INFORMATION ON THE PROCESSING OF PERSONAL DATA

Pursuant to Article 13 of Regulation (EU) 2016/679, General Data Protection Regulation (“GDPR”)

This information notice, or Privacy Policy, is provided for the website www.myair.io, owned and operated by AIR S.r.l., with registered office in Milan (20124), Via Vittor Pisani 16, hereinafter referred to as the “Website”.

Please also note that any third-party websites linked through this Website are governed by their own privacy policies, which are separate from this Privacy Policy.

This information notice is intended for all users who interact with the web pages of the Website and use the online services provided through it.

In compliance with the provisions of Regulation (EU) 2016/679, General Data Protection Regulation, the “GDPR”, we hereby inform you that AIR S.r.l., as owner of the Website and Data Controller, will process your personal data as described below.

DATA CONTROLLER

AIR S.r.l.

Registered office: Via Vittor Pisani, 16 – 20124 Milan
VAT No. 08745320963

Hereinafter referred to as the “Company” or the “Controller”.

DATA PROTECTION OFFICER

In compliance with the provisions of the Regulation, the Company has appointed its own Data Protection Officer, who may be contacted regarding matters relating to the processing of personal data, as well as at the AIR S.r.l. address indicated above, using the following contact details:

Email: dpo@myair.io

PERSONAL DATA PROCESSED

In addition to anything else provided for on other pages, particularly with reference to “Cookies”, the following data may be collected and processed through the Website, its functions and/or the use of the services provided on it:

– browsing data: this is data automatically recorded by the server each time the Website is visited, such as the IP addresses or domain names of the computers used by users connecting to the Website, the URI — Uniform Resource Identifier — addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server response — successful, error, etc. — and other parameters relating to the user’s operating system and IT environment;

– common and identifying personal data: this category includes name and email address, as well as any additional contact details provided by filling in the electronic forms published on the Website from time to time.

LEGAL BASIS AND PURPOSES OF PROCESSING

The processing of personal data is based on the existence of a contractual or legal obligation or, depending on the case and as further specified below, on the existence of a legitimate interest of the Company. The processing is carried out exclusively for the following purposes:

(i) to fulfil contractual or pre-contractual obligations — for the correct provision of the services requested or otherwise accessible through the Website and/or through the forms made available on it, as well as to manage and process questions and requests for interaction with the Company and the parties belonging to the Controller’s organisation;

(ii) to fulfil legal obligations — to comply with obligations arising from applicable national and/or EU laws or regulations, including in the tax field, as well as from provisions issued by competent authorities and bodies;

(iii) on the basis of the Company’s legitimate interest — to defend a right or interest before any competent authority or body, including in relation to cybercrime; to allow better use of the services and an improved browsing environment; to carry out statistical analyses and market research on aggregated data; and, within the limits of and solely for the purposes of providing the services accessible through the Website, to allow users to learn more about the activities, services, events and other institutional and training initiatives organised or carried out by the Controller.

MANDATORY OR OPTIONAL NATURE OF DATA PROVISION

The provision of data for the purposes referred to in points (i), (ii) and (iii) above is entirely optional. However, since such processing is necessary to allow browsing of the Website and use of the services offered through it, failure to provide the data, or the partial or inaccurate provision of such data, will make it impossible, depending on the case, to use the online services and to process and respond to specific user requests.

DATA DISCLOSURE

The data may be disclosed to the following categories of recipients:

to all parties, including Public Authorities, that have access to personal data by virtue of legal or administrative provisions;

to all public and/or private parties, natural and/or legal persons, to whom disclosure is necessary or functional for the proper fulfilment of a contractual or legal obligation.

In addition to the above, for the pursuit of the purposes described above, personal data may be made available to parties acting on behalf of the Company, such as, by way of example and without limitation:

companies, consultants or professionals appointed to install, maintain, update and generally manage the Website’s hardware and software;

companies or professionals appointed to send documentation and/or information material;

the Company’s legal and tax professionals and consultants, who will process the data as external data processors.

In any case, personal data will not be transferred to countries outside the EU or outside the European Economic Area.

PERSONAL DATA RETENTION PERIODS

Personal data will be retained for the entire duration of the contractual relationship or, in any case, for as long as necessary to process, respond to and manage any user requests. Subsequently, the data will be retained for the maximum period provided for by applicable laws on limitation periods and/or forfeiture of claims, including in administrative and tax matters, and, more generally, for the exercise or defence of the Company’s rights in disputes brought by public authorities, public bodies/entities and private parties.

CHILDREN UNDER 16

The Website does not contain information, functions or services directly intended for users under the age of 16. Minors must not provide information or personal data without the consent of the persons exercising parental responsibility over them. If the Company becomes aware that personal data has been provided by a minor under the age of 16, it will immediately delete such data.

RIGHTS

As a data subject, the user has the right to ask the Controller to exercise the following rights:

Right of access

You may request confirmation as to whether or not your personal data is being processed and, if so, access to such data and specific information on the processing.

Right to rectification

You have the right to request and obtain the rectification of personal data concerning you and/or the completion of incomplete personal data.

Right to erasure

You may obtain the deletion of your data, without undue delay, if it is no longer necessary for the purposes for which it was collected or if the data is being processed unlawfully.

Right to restriction of processing

You have the right to obtain restriction of processing where the accuracy of the data is contested or the processing is unlawful.

Right to data portability

In the case of automated processing or processing based on consent, you have the right to receive the personal data concerning you in a structured format.

Right to object

You have the right to object at any time to processing based on the legitimate interest of the Controller.

Finally, you have the right to lodge a complaint with the Supervisory Authority: http://www.garanteprivacy.it/.

The rights listed above may be exercised by submitting a request to the Controller, without any formalities, by email at: dpo@myair.io.

This Privacy Policy was last updated in January 2026.