In accordance with Regulation (EU) 2016/679 (“GDPR”), and with Data Protection Act 2018, and the applicable legislation on the protection of personal data, Nativery S.r.l. provides this notice regarding the processing of personal data collected via the website www.Nativery.com, the portal, content-discovery platforms, feeds, widgets, analytical tools and other services and technological applications made available directly or via third-party websites and digital properties.
The information is provided in such a way as to clearly indicate:
• who processes the data;
• what data is processed;
• for what purposes;
• on what legal basis;
• how long the data is retained;
• to whom it may be disclosed;
• whether it may be transferred outside the European Economic Area;
• what rights data subjects have and how to exercise them

1. DATA CONTROLLER AND DATA PROTECTION OFFICER
The data controller is Nativery S.r.l., in the person of its current legal representative, with registered office in Turin, Via Confienza 10.
The Data Protection Officer (DPO) can be contacted at: dpo@Nativery.com

2. CATEGORIES OF DATA SUBJECTS AND DATA PROCESSED
Nativery may process personal data relating to the following categories of data subjects:
a) Clients (Advertisers) and Business Partners (Publishers)
The following data, by way of example, may be processed:
• identification and contact details;
• username and password;
• email address and telephone number;
• billing details;
• payment details;
• the content of enquiries, communications or messages sent to Nativery
b) Website visitors
The following data may be processed:
• data provided directly via forms, emails or contact enquiries;
• data relating to newsletter subscriptions;
• other data voluntarily provided by the data subject
c) Service users
When users interact with the services displayed on the websites and digital properties of clients and partners, Nativery may collect data relating to:
• device and operating system;
• IP address;
• pages visited;
• referring links;
• date and time of access;
• information on system events;
• general location data.
Where indicated in the context of this data processing activity, such data may be processed in pseudonymised form, i.e. without allowing Nativery to directly identify the data subject by their first name, surname or email address.

3. PURPOSES OF PROCESSING AND LEGAL BASES
Personal data are processed for the following purposes.
3.1 Activation and management of services, accounts and requests
Data are processed to:
a. activate the services offered by the portal;
b. create and manage accounts;
c. manage requests, registrations and relationships with customers, partners and visitors;
d. to carry out pre-contractual measures requested by the data subject or relating to the contractual relationship
Legal basis: the performance of pre-contractual measures taken at the request of the data subject and/or the performance of the contract pursuant to Article 6(1)(b) of the General Data Protection Regulation (GDPR) 679/2016 in the context of the provision of online services to data subjects.
3.2 Service communications and handling of enquiries
Data may be processed for the following purposes:
a. to respond to requests for information;
b. to handle complaints or requests for assistance;
c. to send communications relating to the account or the service.
Legal basis: performance of the contract or pre-contractual measures; where necessary, the data controller’s legitimate interest in the proper management of the relationship pursuant to Article 6(b) and (f) of the GDPR.
3.3 Sending newsletters, offers and promotional communications
Subject to the data subject’s consent, data may be processed for the following purposes:
a. to send newsletters;
b. to send special offers and promotions;
c. to communicate commercial updates and information on products or services deemed to be of interest.
Legal basis: consent of the data subject pursuant to Article 6(a) of the GDPR.
3.4 Personalisation of content and the user experience
Subject to consent, data may be processed for the following purposes:
a. to personalise the content and information displayed or sent;
b. to improve the user experience when using the services.
Legal basis: consent of the data subject pursuant to Article 6(a) of the GDPR.
3.5 Targeted campaigns and cross-browser and cross-device experience synchronisation
Subject to consent, data may be processed for the following purposes:
a. to improve the continuity of the user experience across browsers and devices;
b. to deliver more targeted advertising campaigns based on the user’s characteristics and behaviour.
Legal basis: consent of the data subject pursuant to Article 6(a) of the GDPR.
3.6 Statistical analysis, research and service improvement
Subject to consent, data may be processed for the following purposes:
a. to understand how customers, partners, users and visitors use the website and services;
b. to carry out analyses, statistics and research;
c. to improve functionality, performance and content.
Legal basis: consent of the data subject pursuant to Article 6(a) of the GDPR.
3.7 Compliance with legal obligations, requests from authorities and protection of rights
Data may be processed for the following purposes:
a. to comply with legal obligations;
b. to respond to requests from the competent authorities;
c. to establish, exercise or defend the data controller’s rights
Legal basis: a legal obligation to which the data controller is subject and/or the data controller’s legitimate interest in protecting its rights pursuant to Article 6(c) and (f) of the GDPR
3.8 Interaction with external platforms, statistical tools and third-party content
The website may integrate third-party services, including social media interaction services, statistical tools and content hosted on external platforms. Such services may involve the processing of usage data, cookies and traffic data in accordance with the provisions of their respective privacy policies.
Legal basis: consent of the data subjects where required by applicable legislation pursuant to Article 6(a) of the GDPR; for processing carried out by third parties, the privacy policy of the relevant provider shall apply.

4. NATURE OF THE PROVISION OF DATA
The provision of data may be:
• mandatory, where necessary to comply with legal obligations;
• necessary, where required for the activation, performance and management of the services or the contractual relationship;
• optional, where processing is based on consent, for example for marketing, newsletters, personalisation, targeted campaigns and statistics that are not strictly necessary.
Failure to provide the necessary data may make it impossible to provide the service or to fulfil the data subject’s requests.
Failure to provide data for optional purposes does not affect existing contractual relationships but may prevent the sending of promotional communications or the provision of features based on consent.

5. METHODS OF PROCESSING
Processing is carried out using electronic means and, where necessary, manually, through the collection, recording, organisation, storage, consultation, processing, use, disclosure, erasure and destruction of data.
The processing is carried out:
• by the data controller’s authorised staff;
• by specifically authorised or appointed internal and external parties;
• by suppliers providing services necessary for the purposes indicated

6. RECIPIENTS OF PERSONAL DATA
Personal data may be disclosed, within the limits of the purposes set out above, to the following
• categories of recipients:
• providers of IT, hosting, maintenance and technical support services;
• providers of analytics and monitoring services;
• entities providing administrative, accounting, tax or legal services;
• banks, payment intermediaries and operators involved in transactions;
• companies providing services on behalf of Nativery;
• affiliated and/or subsidiary companies, where applicable, in the cases and for the purposes described;
• public authorities and competent administrations in the cases provided for by law.
The identification details of the appointed data processors may be requested from the data controller.
Personal data is not disclosed to the public, except in cases provided for by law.

7. TRANSFERS OF DATA TO COUNTRIES OUTSIDE THE EU
Where necessary for the purposes indicated above, personal data may be transferred to countries within the European Union or to third countries and international organisations.
In such cases, the transfer takes place in accordance with Chapter V of the GDPR, and therefore:
• on the basis of an adequacy decision by the European Commission;
or
• on the basis of appropriate safeguards pursuant to Article 46 of the GDPR, including, where applicable, standard contractual clauses;
or, in exceptional cases,
• on the basis of the derogations provided for in Article 49 of the GDPR.
The data subject may request information from the Data Controller regarding any such transfer at any time. Where no transfer has taken place, the Data Controller will nevertheless provide a response, informing the data subject.

8. COOKIES AND OTHER TRACKING TOOLS
For detailed information on the use of cookies and other tracking tools, the categories of cookies used, the purposes involved, and how to manage or withdraw consent, please refer to the Website Cookie Policy and the Pages Cookie Policy.

9. PROFILING AND AUTOMATED DECISION-MAKING
Certain purposes described in this notice, such as the personalisation of content, targeted campaigns and the analysis of usage behaviour, may involve profiling or segmentation of data subjects.

10. DATA RETENTION PERIOD
Personal data is retained for a period no longer than is necessary for the purposes for which it is processed, taking into account legal obligations and the need to safeguard Data Controller’s rights.
In particular:
• data processed for the handling of pre-contractual enquiries is retained for as long as necessary to handle such enquiries;
• data processed for the performance of the contract and account management is retained for the duration of the relationship and subsequently for the period necessary to comply with legal obligations and to protect the Data Controller’s rights;
• data processed for administrative, tax and accounting purposes is retained for the periods specified by the applicable legislation;
• data processed for marketing, newsletters, personalisation, targeted campaigns and analyses based on consent are retained until consent is withdrawn and, in any event, in accordance with the principles of proportionality and data minimisation;
• data processed for the establishment, exercise or defence of legal claims are retained for the time necessary to manage the dispute or potential dispute.

11. RIGHTS OF THE DATA SUBJECT
The data subject may exercise, in the cases provided for by the GDPR, the following rights:
• access to personal data;
• rectification of inaccurate data or completion of incomplete data;
• erasure of data, in the cases provided for by law;
• restriction of processing;
• data portability, where applicable;
• objection to processing, in the cases provided for by the GDPR;
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal;
• lodge a complaint with the competent supervisory authority.
Requests may be sent to the data controller’s contact details or to the DPO at the following address: dpo@Nativery.com

13. AMENDMENTS TO THE PRIVACY NOTICE
This privacy notice may be updated from time to time. Any amendments will be published on the website and, where required by applicable legislation, will be communicated to data subjects by appropriate means.

Last updated: 19 June 2026