PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

PURSUANT TO ART. 13 OF EUROPEAN REGULATION 2016/679

The company ESPOSIZIONE INTERNAZIONALE CICLO E MOTOCICLO S.p.A. (hereinafter referred to as  “EICMA S.p.A.” for brevity) hereby informs you that the personal data collected during the registration process  for the purchase of ticket(s) to attend the Event as a Visitor will be processed in compliance with applicable  data protection laws. Accordingly, pursuant to Article 13 of European Regulation 2016/679, E.I.C.M.A. S.p.A.  provides the following information.

1. CONTACT INFORMATION OF THE DATA CONTROLLER

The Data Controller is E.I.C.M.A. S.p.A., with  registered office at Via A. da Recanate, 1, 20124, Milan, VAT No. 04145450153 – email: [email protected].  The Data Controller has not currently appointed a Data Protection Officer (DPO).

2. PURPOSES AND LEGAL BASIS OF THE PROCESSING

a) The data provided by the user/visitor, hereinafter also referred to as the “Data Subject” (first name, last  name, email, date of birth, phone number, address, personal identification data) are processed to enable the  Data Subject to purchase a named ticket for admission to the EICMA event and to offer and manage the  services requested in connection with such purchase (e.g., pre- and post-sale customer service, responses  to requests for information, product evaluations, payment processing, communications in the event of  emergency measures, etc.). The legal basis for the processing described above consists of the performance  of the contract to which the data subject is a party and legal obligations for purposes related to the services  requested in connection with the purchase of the ticket. 

b) If the user/visitor requests to stay in contact with the Data Controller to receive information about promotional  initiatives (promotions, discounts, contests, surveys, and other marketing activities)—including those related  to the EICMA Event—the user/visitor must provide their email address and any additional data requested,  which will then be used for that purpose, without prejudice to the user/visitor’s right to indicate at any time that  they no longer wish to receive such communications. The legal basis for the processing described above is  the user/visitor’s express consent. 

c) The data provided by the user/visitor to the Data Controller and collected based on their interests and  purchasing preferences will be processed for purposes related to marketing and personalized commercial and  promotional communications to enhance their experience at the EICMA Event. The legal basis for the  processing described above is the user’s/visitor’s express consent. 

Promotional email communications sent by the Data Controller may contain tracking technologies, such as  tracking pixels, web beacons, or similar technologies. These technologies may allow the Data Controller to  collect information regarding the data subject’s interaction with the communication. Depending on the  interaction and the technical configuration, the information collected may include: whether the email was  opened; the date and time of the interaction; whether any links contained in the email were clicked; technical  information regarding the device, browser, email client, and operating system used to access the  communication; the IP address and/or other technical identifiers, where available and necessary for the  purposes described below. 

Where required by applicable data protection laws, the use of personalized email tracking technologies is  based on the data subject’s prior consent. Consent to email tracking is optional and may be revoked or  modified at any time, without affecting the lawfulness of the processing carried out prior to the revocation. 

The data subject may withdraw consent to email tracking regardless of their choice to receive promotional  communications by contacting the Data Controller at [email protected]. 

Withdrawal of consent to email tracking does not, in and of itself, result in the data subject being removed from  the list of recipients of promotional communications. The data subject may separately withdraw consent to  receive marketing communications by contacting the Data Controller or, alternatively, by taking action directly  in the footer of the communications received. 

For the sake of completeness, please note that data lawfully collected in accordance with the law may also be  used for statistical analysis in anonymous form.

3. RECIPIENTS OR CATEGORIES OF RECIPIENTS TO WHOM PERSONAL DATA MAY BE DISCLOSED

The data may be disclosed to third parties acting in support of and on behalf of the Data Controller solely for  the purposes listed above, in accordance with contractual and legal obligations. Administrative staff, as well  as those responsible for the management and maintenance of the processing systems, may have access to  the data. Disclosure to the aforementioned parties will, in any case, be made with a guarantee of protection of  the data subject’s rights as provided for in the GDPR. A list of any data processors is available from the Data  Controller. Please note, however, that for the issuance of tickets through this sales channel, the company  Platinium Group S.A.M., registered in Monaco under number 06S04539, with address: 2 Rue du Gabian,  98000 Monaco, is responsible for managing the technological infrastructure that enables ticket purchases and  the processing of data collected through such technological tools. 

Data provided for marketing purposes may also be disclosed or transferred to third-party partners of the Event  (including, but not limited to, the main partners listed on the E.I.C.M.A. S.p.A. website: https://www.eicma.it/)  so that they may use such data directly to send their commercial communications, only upon the user’s specific  consent.

4. POSSIBLE TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY

Any transfer of data outside the  EU will take place in full compliance with the levels of protection and safeguards provided for in the GDPR.

5. RETENTION PERIOD FOR PERSONAL DATA OR CRITERIA USED TO DETERMINE SUCH PERIOD

Data will be retained in a form that allows for the identification of data subjects for a period no longer than is  necessary to fulfill the purposes of the processing, consistent with other legal obligations, and in accordance  with the data retention procedure adopted by the Data Controller. The data subject may request information  regarding the retention period of their personal data at any time by writing to the following address: [email protected]. Information collected through email tracking technologies will be retained only for the period  necessary to achieve the purposes described in Section 2c and in accordance with the Data Controller’s applicable data retention policy. If email tracking data is processed on the basis of consent, such processing  will cease upon withdrawal of consent, without prejudice to the retention of information that the Data Controller is required to retain under applicable law or that is necessary to establish, exercise, or defend a legal claim.

6. RIGHTS OF THE DATA SUBJECT

As provided for in Article 13 of the GDPR, the Data Subject may exercise the following rights at any time: 

a) Right of access, rectification, erasure, restriction, and objection: The data subject may access their data at  any time, request its rectification if it is incorrect, request the erasure of redundant data—but not of data  required by law—from the data controller, and may restrict access to the data to certain individuals; 

b) b) right to data portability: The data subject has the right to receive the personal data concerning him or her,  which he or she has provided to a data controller, in a structured, commonly used, and machine-readable  format, and has the right to transmit such data to another data controller without hindrance from the data  controller to whom he or she provided the data, exclusively in the cases provided for in Article 20 of the GDPR; 

c) Right to withdraw consent at any time: the Data Subject may withdraw consent at any time, assuming the  consequences thereof, without prejudice to the Data Controller’s obligation to continue retaining the personal  data subject to this processing when necessary to comply with a legal obligation of the Data Controller or for  the performance of a task carried out in the public interest or in the exercise of official authority vested in the  Data Controller. 

d) the right to lodge a complaint with a data protection supervisory authority. 

e) With regard to the marketing purposes referred to in paragraphs 2(b) and 2(c), the data subject who has  provided consent retains the right: i. to request, at any time and free of charge, that the Data Controller send  communications exclusively through traditional contact methods such as paper mail or calls via an operator;  ii. to object, at any time and free of charge, to the processing of their personal data for the aforementioned  purposes. In this case, the data subject’s right to object to the processing of their personal data through  automated means of contact (e.g., email, MMS or SMS messages, and social media, etc.) extends to traditional  means of contact; iii. to object, at any time and free of charge, to the processing of their personal data for the  aforementioned purposes only in part—that is, by specifying their preference regarding the methods of contact. 

f) With regard to the marketing purposes referred to in paragraphs 2(b) and 2(c), the data subject retains the  right to object, at any time and free of charge, to the processing of their personal data for the aforementioned  purpose. 

With specific reference to email tracking technologies, the data subject may revoke or modify their consent to  personalized email tracking at any time, without revoking their consent to receive promotional communications. 

This can be done by contacting the Data Controller at [email protected]. Withdrawing consent to email tracking  and withdrawing consent to receive promotional communications are independent choices. 

To exercise your rights, please write to [email protected].

7. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION

The provision of data marked with an  asterisk is mandatory given the nature of the contractual relationship established between the user/visitor and  the Data Controller regarding the requested services, including those related to ticket purchases. The provision  of data for the purposes of the Data Controller’s or third parties’ marketing, email tracking technologies, and  analysis of purchasing preferences (personalized marketing) is optional. 

8. CONSEQUENCES OF A REFUSAL TO PROVIDE DATA

If the user/visitor refuses to provide the  mandatory data requested in connection with the requested services—including those related to ticket  purchases—the Data Controller will be unable to provide its services. However, there are no consequences  for failing to provide optional data, except for the inability to receive personalized and/or general promotional  communications.

9. EXISTENCE OF PROFILING ACTIVITIES OR AUTOMATED DECISION-MAKING PROCESSES, LOGIC USED, AND CONSEQUENCES FOR THE DATA SUBJECT.

Within the limits set forth in this policy, the Data  Controller performs profiling activities on the Data Subject related to marketing activities: these will be carried  out in accordance with the GDPR, and the Data Subject may object at any time by writing to [email protected].

10. UPDATES

This privacy notice may be updated to reflect regulatory, organizational, or technological  changes. The current version is available on the website, and if the changes significantly affect processing  based on consent, data subjects will be informed in an appropriate manner. 

Last updated: September 11, 2026 

EICMA S.p.A.