PRIVACY POLICY

Information document pursuant to and for the purposes of Article 13 of Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR")

1. DATA CONTROLLER

The processing in this Policy is carried out by B939 SUB HOLDING S.p.A. , with its registered office at Via Vincenzo Lancetti 28, 20100 (Milan) and BBB S.p.A. , with its registered office at Via Lancetti 28, 20100 (Milan), in the person of its pro tempore legal representative, who act as joint data controllers. The joint data controllers can be contacted at the following email address: [email protected].

2. DATA PROTECTION OFFICER The joint data controllers have appointed a Data Protection Officer (DPO) pursuant to Articles 37, 38, and 39 of the GDPR. The DPO can be contacted at the following email address: [email protected].

3. PURPOSE OF THE PROCESSING, LEGAL BASIS, RETENTION AND NATURE OF THE PROVISION

• We use the data provided by the user to provide a personalised suggestion of the product size required by the user. Processing is necessary for the performance of pre-contractual obligations pursuant to Article 6(1)(b) of the GDPR. The provision of personal data is necessary for contractual purposes. Failure to provide the necessary personal data will make it impossible to use the size suggestion service. It should be noted that the data provided via the body scan is stored only for the duration of the usage session; the recommended size and the body type questionnaire, on the other hand, are stored using cookies and similar technologies and shown on subsequent visits to the website, as per the Cookie Policy available in the footer of the www.boggi.com website.
• We use information relating to purchases made and any returns, as well as the size recommended by the system, to improve the accuracy of the size suggestion service and the quality of the services offered. Processing is based on the Data Controller's legitimate interest pursuant to Article 6(1)(f) of the GDPR. Data is retained for a maximum period of 12 months from the time of collection. Any opposition to the processing will not affect the use of the service, but could affect the quality and accuracy of the size suggestion service.
• Finally, we use the personal data collected to manage any requests to exercise data subjects' rights pursuant to Articles 15 et seq. of the GDPR. Processing is necessary to fulfil legal obligations pursuant to Article 6(1)(c) of the GDPR. The data is retained for 5 years from the closure of the request, barring disputes. Provision of data is mandatory, as it is necessary to respond to requests.

The size suggestion service is provided by Kleep, which may also process some personal data as an independent data controller for its own purposes, for which B939 SUB HOLDING S.p.A. and BBB S.p.A. are in no way responsible. For information on such processing, please consult the relevant privacy policy, available on the www.kleep.ai website.

4. DATA RECIPIENTS AND TRANSFERS OUTSIDE THE EU

The data will not be disclosed. The personal data will be communicated to parties that will process the data as independent Data Controllers or Data Processors (Article 28 of the GDPR) and processed by natural persons (Article 29 of the GDPR) acting under the authority of the Data Controller and the Data Processors based on specific instructions provided regarding the purposes and methods of processing. Specifically, personal data may be processed by IT service providers, hosting service providers, size recommendation service providers, and possibly legal and data protection consultants. No transfers outside the European Union are foreseen. If it becomes necessary to transfer personal data to third countries, said transfers will be carried out in compliance with Articles 44 et seq. of the GDPR, through adequacy decisions or the adoption of standard contractual clauses.

5. PROCESSING METHODS – AUTOMATED DECISION-MAKING PROCESS

The personal data will be processed using automated tools. The system only provides a recommendation, and therefore is not intended to give rise to automated decisions that produce legal effects or significantly affect the data subject pursuant to Article 22 of the GDPR.

6. RIGHTS OF THE DATA SUBJECTS

Data subjects may exercise their rights under Articles 15 et seq. of the GDPR by contacting the DPO at the following email address: [email protected], or by contacting the Data Controller using the contact details above. The Data Controller guarantees data subjects the right to request, at any time, access to their personal data (Article 15), rectification of their personal data (Article 16), erasure of their personal data (Article 17), and restriction of processing (Article 18). The Data Controller shall communicate (Article 19) to each of the recipients to whom the personal data has been communicated any rectifications, erasures, or limitations imposed on the processing carried out. Upon request, the Data Controller shall inform the data subjects of such recipients. The Data Controller guarantees the right to portability (Article 20) and, in the event of requests pursuant to Article 20, will provide data subjects with the data in a structured, commonly used, and machine-readable format. Data subjects have the right to object (Article 21) at any time to data processing based on their legitimate interest. They can exercise this right by writing to the contact details above with the subject "objection." In the event that the data subjects exercise their right to object to processing based on their legitimate interest, the Data Controller grants the former the right to obtain, upon request, information on the balancing test performed. In the event that the data subjects believe that the processing of personal data carried out by the Data Controller is in violation of the provisions of the GDPR, they are free to lodge a complaint with the National Supervisory Authority, either in the Member State in which they habitually reside or work, or in the place where the alleged infringement of the GDPR occurred (Italian Supervisory Authority: https://www.garanteprivacy.it/), or to take appropriate legal action.

7. POLICY CHANGES

The Data Controller may change, modify, add, or remove any portion of this Privacy Policy. To facilitate the verification of any changes, the Policy will contain the date it was last updated.

Updated: 2 April 2026