PRIVACY POLICY NOTICE

Introduction

This Privacy Policy describes how ROYALTEX S.R.L., with registered office at
Via Carrali, 15 – 24020 Casnigo (BG), VAT IT02984480166, as the data controller,
collects, uses, stores, and protects the personal data of users visiting the website
www.bertasa.com (hereinafter, the “Site”), used by Bertasa S.p.A.,
a company of the Royaltex Group, for the presentation of its activities and services.

This Policy complies with Italian and European regulations on personal data protection,
in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

Data Controller

The data controller of personal data is:

ROYALTEX S.R.L.
Via Carrali, 15 – 24020 Casnigo (BG)
VAT: IT02984480166
Email: info@bertasa.com

Bertasa S.p.A., as a company of the Royaltex Group using the Site for the
presentation of its textile solutions for high-end hospitality, operates on behalf of the
controller and may process personal data as an authorized/appointed entity under the
current regulations.

Data Collected

The personal data that may be collected through the Site include:

• Identification and contact data: name, surname, email address, phone number, any business role, and name of the establishment/company, if provided through contact forms or direct communications.
• Data related to requests and commercial relationships: information contained in messages sent through the Site (e.g., requests for information, quotes, collaboration proposals), as well as data related to any contractual relationships subsequently established.
• Browsing data: IP address, information related to the device used, operating system, browser, timestamp, and other information collected through cookies and similar tools. For more details, see the Cookie Policy.

Purpose of Processing

Personal data is processed for the following purposes:

a) Management of requests sent through the Site

• respond to requests for information, quotes, commercial contacts, or support requests sent through the forms on the Site or via email;
• manage any pre-contractual and contractual phases in B2B relationships with hotels, hospitality facilities, and other clients.

b) Legal, fiscal, and administrative compliance

• comply with obligations set by laws, regulations, community legislation, as well as instructions given by competent authorities;
• manage administrative, fiscal, and accounting aspects related to established contractual relationships.

c) Marketing and communication activities (with prior consent where necessary)

• send commercial communications, newsletters, updates on products and services of the Royaltex Group and Bertasa S.p.A. dedicated to the high-end hospitality sector, via email or other digital communication tools, in accordance with the preferences expressed by the user.

d) Analysis and improvement of the Site

• analyze the use of the Site and monitor its proper functioning;
• improve content, features, and services offered, also through the use of cookies and statistical tools (within the limits indicated in the Cookie Policy).

Legal Basis for Processing

Depending on the case, the legal basis for processing is represented by:

• the execution of pre-contractual or contractual measures requested by the user (Art. 6, para. 1, letter b GDPR);
• compliance with legal obligations to which the controller is subject (Art. 6, para. 1, letter c GDPR);
• the legitimate interest of the controller in the proper functioning of the Site and the development of its B2B activity in the textile sector for hospitality (Art. 6, para. 1, letter f GDPR);
• the user’s consent, where required for specific activities (e.g., direct marketing via newsletters).

Processing Methods and Security

Personal data is processed manually, electronically, and telematically, in compliance with the principles
of lawfulness, fairness, and transparency as provided by the GDPR. ROYALTEX S.R.L. adopts appropriate technical and
organizational measures to ensure the security of personal data and protect it from unauthorized
access, loss, destruction, or improper disclosure.

Data Retention

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected and, in any case:

• for managing contact requests and information: for the time necessary to properly handle the request and for a reasonable subsequent period for any further related communications;
• for managing contractual relationships: for the entire duration of the relationship and, subsequently, for the period provided by civil, fiscal, and accounting regulations;
• for marketing activities: until consent is withdrawn and/or a request for deletion is made by the data subject;
• for browsing data: as indicated in the Cookie Policy and in line with the technical retention terms of logs and analysis tools used.

Data Communication

Personal data may be communicated, within the limits of the purposes indicated above, to:

• companies of the Royaltex Group, including Bertasa S.p.A., as authorized/appointed entities for processing;
• IT and hosting service providers supporting the operation of the Site and the controller’s information systems;
• consultants and professionals (e.g., tax, legal consultants) for compliance related to business management;
• third parties, public or private, in cases where communication is mandatory by law or requested by competent authorities.

These entities will process the data as independent controllers or as data processors,
duly appointed pursuant to art. 28 GDPR. The data is not subject to indiscriminate dissemination.

Transfer of Data to Third Countries

If some service providers (e.g., analytics tools or newsletter platforms)
involve the transfer of personal data to non-EU countries, such transfer will occur in
compliance with Articles 44 and following of the GDPR, through the adoption of appropriate safeguards (e.g., European Commission adequacy decisions, standard contractual clauses).

Rights of Data Subjects

The user, as a data subject, has the right to:

• obtain confirmation of the existence or non-existence of personal data concerning them and access it;
• request the rectification or updating of inaccurate or incomplete data;
• request the deletion of personal data in cases provided by law;
• request the restriction of processing;
• object, in whole or in part, to the processing of personal data based on legitimate interest, as well as to processing for direct marketing purposes;
• request the portability of personal data provided, where applicable;
• lodge a complaint with a competent supervisory authority (in Italy, the Data Protection Authority).

To exercise these rights, you can send a request to the email address:
info@bertasa.com

Changes to the Privacy Policy

ROYALTEX S.R.L. reserves the right to update or modify this Privacy Policy at any
time. Any changes will be published on this page and will become effective from the date of
publication. Users are therefore invited to periodically consult this section.

Contacts

For any questions regarding this Privacy Policy or to exercise the rights provided by data protection regulations,
you can contact:

ROYALTEX S.R.L.
Via Carrali, 15 – 24020 Casnigo (BG)
Email: info@bertasa.com