App Privacy Policy

ver. 1.1APP21

PRIVACY POLICY

MORELLATO SPA, with registered office at Via Commerciale n. 29, 35010 Santa Giustina in Colle, Padua, Italy, tax code/VAT number IT13442590157 ("MORELLATO SPA"), provides e-commerce services and sells products through the Website.

We invite you to read our Privacy Policy, which applies whenever you use the smartwatch (device) and/or the App installed on your smartphone. We also invite you to read the App's General Terms of Use, as they also contain information on privacy and on the security systems adopted by the device and the App.

Any processing of personal data of users of the website/device/app will take place in Italy in compliance with current European legislation (General Data Protection Regulation (GDPR) No. 2016/679), which governs the processing of personal data carried out by anyone residing or based in Italy, as well as by Legislative Decree 196/2003 as subsequently amended and supplemented.

This policy describes exclusively the processing of personal data for which Morellato S.p.A. acts as data controller, as well as relevant information regarding data processed directly on the device or by third parties.

1. OUR POLICY

Everyone has the right to the protection of their personal data. MORELLATO SPA respects the right of its users to be informed about the collection and processing of their personal data. We are always committed to respecting the principle of strict necessity in the processing of data that may identify you, even indirectly. For this reason, we have configured the Website and the App to ensure the minimum possible use of your personal data, thereby excluding processing when the purposes pursued in individual cases can be achieved through the use of anonymous data or by other means allowing identification of the data subject, only in cases of necessity or upon request by authorities or law enforcement. This Privacy Policy provides useful information for understanding how information identifying users of the Device or App is collected and used. For further information about our Privacy Policy, you can send requests by email to privacy@morellato.com.

If you are a minor, your legal guardian must consent to your use of this application and accept the terms of service of the relevant application. Parents and guardians must also take appropriate precautions to protect minors, including supervising their use of this application.

The specific age at which a guardianship agreement is required may vary depending on the specific legislation of the country in which use will take place.

2.IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND THE DATA PROTECTION OFFICER (DPO)

MORELLATO SPA, with registered office in Santa Giustina in Colle (PD), Via Commerciale, 29, Fratte, VAT number 13442590157, is the Data Controller of the Personal Data of App/Website users, for the management and execution of commercial transactions and commercial communications through this App (the "Purpose").

If you wish to receive further information on how MORELLATO SPA processes your personal data, please write an email to the following address:privacy@morellato.com. To learn about your rights and stay updated on legislation regarding the protection of individuals with regard to the processing of personal data, we recommend visiting the website of the Italian Data Protection Authority (Garante per la protezione dei dati personali) at http://www.garanteprivacy.it/.

The Data Protection Officer (DPO), pursuant to Articles 37 et seq. of Regulation (EU) 2016/679, appointed by the Company is Adriaflor S.r.l., with registered office in Cervignano del Friuli, Via San Francesco n. 33 (identified as the contact person for the Data Controller: attorney Enrico Menin), domiciled for this purpose at the offices of Morellato SPA and reachable for any matter relating to the processing of your personal data and for the exercise of your rights at the following email address:dpo@morellatogroup.com.

3.PURPOSES AND RETENTION PERIOD OF YOUR PERSONAL DATA

Morellato S.p.A. does not access or process personal data relating to health and physical activity generated by the device, which remain stored locally on the user's device.

We clarify from the outset that the App does not use user profiling tools, but technical tools for monitoring and analyzing functionality may be used, as specified below.

3.1Access to and Use of the App or Device

When you access the App or your device, Morellato S.p.A. does not collect or process personal data relating to use of the device, except as indicated below.

The user who uses the device or the app has the ability to enter their own personal data, including sensitive data (personal data such as name, height, weight, age, gender, as well as the profile image uploaded from the gallery or camera app upon the user's authorization).

When you change the background image of the watch face or use the remote shutter function, we must request and obtain your authorization to complete the shot, so that the image can be used as the smartwatch's watch face image. If you do not need these services, you can disable this authorization at any time, without affecting the use of other services.

Such personal data will not be processed by us in any way, as it will not be saved on any server and we will not have access to it under any circumstances.

Such data is processed exclusively at the local level on the user's device and is not accessible to or transmitted to Morellato S.p.A.

This data is processed by your device and may be synchronized solely for the purpose of providing feedback on physical activity and offering a better health management service. This data includes activities such as: types of information on sports activity, on the activity itself, on sleep, heart rate, blood oxygen saturation, blood pressure, weight, pace, and duration of exercise.

Any synchronization features depend on the operating system or third-party applications and are not managed by Morellato S.p.A.

In order to provide better sports health services, the device needs to locally collect some basic personal data (age, date of birth, gender, height, weight) or account information (avatar, nickname) and, for the same purposes, this device may generate locally data relating to physical activity and health (e.g., steps, heart rate, sleep).

Below are the categories of data that may be collected or generated by the device locally but which always remain under the user's exclusive control:

• sports health information (such as: number of steps, heart rate, blood oxygen saturation, sleep, exercise, and other monitoring data);

• application information (basic application information, application usage information, account login information, etc.);

• location information (precise location information, movement trajectory, etc.);

• device information (basic system information, device name, device identifier, IMEI, MAC address, system log, system usage information, device usage information, IMSI, Android ID, hardware serial number, SIM card identifier, etc.);

• mobile phone model;

• system language configuration (the application is configured to monitor system broadcasts and may interact with the operating system to ensure the correct functioning of auto-start features);

• system version number;

• Bluetooth information.

This information can help calculate sports data more accurately for different devices. Health and sports information is used for local storage and display to users, who can easily query historical data.

To address app stability, we will introduce relevant Google libraries, which need to collect information on installed applications, device information (device model, system version, screen resolution), app usage, crash reports, performance monitoring, and other related information. This information can help us analyze the causes of app crashes, better identify problems, and make the app safer and more stable.

Morellato Group APPs such as SECTOR&MORELLATO smartwatches and Chronostar smartwatches may transfer to Google Fit data relating to steps, distance, calories, heart rate, blood pressure, oxygen saturation, workout sessions, and sleep, if the transfer of data to this app is authorized.

Such transfer takes place exclusively at the user's initiative and under their control.

For processing related to the technical operation of the App (e.g., usage logs, error reports, use of third-party SDKs and libraries):

• some technical data may be processed by third parties, in particular by Google LLC, based in the United States;

• these parties may act, depending on the service used, as independent data controllers or data processors;

• should any data be processed by Morellato S.p.A., the legal basis is the controller's legitimate interest in ensuring the correct functioning, security, and improvement of the App;

• for processing carried out by the aforementioned third parties (Google LLC), please refer to the privacy policy indicated below;

• should Morellato S.p.A. process any data, it is retained for the time strictly necessary to achieve the purposes indicated above, and in any case for no longer than 12 months;

• any transfers of data to third-party applications or services activated by the user (e.g., integration with health services) take place exclusively at the user's initiative and under their control;

• please consult the following link for the complete policy on rules relating to user data for Google API services and on the processing carried out by Google LLC (https://developers.google.com/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes), including limited use requirements.

If you wish to receive notifications on your device when you receive an SMS, email, or an app alert, you must enable this option in the app settings. For certain features to work correctly, the app requires access to your contacts. Please note that settings relating to your contacts, including your address book, will remain on your mobile device and will not be accessible by us. Furthermore, we do not store the content of notifications, but merely log their receipt.

3.2 Device repair

Your personal data may be processed only if it becomes necessary to provide you with assistance in the event of a device malfunction or if the device is sent for repair.

Since it is not necessary to enter your first and last name or other personal data that, aggregated with other data, could identify or make you identifiable within the app, there may be no data processing even in this case. Nevertheless, we deemed it appropriate to draft this notice to ensure maximum transparency even in such unlikely cases.

Such processing is limited to the data strictly necessary for managing the assistance request.

Below is a list of the data that may be processed:

✔Obligation and consequence of failure to communicate your personal data.

Providing personal data is mandatory for the purposes described above. Refusal to provide the above personal data will make it impossible to repair the device.

✔Retention period of the personal data we process.

Processing begins at the time the data is collected, and the data will be retained by us for the time strictly necessary to achieve the purposes indicated above, and in any case within two years from the date such data is acquired.

In detail:

• data contained on the device will not be retained or communicated in any way, either by us or by the repair technician who will carry out the repair of the product, other than for a short term only;

after the retention period indicated has elapsed, such data is automatically deleted or communicated by transmission to the data subject within their device.

✔Recipients or categories of recipients of personal data.

In this regard, please refer to what is specified below in the relevant section.

✔Cookies and other tracking systems.

We also clarify that our App does not use cookies or other tracking systems in relation to after-sales repair.

4.WHO WE SHARE YOUR PERSONAL DATA WITH AND TRANSFERS OUTSIDE THE EU

✔Categories of recipients of personal data.

Your data, if processed, may be handled by third parties that provide repair services for your device. Please remember that your personal data is an important part of our work, and it is not our practice to communicate it to third parties. Therefore, personal data processed exclusively for the purposes indicated above will be communicated within the Morellato Group and may be brought to the attention of its employees and/or collaborators (appointed in writing as authorized people pursuant to Article 2-quaterdecies, paragraph 2, of Legislative Decree 196/2003), as well as communicated to the following parties appointed as data processors pursuant to Article 28 GDPR:

• companies that provide assistance services for the repair of your device;

• companies that provide virtual assistance services, real-time chat, or management of user interaction.

✔ Transfer outside the EU.

Your personal data, as indicated above, will not be stored on any server, either within or outside the European Union, except as specified above(1). In such case, some technical data processed through third-party components may be transferred to countries outside the European Economic Area, in compliance with the safeguards provided for by applicable legislation.

Below you can find more information on the type of information tracked by Google Analytics and how to withdraw your consent:

• Google: Google Analytics is used to track statistics and user demographics, interests, and behavior. Find out more information about how this analytics information may be used, how to control the use of your information, and how to opt out of having your data used by Google Analytics.

(1)By way of example: relevant Google libraries that need to collect information on installed applications, device information (device model, system version, screen resolution), app usage, crash reports, performance monitoring, other related information, and information relating to the APP's performance.

5.SECURITY MEASURES

Your data, if present on the device delivered for repair, will also be processed using IT, telematic, paper, and manual tools, in compliance with the confidentiality and security standards established by law.

We have adopted security measures in order to minimize the risk of destruction or loss, even accidental, of data, of unauthorized access, or of processing that is not permitted or not compliant with the purposes of collection indicated in our Privacy Policy.

However, since it is not possible to guarantee that the measures adopted for the security of the Website and the transmission of data and information on the Website will limit or exclude any risk of unauthorized access or data loss, we invite you to make sure your computer is equipped with up-to-date antivirus software to protect both incoming and outgoing data transmission, and that your Internet service provider has adopted firewalls and spam filters adequate for the security of data transmission on the web.

6. LINKS TO OTHER WEBSITES OR INTEGRATION WITH THIRD-PARTY PLATFORMS AND FEATURES

Our App does not provide links to third-party websites and does not contain third-party content, except in the following cases:

• Location authorization may be requested through our Smartwatch Apps on the Google Play Console or the iTunes App Store. If the user consents to share their location with the App, it is used exclusively to enable the weather function and to improve the user experience. It is not stored or collected on any server to which Morellato has access, and there is no other reason to collect it. Location data is processed exclusively to provide the requested features and in compliance with the device's settings. The user can also choose not to share their location by disabling location sharing settings from the iOS or Android menu at any time. When using sports route generation, Bluetooth device search, weather notifications, or other location-based search functions, you can choose to enable location permissions to determine your current position. At the same time, you can obtain more accurate sports routes, search for nearby Bluetooth devices, and find weather forecasts for the city you are in.

• Bluetooth usage authorization: both location authorization and Bluetooth usage authorization are used for low-energy Bluetooth devices in order to facilitate the connection of the smartwatch and the communication of Bluetooth data.

• Network authorization: network authorization is used to collect application error logs, detect smartwatch version updates, access the account, etc.

• Access to device information status: this is actually used to verify the user's device information and identify its model (basic system information, device name, device identifier, IMEI, MAC address, system log, IMSI, Android ID, hardware serial number, SIM card identification, etc.).

• Call permissions: when using the smartwatch to make calls, reject calls, receive call information, and other functions, you can choose to enable this authorization to obtain phone status. If you do not accept this authorization, call reminder-related functions may not work correctly.

• Call history permissions: when using the smartwatch to view missed call numbers, check call volume and channels, you can choose to enable this authorization to view missed call numbers on the paired device and synchronize call status. If you do not need these services, you can disable this authorization at any time, without affecting the use of other services.

• Address book permissions: when using the contact synchronization function, you can choose to enable this authorization to quickly add phone contacts to the address book, so that they are synchronized with the smartwatch in the app and allow calls to be made directly. If you do not need these services, you can disable this authorization at any time, without affecting the use of other services. It does not affect the use of other services.

• Storage authorization: when using Over-The-Air firmware updates, manual access, and other functions that require local storage, you can choose to enable this authorization to read or write relevant data, so that users can view historical data in the APP at a later time.

The functions described above can be disabled at any time and do not affect the use of other App services.

7. RIGHT OF ACCESS TO DATA AND OTHER RIGHTS

Pursuant to Articles 15 to 22 of the GDPR, the user always has the right to obtain confirmation as to whether or not personal data concerning them exists, even if not yet recorded, and its communication in an intelligible form. You also have the right to obtain information about the origin of your personal data, the purposes and methods of processing, the logic applied in the case of processing carried out with the aid of electronic tools, the identifying details of the controller and processors, and an indication of the parties or categories of parties to whom the personal data may be communicated or who may become aware of it, such as processors or persons in charge of processing. Some of this information is contained in our Privacy Policy; to find out more, you can send an email to privacy@morellato.com. You always have the right to obtain from MORELLATO S.P.A.:

• the updating, rectification, or, where relevant to you, the completion of your personal data;

• the erasure, transformation into anonymous form, or blocking of personal data concerning you that has been processed unlawfully, including data that does not need to be retained for the purposes for which it was collected or subsequently processed;

• confirmation that the operations described above have been brought to the attention, including as regards their content, of those to whom the data has been communicated or disseminated, except where this proves impossible or involves a use of means manifestly disproportionate to the right protected;

• data portability and restriction of processing, as well as the right to withdraw consent at any time.

You also have the right to object, in whole or in part:

• for legitimate reasons, to the processing of personal data concerning you, even where relevant to the purpose of the collection;

• to the processing of personal data concerning you for the purposes of sending advertising or direct marketing material, or for conducting market research or commercial communication.

Finally, we remind you that you have the right to contact the Italian Data Protection Authority (Garante per la protezione dei dati personali) (whose contact details are available at the following link: https://www.garanteprivacy.it/home/footer/contatti), in order to exercise your rights in relation to the processing of personal data.

You may freely exercise your rights at any time, within the limits provided by law, by sending a request to MORELLATO S.P.A. at the email address privacy@morellato.com, to which we will provide an appropriate response.

7-bis. ACCESS TO DATA GENERATED BY THE DEVICE

Data generated by the device:

• is directly accessible to the user through the App;

• remains under the user's control;

• may be shared with third parties at the user's initiative.

Morellato S.p.A. does not access such data, nor does it limit the user's use of it.

The path for downloading and exporting data can be found in the Personal Section (Me) -> Export Data -> Selection of different data by category. The exported file will be in .txt format.

8. APPLICABLE LAW

This Privacy Policy is defined on the basis of the GDPR. The GDPR ensures that the processing of personal data takes place in compliance with the fundamental rights and freedoms, as well as the dignity, of the data subject, with reference to confidentiality, personal identity, and the right to the protection of personal data.

9. CHANGES AND UPDATES TO THE WEBSITE'S PRIVACY POLICY

Morellato S.P.A. may modify or simply update, in whole or in part, the Website's Privacy Policy, including in consideration of changes to the laws or regulations governing the matter and protecting your rights. Changes and updates to the website's Privacy Policy will be notified to users on the site's homepage as soon as they are adopted and will become binding as soon as they are published in this same section. We therefore invite you to regularly access this section to check for the publication of the App's most recent and updated Privacy Policy.