Privacy Notice – ARCAClick Reserved Area and Arca Fondi App

This document has been drafted pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the "Regulation") in order to inform you about how your personal data is processed when you use the ARCAClick Reserved Area Service (hereinafter the "Reserved Area", "ARCAClick" or the "Service") on the website of Arca Fondi SGR S.p.A., accessible online at https://www.arcafondi.it (hereinafter the "Website"), and through the use of the "Arca Fondi" application (hereinafter the "App").

For information on the use of personal data by the Virtual Assistant of the Reserved Area, please refer to its Terms of Service.

1. Data Controller and Joint Controller

The data controller is Arca Fondi SGR S.p.A., with registered office at Via Disciplini 3, 20123 Milan, Italy (hereinafter "Arca", the "Company" or the "Controller").

The Company has appointed the "data protection officer" (the so-called "Data Protection Officer") provided for by the Regulation, who can be contacted for any information concerning the processing of personal data carried out by Arca, including the list of data processors, at the following address: privacy@arcafondi.it.

In the context of the Service, with exclusive reference to the processing of data of subscribers to Sidera Funds SICAV, with registered office at 3 Rue Jean Piret, L-2350 Luxembourg, Arca acts as Joint Controller pursuant to Article 26 of the Regulation.

In this regard, please note that Arca and Sidera Funds SICAV have entered into a specific agreement defining their respective responsibilities for compliance with the obligations arising from the Regulation.

It is understood that, regardless of the agreement, you may in any case exercise the rights recognised to you by the Regulation, as set out in section 8, against each Joint Controller, in relation to the processing for which they act in that capacity.

Information on the essential content of the agreement is available here.

2. Types of data processed

The types of personal data that Arca processes in order to enable you to use the Service are described below.

Registration data

When you complete the registration form for the Reserved Area, Arca collects the following personal data directly from you:

• personal details (first name and last name, date of birth, tax code);
• contact details (email address and telephone number);
• access and identification data (Arca code, login credentials);
• privacy consents (promotional communications, profiling, disclosure of data to third parties).

Browsing data

Arca collects access logs and browsing logs for the Reserved Area, through the website and the app, in which the following data associated with the user's personal account are recorded:

• the IP address or domain names of the computers used by the user to access the Reserved Area, from which the User's location is inferred;
• the URI (Uniform Resource Identifier) addresses of the requested resources;
• the time of the request;
• the method used to submit the request to the server and the size of the file obtained in response;
• the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the User's operating system and computing environment;
• the use of the features available in the Reserved Area (activity logs).

Financial data

Arca processes financial information relating to the investment and supplementary pension products subscribed to by the User (e.g. assets, returns, transfers of funds, investment objectives).

Data voluntarily provided by the data subject (including special categories of personal data)

When you use the Service, and in particular the transactional functions for managing your membership of the Pension Fund, Arca may process the following data, for example: change of address/residence, change of investment option, declaration of non-deducted contributions, requests for advances, redemptions, benefits.

To handle requests for advances relating to the Pension Fund, it may be necessary to provide health data. The processing of data belonging to special categories takes place on the basis of the data subject's prior and explicit consent.

When using certain Services of the Website, personal data of third parties sent by you to Arca may be processed. In such cases, you act as an independent Data Controller, assuming all obligations and responsibilities under the law. In this respect, you grant the fullest indemnity against any claim, demand or request for compensation for damages arising from processing that may be made against Arca by third parties whose personal data have been processed through your use of the Website's functions in breach of the applicable data protection rules. In any event, if you provide or otherwise process personal data of third parties when using the Website, you hereby guarantee – assuming all related responsibility – that this particular processing is based on a suitable legal basis under Article 6 of the Regulation that legitimises the processing of the information in question.

3. Purposes of the processing

The processing of the data listed in the previous section has the following purposes:

1. to allow you to register for and access, through the Website and the App, the Reserved Area and its related informational and transactional features, as well as, in the event of loss of your login credentials, to activate the procedure that allows you to recover and reset your password;
2. to respond to any requests for support or information you submit through the "Support" section;
3. to notify you that content and documents of interest to you and to the Company are available in the Reserved Area;
4. to protect the rights and interests of the Company or of third parties, both in court and out of court;
5. to send you:
   1. the "Arca Online" newsletter, which provides periodic updates on financial markets, macroeconomic analyses, studies produced by specialised firms and all information about Arca and its field of activity;
   2. communications of a promotional, informational and/or advertising nature relating to products or services of Arca or of commercial partners, including free gifts, prize promotions, market research and notices of all initiatives dedicated to subscribers of the Reserved Area or the Newsletter.

   Promotional activities may also include measuring customer satisfaction with the quality of the services provided or the activity carried out by the Company, performed directly or through specialised companies by means of personal or telephone interviews and questionnaires, including through automated and non-automated means (email, SMS, MMS, mail and telephone).

   Newsletter unsubscription

   For users who have subscribed to the "Arca Online" Newsletter when signing up for the "ARCAclick" service, or at a later time through their "ARCAclick" profile, the subscription may be withdrawn at any time from the User's personal profile on the "ARCAclick" platform, as indicated in the footer of each email communication;

6. to carry out profiling activities, such as the analysis of the User's investment habits or choices, mainly by processing the data entered at the time of registration or possibly when amended and/or supplemented using the "ARCAclick" service, or in other cases of interaction with Arca. The information thus obtained will allow Arca to create profiles (individual and/or aggregated) of Users, in order to carry out market analyses and statistics, also to improve Arca's products and services and make them more responsive to Users' needs, as well as to send the User – always and only with their consent – more targeted information and offers that may be, in Arca's judgement, of greater appeal and interest to the User;
7. to disclose the data, for marketing purposes, to third parties who organise commercial and promotional events and initiatives, as well as to Arca's commercial partners (such as, for example, the banks that distribute Arca products), in order to receive advertising and/or informational material on products, services and commercial initiatives/proposals.

4. Legal basis and mandatory or optional nature of the processing

The legal basis for the processing of personal data for the purposes set out in sections 3 (a), (b), (c) is Article 6(1)(b) of the Regulation, as the processing is necessary for the provision of the Services or to respond to requests from the data subject. The provision of personal data for these purposes is optional, but failure to provide it would make it impossible to use the Service.

The legal basis for the processing of personal data for the purpose described in section 3 (d) is Article 6(1)(f) of the Regulation, as the processing is based on the legitimate interest of the Controller in verifying the proper functioning of the Service and protecting itself against any claims.

The legal basis for the processing of personal data for the purposes described in section 3 from (e) to (g) is Article 6(1)(a) of the Regulation, as the processing is subject to obtaining explicit consent. This consent may be withdrawn at any time, with effect for subsequent processing.

5. Processing methods

The information and data you provide, or that is otherwise acquired in the context of your use of the Service, will be processed in accordance with the provisions of the Regulation and its principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality. The processing is also carried out with the aid of computer and telematic tools designed to store and manage the data, and in any case in such a way as to ensure its security and protect the data subject's utmost confidentiality.

6. Recipients of personal data

Your personal data may be shared, for the purposes set out in section 3 above, with:

• parties that typically act as data processors, namely: i) individuals, companies or professional firms that provide assistance and advisory services to Arca in relation to the provision of the Service; ii) parties with whom it is necessary to interact in order to provide the Service (for example, hosting providers, call centres); iii) or parties delegated to carry out technical maintenance activities (including the maintenance of network equipment and electronic communication networks); (collectively, the "Recipients");
• parties, bodies or authorities to whom your personal data must be disclosed by law or by order of the authorities;
• persons authorised by Arca to process personal data as necessary to carry out activities strictly related to the provision of the Service, who have undertaken to maintain confidentiality or are subject to an appropriate statutory duty of confidentiality (e.g. Arca employees).

7. Transfers of personal data

Some of your personal data is shared with Recipients who may be located outside the European Economic Area. Arca ensures that the processing of your personal data by these Recipients is carried out in compliance with the Regulation. Transfers may be based on an adequacy decision, on the Standard Contractual Clauses approved by the European Commission or on another suitable legal basis. More information is available from Arca by writing to the following address: privacy@arcafondi.it

8. Data retention

Personal data processed for the purposes described in section 3 from (a) to (d) will be retained, as these are processing activities carried out for the provision of services, for the period permitted by Italian law for the protection of its interests (Article 2946 et seq. of the Italian Civil Code), namely 10 years. Data processed for the purposes from (e) to (g) will be retained until consent is withdrawn.

Further information on the data retention period and on the criteria used to determine that period may be requested by writing to Arca at the following address: privacy@arcafondi.it

9. Rights of data subjects

Pursuant to Articles 15 et seq. of the Regulation, you have the right to ask Arca, at any time, for access to your personal data, for its rectification or erasure, or to object to its processing; you also have the right to request restriction of processing in the cases provided for in Article 18 of the Regulation, and to obtain, in a structured, commonly used and machine-readable format, the data concerning you, in the cases provided for in Article 20 of the Regulation.

Requests should be sent in writing to Arca at the following address: privacy@arcafondi.it

In any case, you always have the right to lodge a complaint with the competent Supervisory Authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali), pursuant to Article 77 of the Regulation, if you believe that the processing of your personal data is contrary to the applicable legislation.

10. Changes

This notice has been in force since 22/07/2025. Arca reserves the right to amend or simply update its content, in whole or in part, including as a result of changes in the applicable legislation. Any changes introduced will be binding as soon as they are published on the Website. Arca therefore invites you to visit this section regularly to view the latest version of the notice and to stay up to date on the personal data collected and how it is used.