Informativa Privacy Sito

Versione 7.0

This document has been drafted pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the "Regulation") in order to inform you about how your personal data is processed when you use the website of Arca Fondi SGR S.p.A., accessible online at https://www.arcafondi.it (hereinafter the "Website").

The information and data you provide, or that is otherwise acquired in the context of your use of the services made available through the Website (e.g. subscription to the newsletter, use of the "Contact us" form, hereinafter the "Services"), will be processed in accordance with the provisions of the Regulation and its principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality.

This notice applies only to the Website of Arca Fondi SGR S.p.A. and not to any other websites the user may visit via links.

Information on the processing of personal data relating to the use of the ARCAClick Reserved Area, accessible through the Website, and of the "ArcaFondi" mobile app is provided in the Privacy Notice for the ARCAClick Reserved Area and the ArcaFondi App.

For information on the use of personal data by the Website's Virtual Assistant, please refer to its Terms of Service.

1. Data Controller and Joint Controller

The data controller is Arca Fondi SGR S.p.A., with registered office at Via Disciplini 3, 20123 Milan, Italy (hereinafter "Arca", the "Company" or the "Controller").

The Company has appointed the "data protection officer" (the so-called "Data Protection Officer") provided for by the Regulation, who can be contacted for any information concerning the processing of personal data carried out by Arca, including the list of data processors, at the following address: privacy@arcafondi.it

2. Types of data processed

Browsing data

The computer systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects but, by its very nature, could allow users to be identified through processing and association with data held by third parties. This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computing environment.

Other personal data may be collected while browsing the Website through the use of cookies and other tracking tools installed by the Company. For more information, please see the cookie policy.

Data provided by the User

This is the data that the User voluntarily transmits by sending communications (e.g. by email, to the addresses within the website domain) or by completing the relevant forms on the Website:

• personal details (first name, last name, tax code);
• contact details (for example, email address, telephone number, etc.);
• data relating to the use of the Website's Services;
• any other personal data included in the message.

In addition, when using the Website's "Work with us" feature, you may provide personal data falling within the special categories of personal data referred to in Article 9 of the Regulation, namely "[...] data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation". We remind you that, where special categories of personal data are submitted without your specific consent to the processing of such data (a situation which, in any event, still allows you to submit a curriculum vitae), Arca cannot be held liable in any way, nor be subject to any claims, since in such a case the processing will be permitted because it relates to data manifestly made public by the data subject, in accordance with Article 9(2)(e) of the Regulation. We nevertheless stress the importance, as indicated above, of giving explicit consent to the processing of special categories of personal data, should you decide to share such information. We also inform you that, for selection purposes, Arca may analyse your professional social media profiles that you have made freely available on the Internet (e.g. LinkedIn).

When using certain Services of the Website, for example the "Contact us" section, personal data of third parties sent by you to Arca may also be processed. In such cases, you act as an independent Data Controller, assuming all obligations and responsibilities under the law. In this respect, you grant the fullest indemnity against any claim, demand or request for compensation for damages arising from processing that may be made against Arca by third parties whose personal data have been processed through your use of the Website's functions in breach of the applicable data protection rules. In any event, if you provide or otherwise process personal data of third parties when using the Website, you hereby guarantee – assuming all related responsibility – that this particular processing is based on a suitable legal basis under Article 6 of the Regulation that legitimises the processing of the information in question.

3. Purposes of the processing

The processing we intend to carry out, with your specific consent where necessary, has the following purposes:

For browsing data:

1. to enable web browsing and use of the Services;
2. to obtain anonymous statistical information on the use of the Website, to check that it is working properly, to identify anomalies and/or abuse, and to establish liability in the event of any cybercrime committed against the Website or third parties.

For data provided by the user:

3. to allow you to use the online subscription service for the Arca Previdenza Open Pension Fund. For the processing of personal data provided for the subscription, please refer to the Privacy Notice of the Subscription Form;
4. to allow you to register for and access the Website's reserved area ("ARCAclick"). For the processing of personal data provided for registration to the ARCAclick reserved area, please refer to the Privacy Notice for the ARCAclick Reserved Area and the ArcaFondi App;
5. to send you (i) the "Arca Online" newsletter, which provides periodic updates on financial markets, macroeconomic analyses, studies produced by specialised firms and all information about Arca and its field of activity, and (ii) communications of a promotional, informational and/or advertising nature relating to products or services of Arca or of commercial partners, including free gifts, prize promotions, market research and notices of all initiatives dedicated to subscribers of the Reserved Area or the Newsletter. Promotional activities may also include measuring customer satisfaction with the quality of the services provided or the activity carried out by the Company, performed directly or through specialised companies by means of personal or telephone interviews and questionnaires, including through automated and non-automated means (email, SMS, MMS, mail and telephone).

   Newsletter unsubscription:

   Users who have subscribed to the "Arca Online" Newsletter through the public page of the website can cancel their subscription using the link available in the footer of each email communication.

6. to allow you to enrol in our financial education courses "Minicorsi";
7. to respond to requests for assistance or information submitted through the "Contact us" section;
8. to analyse CVs and, where appropriate, to contact again candidates who have submitted their application through the "Work with us" section.

4. Legal basis and mandatory or optional nature of the processing

The legal basis for the processing of personal data for the purposes set out in sections 3 (a), (c), (d), (f), (g) and (h) is Article 6(1)(b) of the Regulation, as the processing is necessary for the provision of the Services or to respond to requests from the data subject. The provision of personal data for these purposes is optional, but failure to provide it would make it impossible to activate the Services offered by the Website, respond to requests or evaluate CVs.

The legal basis for the processing of personal data for the purpose set out in section 3 (e) is Article 6(1)(a) of the Regulation, as the processing is subject to obtaining explicit consent. This consent may be withdrawn at any time, with effect for subsequent processing.

The legal basis for the processing of personal data for the purpose set out in sections 3 (b) and 3 (h), with regard to the analysis of professional social media profiles freely available on the Internet, is Article 6(1)(f) of the Regulation, namely Arca's legitimate interest in verifying, respectively, the proper functioning of the Website and the suitability of the candidate for the specific open position.

5. Recipients of personal data

Your Personal Data may be shared, for the purposes set out in section 3 above, with:

• parties that typically act as data processors, namely: ii) parties with whom it is necessary to interact in order to provide the Services (for example, hosting providers); iii) or parties delegated to carry out technical maintenance activities, including the maintenance of network equipment and electronic communication networks;
• parties, bodies or authorities to whom your personal data must be disclosed by law or by order of the authorities;
• persons authorised by Arca to process Personal Data as necessary to carry out activities strictly related to the provision of the Services, who have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality (e.g. Arca employees).

6. Transfers of personal data

Some of your Personal Data is shared with Recipients who may be located outside the European Economic Area. Arca ensures that the processing of your Personal Data by these Recipients is carried out in compliance with the Regulation. Transfers may be based on an adequacy decision, on the Standard Contractual Clauses approved by the European Commission or on another suitable legal basis. More information is available from Arca by writing to the following address: privacy@arcafondi.it

7. Data retention

Personal Data processed for the purposes set out in sections 3 (a) and (b) will be retained for the time strictly necessary to achieve those purposes. In any case, as these are processing activities carried out for the provision of Services, Arca will process Personal Data for the period permitted by Italian law for the protection of its interests (Article 2946 et seq. of the Italian Civil Code).

Data processed for the purposes under (e) will be retained until consent is withdrawn.

CVs submitted through the "Work with us" form will be retained for up to 2 years.

Further information on the data retention period and on the criteria used to determine that period may be requested by writing to Arca at the following address: privacy@arcafondi.it

8. Rights of data subjects

Pursuant to Articles 15 et seq. of the Regulation, you have the right to ask Arca, at any time, for access to your Personal Data, for its rectification or erasure, or to object to its processing; you also have the right to request restriction of processing in the cases provided for in Article 18 of the Regulation, and to obtain, in a structured, commonly used and machine-readable format, the data concerning you, in the cases provided for in Article 20 of the Regulation.

Requests should be sent in writing to Arca at the following address: privacy@arcafondi.it

In any case, you always have the right to lodge a complaint with the competent Supervisory Authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali), pursuant to Article 77 of the Regulation, if you believe that the processing of your Personal Data is contrary to the applicable legislation.

9. Changes

This notice has been in force since 17/07/2025. Arca reserves the right to amend or simply update its content, in whole or in part, including as a result of changes in the applicable legislation. Any changes introduced will be binding as soon as they are published on the Website. Arca therefore invites you to visit this section regularly to view the latest version of the notice and to stay up to date on the personal data collected and how it is used.