Personal Data owner is Superstrada Pedemontana Veneta S.p.A. (“Owner”) with legal headquarters in Via Invorio 24/A, 10146 Turin (Italy), VAT number 10201260014, tel. (+39)011/7176222, email: infobond@spveneta.com

Personal Data provided may only be communicated to:

• Affiliates of Superstrada Pedemontana Veneta S.p.A., Consorzio Stabile SIS S.c.p.A. and its parent companies and/or their Affiliates (belonging to FININC S.p.A. Group and SACYR S.A. Group)
• Circuitus Capital LLP
• Third parties to whom Superstrada Pedemontana Veneta S.p.A. entrusts certain functional activities regarding the Website (internet software development, website development services, elaboration of studies and statistical surveys, recognition of the degree of satisfaction on the quality of the services provided).

Personal Data collected through the Superstrada Pedemontana Veneta S.p.A. website (www.spveneta.com) (“Website”) will be processed, pursuant to Legislative Decree no. 196/2003, by automated filing in the IT systems of Superstrada Pedemontana S.p.A. for the following purposes:

• granting access to protected information regarding Superstrada Pedemontana Veneta S.p.A. and the Superstrada Pedemontana Veneta Project (“Project”) to those Users which demonstrate to be current investors in the securities issued by Superstrada Pedemontana Veneta S.p.A. for the financing of the Project (“Project Bond”, and each investor, “bondholder”).
• verifying the identity of those Users who state to be current bondholder / who declare to be entitled to access the protected area of the Website as authorized representatives of current bondholder.
• sending alert e-mails in connection with i) the functioning of the Website, ii) the posting or removal of documents from the Website, iii) the expiration of credentials to access the protected area of the Website, iv) any kind of assistance with the functioning of the Website and the Website access granting.
• requesting any further details in connection with the Personal Data provided in order to verify the permission to have access to the protected area of the Website.
• analyzing the traffic on the Website and controlling any improper use of the protected information provided therein.

Personal Data collected through the Website are defined, for the purpose of the document herein, as any information regarding a natural person, a legal person, an institution or an association, which is, or can be, identified, even indirectly, by reference to any other information, including a personal identification number. The Users are requested to fill in a form indicating the following data: first name, last name, date of birth, email address, ID document and relevant number, Tax ID, Company name, Company address, Company ZIP/Postal Code, Company ID or VAT number, other various type of Data which can be requested to prove the identity of the User and of the bondholder who has invested in the Project Bond.

Among the types of Personal Data that Superstrada Pedemontana Veneta S.p.A. collects through the Website, by itself or through third party tools and services, there are Usage Data, which are defined as follows in the section “Definitions and legal references”.

For operation and maintenance purposes, the Website and any third party tools and services used through the website may collect files that record interaction with the Website (System logs) or use for this purpose other Personal Data (such as IP Address).

Personal Data may be freely provided at each User discretion, but denial of consent to their processing will result in the failure to register and the inability to access the Website and the related information services. All Data requested by the Website are mandatory, unless specifically stated otherwise.

Any use of Cookies – or of other tracking tools – by the Website or by third party services used by the Website is aimed solely for pursuing the abovementioned purposes, in addition to any other purposes described in the Cookie Policy, if available.

Users are responsible for any third party Personal Data obtained, published or shared through the Website and confirm that they have the third party's consent to provide the Data to Superstrada Pedemontana Veneta S.p.A.

Methods of processing. The Data Controller processes the Data of Users in a proper manner and shall take appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data. For any further detail please find attached minimum security measures instruction under Legislative Decree n. 196/2003, Annex B (“Annex 1”). The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Data Controller, in some cases, the Data may be accessible to certain types of persons involved with the operation and maintenance of the Website (administration, legal, system administration) or external parties appointed by the Owner and/or its IT suppliers (such as third party technical service providers, hosting providers, IT companies), if necessary.

Place. Personal Data are processed at the Data Controller's operating offices and in any other places where the parties involved with the processing are located.

According to art.7 of Legislative Decree n.196/2003 the Users have the right, in any time:

• to know whether their Personal Data, even if not yet registered, has been stored and can request the Data Controller to learn about their contents.
• to receive any information about:
  • the origin of the Personal Data;
  • the purposes and modes of processing Personal Data, even in case of use of electronics systems;
  • the details of the owner of Personal Data and its designated representatives in processing Personal Data in accordance with art. 5, comma 2, of Legislative Decree n.196/2003;
  • the details of other persons to whom Personal Data can be communicated or who may become aware of them.
• to obtain:
  • cancellation, transformation into anonymous form or blocking in processing the Personal Data due to a violation of the law, including those for which storage is not necessary in relation to the purposes for which the data was collected or subsequently processed;
  • the confirmation that the operations referred to in points (a) and (b) have been brought to the attention, including their content, of those to whom the data have been communicated or transferred, except where such fulfillment is impossible or involves the use of means manifestly disproportionate to the protected right.
• to object, in whole or in part:
  • for legitimate reasons, to the processing of the Personal Data, even if connected with the purpose of the collection;
  • the processing of Personal Data for the purpose of sending advertising material or direct selling or for the purpose of market research or commercial communication.

The User's Personal Data may be used for legal purposes by the Data Controller, in Court or in the stages leading to possible legal action arising from improper use of the Website or the related documents uploaded on it.

The User declares to be aware that the Data Controller may be required to reveal Personal Data upon request of public authorities.

The Data Controller reserves the right to make changes to this privacy policy at any time by giving notice to the Users on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom. If a User objects to any of the changes to the Privacy Policy, the User must cease using the Website and can request that the Data Controller remove the Personal Data. Unless stated otherwise, the then-current privacy policy applies to all Personal Data the Data Controller has about Users.

A subsidiary or a holding company of a person/entity or any other subsidiary of that holding company.

The legal or natural person to whom the Personal Data refers.

Any information regarding a natural person, a legal person, an institution or an association, which is, or can be, identified, even indirectly, by reference to any other information, including a personal identification number.

The design, construction and operation of Superstrada Pedemontana Veneta toll road.

Information collected automatically from this Application (or third party services employed in this Application), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Application, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User's IT environment.

The individual using this Application, which must coincide with or be authorized by the Data Subject, to whom the Personal Data refers.