is carried out with automated tools, has the right to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). To exercise the rights, the interested party may contact the Data Controller at the contact points indicated in paragraph 1.The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation occurred.

In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (a third country deemed adequate by the European Commission pursuant to Article 45 of the GDPR by decision of 28 June 2021), as well as may be transferred to its sub-managers established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, letter .c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. In addition, the data are processed by the employees of the Data Controller - belonging to the company functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions.

5. Rights of the interested party

The interested party may exercise the rights referred to in articles 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him or her is being processed and, in this case, access to them and to the information referred to in Article 15, the correction of inaccurate data, the integration of incomplete data, the cancellation of data in the cases provided for by art. 17, the limitation of processing in the cases provided for in Article 18 GDPR. Furthermore, the interested party, in the event that the processing is based on consent or on the contract and is carried out with automated tools, has the right to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). To exercise the rights, the interested party may contact the Data Controller at the contact points indicated in paragraph 1.The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation occurred.