Newsletter information

Information notice (1) provided pursuant to art. 13 of EU Reg. No. 2016/679

[https://abrakadabraitaly.com/ - https://abrakadabraitaly.com/pages/abk-card]

I. Why are you being provided with this information notice?

Because ABK Experience s.r.l. intends to process some of your personal data through the pop-up form 'Sign up and get early access to ABK event tickets.' or the form 'Enter the Abrakadabra world' or the form 'Unlock the ABK Card 2026 gift promo' (within the website 'https://abrakadabraitaly.com/') for the purposes and methods described below, and the law requires that you be informed of this in advance and adequately. All of this is distinct from what is contained in the Personal data protection policy and the Cookies policy.

II. Who is providing you with this information notice?

The data controller is (according to the law) the entity that has autonomously decided both the purposes and methods, controlling the website in question, and the law requires you to know who they are and, above all, how they can be contacted.

In this case, it will be ABK Experience s.r.l., a limited company with VAT number and tax code no. 04783490404, registered in the Companies Register with no. RN-440772, located in via Monte Rosa, 11 - Riccione (RN), 47838 and reachable via the corporate email contact 'compliance@abrakadabraitaly.com'.

III. What are the repeatedly mentioned purposes of the processing?

The first task of the data controller is (according to the law) to declare which objectives they intend to achieve through the processing of your personal data.

The first [1] purpose [main] is to allow the periodic transmission via e-mail of commercial and/or technical information circulars, in order to enable them to provide you with support in viewing useful updates, once your free and unequivocal consent has been obtained. If you intend to stay updated on commercial and/or technical news concerning the data controller because you are interested in the added value they can help create, this is the purpose for you.

The second [2] purpose [ancillary] is to comply with personal data protection regulations, by conforming to one or more relevant legal obligations. Please read the section (no. IV.c.) on your rights carefully to understand what the data controller will be required to do.

The third [3] purpose [ancillary] is to eventually protect - even if it is hoped that there will be no need - its economic interests in extra-judicial and/or judicial proceedings [legitimate interest]. Don't worry, it's just the legislator who imposes such a clarification on us...

IV.a. Who will help achieve the purposes of processing?

The second task of the data controller is (according to the law) to declare what methods they intend to adopt for the processing of your personal data: here, in particular, who will have access to your personal data. Keep in mind that a service provider in this context is not a simple software reseller, but the entity that hosts your personal data involved in the use of the same software on their servers.

Internally, regarding the first [1], second [2] and third [3] purposes, only the sole director (general management area) will be involved.

Externally, for the first [1] purpose, the corporate website hosting service provider (A), the secretarial-commercial and technical, compliance, commercial and technical assistance service provider (B), the commercial-communication assistance service provider (C), the corporate newsletter hosting service provider (D) and - eventually - the corporate instant messaging hosting service provider (E) will be involved, all authorized to operate as data processors.

Externally, for the second [2] purpose, the corporate website hosting service provider (A), the secretarial-commercial and technical, compliance, commercial and technical assistance service provider (B), the commercial-communication assistance service provider (C), the corporate newsletter hosting service provider (D), - eventually - the corporate instant messaging hosting service provider (E), - eventually - the corporate email hosting service provider (F), - eventually - the certified corporate email hosting service provider (G) and - eventually - the specifically selected lawyer(s) (H) will be involved, all authorized to operate as data processors, as well as - eventually - the specifically selected lawyer(s) (I), acting as independent data controller(s).

Externally, for the third [3] purpose, - eventually - the corporate email hosting service provider (A), - eventually - the secretarial-commercial and technical, compliance, commercial and technical assistance service provider (B), - eventually - the certified corporate email hosting service provider (C) and - eventually - the specifically selected lawyer(s) (D) will be involved, all authorized to operate as data processors, as well as - eventually - the specifically selected lawyer(s) (I), acting as independent data controller(s).

Please note that the corporate website hosting service provider, for the pursuit of the first [1] and second [2] purposes, will - in case of detection of its operational needs - transfer your personal data to Canada (CA) and - eventually - to one or more additional non-EU countries, which are nevertheless considered third countries, adopting as appropriate safeguards the adequacy decisions regarding the individual relevant national legal systems concerning personal data protection, pursuant to art. 45, par. 1 of the GDPR and/or the standard contractual clauses for the transfer of personal data referred to in EC Decision No. 2021/914, pursuant to art. 46, par. 2, letter c) of the GDPR, as declared at 'https://www.cloudflare.com/it-it/cloudflare-customer-dpa/' (section "6. Data transfers from the EEA, Switzerland, and the UK"), unfortunately not currently available in Italian.

Please also note that the corporate instant messaging hosting service provider, for the pursuit of the first [1] and second [2] purposes, will - in case of detection of its operational needs - transfer your personal data to the United States of America (US) and - eventually - to one or more additional non-EU countries, which are nevertheless considered third countries, adopting as appropriate safeguards the adequacy decisions regarding the individual relevant national legal systems concerning personal data protection, pursuant to art. 45, par. 1 of the GDPR and/or the standard contractual clauses for the transfer of personal data referred to in EC Decision No. 2021/914, pursuant to art. 46, par. 2, letter c) of the GDPR, as declared at 'https://www.whatsapp.com/legal/business-data-transfer-addendum' (section "6. Data transfers from the EEA, Switzerland, and the UK"), unfortunately not currently available in Italian.

Please also note that the secretarial-commercial and technical, compliance, commercial and technical assistance service provider, for the pursuit of the first [1] and second [2] purposes, will - in case of detection of its operational needs - transfer your personal data to Canada (CA) and - eventually - to one or more additional non-EU countries, which are nevertheless considered third countries, adopting as appropriate safeguards the adequacy decisions regarding the individual relevant national legal systems concerning personal data protection, pursuant to art. 45, par. 1 of the GDPR and/or the standard contractual clauses for the transfer of personal data referred to in EC Decision No. 2021/914, pursuant to art. 46, par. 2, letter c) of the GDPR, as declared regarding its separate hosting assistant (corporate email) at 'https://www.cloudflare.com/it-it/cloudflare-customer-dpa/' (section "6. Data transfers from the EEA, Switzerland, and the UK"), unfortunately not currently available in Italian.

Finally, please note that the corporate newsletter hosting service provider, for the pursuit of the first [1] and second [2] purposes, will - in case of detection of its operational needs - transfer your personal data to one or more non-EU countries, which are considered third countries, adopting as appropriate safeguards the adequacy decisions regarding the individual relevant national legal systems concerning personal data protection, pursuant to art. 45, par. 1 of the GDPR and/or the standard contractual clauses for the transfer of personal data referred to in EC Decision No. 2021/914, pursuant to art. 46, par. 2, letter c) of the GDPR, as declared at 'https://www.brevo.com/legal/termsofuse/' (appendix "Appendix 3: Data Processing Agreement (DPA)" - section "9. International Transfers"), unfortunately not currently available in Italian.

IV.b. How long will it take to achieve the purposes of processing?

The second task of the data controller is (according to the law) to declare what methods they intend to adopt for the processing of your personal data: here, in particular, for how long they will have access to your personal data.

Regarding the first [1] purpose, the necessary personal data will be kept for a period of 2 years from the date of interaction with the aforementioned form.

Furthermore, regarding the second [2] purpose, the necessary personal data will be kept for a period of 2 years from the date of interaction with the aforementioned form, but subsequently - in a separate and secure location, to ensure the pursuit of the third [3] purpose - for an additional 10 years from then.

Finally, regarding the third [3] purpose, the necessary personal data will be kept for a period of 12 years from the date of interaction with the aforementioned form.

IV.c. What rights can you exercise before, during, and after processing?

The second task of the data controller is (according to the law) to declare what methods they intend to adopt for the processing of your personal data: here, in particular, what you can ask the data controller to do.

Only with regard to the first [1] purpose, you may withdraw your consent at any time: this can be done by writing to ‘compliance@abrakadabraitaly.com’.

Furthermore, regarding the first [1], second [2] and third [3] purposes, you can access your processed personal data, obtaining information on the processing similar to what you find in this information notice, as well as a copy of the same, rectify your processed personal data, for example if you have changed your email contact, have your processed personal data erased, for example if you deem the processing unlawful, have the processing of your processed personal data restricted, instead of having them erased, for example if you deem the processing unlawful: this can also be done by writing to ‘compliance@abrakadabraitaly.com’.

Furthermore, regarding the first [1] purpose, you may obtain the portability of your processed personal data: this can also be done by writing to ‘compliance@abrakadabraitaly.com’.

Moreover, solely with regard to the third [3] purpose, you may object to the processing of your processed personal data: this can also be done by writing to ‘compliance@abrakadabraitaly.com’.

However, finally, regarding the first [1], second [2] and third [3] purposes, you may lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali) at ‘https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524’ or with the national supervisory authority operating within the territory of the European Union state where you reside and/or work, which is nevertheless qualified as the competent supervisory authority: this will be very useful if at any time you believe the processing of your personal data is unlawful.

IV.d. Is it mandatory to communicate your personal data to the data controller?

The second task of the data controller is (according to the law) to declare what methods they intend to adopt for the processing of your personal data: here, in particular, whether there is a pre-contractual or contractual and/or legal obligation that requires the data controller to collect your personal data.

Regarding the first [1] purpose, there is no pre-contractual or contractual and/or legal obligation, and therefore the data controller acts solely to satisfy their need related to that purpose, thanks to your prior consent.

Furthermore, regarding the third [3] purpose, there is no pre-contractual or contractual and/or legal obligation and therefore the data controller acts solely to satisfy their legitimate interest related to that purpose, ensuring you all necessary guarantees.

Date: 12/01/2026

The legal representative of the data controller: Mr. Valerio MONTANARI