Privacy & Disclaimer

1.1 Who We Are

The Data Controller is Casa Della Finanza S.p.A., registered in Italy with company number 01234567890, with its registered office at Via della Repubblica 14, 20121 Milano MI, Italy. We are authorised by the Bank of Italy and regulated under the Consolidated Banking Act (D.Lgs. 385/1993).

Where any Group subsidiary or affiliate processes personal data jointly with or on behalf of Casa Della Finanza, the specific data controller relationships are disclosed at the point of data collection or within the relevant subsidiary's own privacy notice.

1.2 Data We Collect

We collect and process personal data that you provide to us directly, data that we generate in the course of providing services to you, and in limited circumstances, data received from third-party sources where we have a lawful basis to do so.

The categories of personal data we may process include:

• Identity data: full name, date of birth, national identity number (codice fiscale), passport or identity document details, nationality.
• Contact data: postal address, email address, telephone and mobile numbers.
• Financial data: bank account details, IBAN, payment card details, credit history, income and employment information, tax identification numbers, assets and liabilities.
• Transaction data: details of payments made to or from your accounts, transaction descriptions, merchant information, and timestamps.
• Technical data: internet protocol (IP) address, browser type and version, device identifiers, time zone settings, cookie identifiers, and login credentials.
• Profile data: your username and password, investment preferences, risk appetite declarations, marketing preferences, and survey responses.
• Communications data: records of correspondence, telephone call recordings (where required by law or disclosed at the time), and electronic communications.
• Special category data: where required by law (e.g. health data for insurance or accessibility purposes), only with your explicit consent or where a legal obligation applies.

1.3 How We Use Your Data

We use your personal data for the following purposes:

1.4 Legal Basis for Processing

We rely on the following lawful bases under Article 6 GDPR for processing your personal data:

• Performance of a contract (Art. 6(1)(b)): processing necessary to provide the banking services you have requested or to take steps prior to entering into a contract with you.
• Legal obligation (Art. 6(1)(c)): processing required to comply with obligations imposed by Italian and European banking, tax, and anti-money laundering law.
• Legitimate interests (Art. 6(1)(f)): processing for our legitimate business interests, such as fraud prevention, security, and service improvement, where these are not overridden by your rights.
• Consent (Art. 6(1)(a)): for marketing communications, certain types of cookies, and any processing of special category data — where consent is required and has been obtained.

1.5 Sharing and International Transfers

We do not sell your personal data to third parties. We share your data only where necessary for the purposes described above, with the following categories of recipient:

• Service providers and processors acting on our instruction (cloud hosting, payment processing, identity verification, IT services)
• Financial institutions and payment networks required for transaction processing (SWIFT, SEPA, card networks)
• Regulatory and supervisory authorities (Banca d'Italia, Consob, Guardia di Finanza, Europol) where legally required
• Credit reference agencies for affordability and fraud assessment
• Professional advisers (lawyers, auditors, insurers) under confidentiality obligations
• Group companies within the Casa Della Finanza Group, under intra-group data processing agreements

Where we transfer personal data outside the European Economic Area, we ensure adequate safeguards are in place — including Standard Contractual Clauses approved by the European Commission, or transfers to countries with an EU adequacy decision.

1.6 Retention Periods

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Key retention periods applicable to banking data in Italy include:

• Account and transaction records: 10 years from account closure, as required by the Consolidated Banking Act
• Anti-money laundering records: 10 years from the date of the relevant transaction or business relationship (D.Lgs. 231/2007)
• Marketing consent records: until consent is withdrawn, plus 3 years for evidentiary purposes
• Call recordings: 5 years where required for investment services (MiFID II)
• Credit application data: 5 years from the date of the application decision

Upon expiry of the applicable retention period, your data is securely and irreversibly deleted or anonymised in accordance with our Data Disposal Policy.

Under the General Data Protection Regulation (EU) 2016/679 and the Italian Personal Data Protection Code (D.Lgs. 196/2003 as amended), you have the following rights in relation to the personal data we hold about you. These rights apply subject to certain legal exceptions, which we will explain if relevant to your request.

Our website and digital platforms use cookies small text files placed on your device to ensure proper functionality, analyse usage, and, where you have consented, to provide a personalised experience. This policy explains the types of cookies we use and your choices regarding them.

This Cookie Policy is issued in accordance with Article 122 of D.Lgs. 196/2003 and Provision of the Italian Data Protection Authority of 8 May 2014, as subsequently amended.