Walliance Group SpA, with registered office at Viale della Costituzione no. 16, 38122 Trento (Italy), in its capacity as Data Controller of personal data (hereinafter, the "Data Controller" or "Walliance"), recognises the importance of protecting personal data, which is one of the main objectives of its activities.

Therefore, before providing any personal data to the Data Controller, we invite you to carefully read this document (hereinafter, the "Privacy Policy"), as it contains important information regarding the processing of personal data and the security measures adopted to ensure their protection, in full compliance with applicable legislation.

Please note that this Privacy Policy applies to the website https://www.walliance.eu (hereinafter, the "Website") and its related subdomains, including, by way of example and without limitation, www.walliance.it, www.walliance.fr, www.walliance.es, http://prospettica.walliance.eu/, https://careers.walliance.eu, https://reportcrowdfunding.walliance.eu/, websites owned by Walliance (hereinafter, the "Websites"), managed by the Data Controller, as well as to the Walliance application (the "App"), also managed by the Data Controller.

This Privacy Policy does not apply to websites that may be accessed through external links and is provided, pursuant to Article 13 of European Regulation 2016/679 on the protection of personal data ("GDPR"), to all individuals interacting with the Websites (hereinafter, the "Users" or the "User"). Where applicable, it also complies with Italian Legislative Decree 196/2003 (hereinafter, the "Privacy Code"), as most recently amended by Law no. 160 of 27 December 2019, Decree-Law no. 53 of 14 June 2019, Ministerial Decree of 15 March 2019 and the GDPR Adaptation Decree (Italian Legislative Decree no. 101 of 10 August 2018), insofar as applicable.

The Data Controller informs you that the processing of your personal data, as a User, will be carried out in accordance with the principles of fairness, lawfulness, transparency, confidentiality and protection of the User's rights. The User's personal data will therefore be processed in compliance with the provisions of the GDPR and the data protection obligations set out therein.

Following the consultation and use of the Websites, data relating to identified or identifiable natural persons may be processed.

The identification details of the Data Controller and Website operator are as follows: Walliance Group SpA, with registered office at Viale della Costituzione 16, 38122 Trento (Italy), Tax Code and VAT number 02432640221, REA TN-224237.

Together with Walliance Group SpA, the wholly owned companies listed below may process data on behalf of the Data Controller in order to support Walliance Group SpA in managing its activities in France and Spain, respectively.

The list of Data Processors may be requested by sending an email to the following address: privacy@walliance.eu.

The Data Controller has appointed a Data Protection Officer (hereinafter, the "DPO"), Ms Lisa Vicenzi, who may be contacted at the following address: dpo@walliance.eu.

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, allow Users to be identified. This category of data includes IP addresses or domain names of the devices used by Users connecting to the Websites, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.) and other parameters relating to the User's operating system and IT environment.

These data are used to obtain anonymous statistical information on the use of the Websites and the App, to verify their proper functioning and, in view of the architecture of the systems used, to ensure the proper provision of the various functionalities requested by the User. For security reasons, these data are deleted immediately after processing.

Under no circumstances does the Data Controller combine this information with other data it may hold for the purpose of tracking the activities of specific Users.

In order to access the functionalities relating to offerings through the Website that are reserved for registered Users, registration is required through at least the following personal data: country of residence, first name, surname, email address, nationality and telephone number for account verification, citizenship, gender, country of birth, city of birth and tax identification number.

Once registration has been completed within the User's personal area, additional data relating to their profile may be entered, such as, for example, residential address, a copy of an identification document, together with the expiry date and number of the document, and the bank account from which invested amounts are transferred.

These data are provided voluntarily and will be processed in full compliance with data protection legislation. Failure to provide such data will only result in the inability to create an account and access certain functionalities.

The User is responsible for the accuracy of the data entered in their profile and guarantees that such data are correct.

Such data may also be processed in connection with the subsequent possible qualification of Users as "Investors" and/or "Offerors", for the purpose of participating in an Offering through the Portal accessible via the Websites (under the conditions available in the relevant section of the Websites), or for the purpose of submitting offerings to Walliance and their possible subsequent publication on the Website and its related subdomains for raising capital from the public.

Access to the Websites, the App and the services may take place using credentials provided by a third party, such as Google, Facebook, Apple or a similar service ("social login"). In such cases, the User is required to check the settings of that service and carefully read the third-party provider's policies, as these may authorise the third-party provider to share the User's personal information and authorise Walliance to collect information such as the User's contacts and other data.

Walliance will retain the identification code associated with the User's account with the third-party service from the time it is used for login or for sharing content hosted on the Website. Such information will be retained for as long as necessary to provide the requested services.

If the User creates a Walliance account or uses Website services by connecting through social login, Walliance may use the information contained in the originating account to complete the User's profile on the Websites. The User may update or amend their profile and contact information at any time through the social login.

Such data are retained for the period necessary to provide the requested services and for any additional periods where retention is required by law or for other legitimate purposes, such as Walliance's defence in legal proceedings, or where a legitimate interest of the Data Controller or third parties exists.

Cookies are small text files that websites visited by the User send to and store on the User's computer or mobile device, to be transmitted back to the same websites upon the User's next visit. Through cookies, a website remembers the User's actions and preferences, such as login details, chosen language, font size and other display settings, so that they do not need to be entered again when the User returns to the website or browses from one page to another. Cookies are therefore used to perform computer authentication, monitor sessions and store information relating to the activities of Users accessing a website. They may also contain a unique identification code that allows the User's browsing activity within the website to be tracked for statistical or advertising purposes. While browsing a website, the User may also receive on their computer or mobile device cookies from websites or web servers other than the one being visited, known as "third-party" cookies. Certain operations could not be carried out without the use of cookies, which in some cases are therefore technically necessary for the operation of the website itself.

By using the Website, the User consents to the use of cookies in accordance with this Privacy Policy and as indicated on the Website pages through the Cookiebot application.

Cookies are small files stored on the User's computer hard drive. There are two main categories of cookies: technical cookies and profiling cookies.

Technical cookies are necessary for the proper functioning of a website and to enable User navigation. Without them, the User may not be able to view pages correctly or use certain services.

Profiling cookies are intended to create User profiles for the purpose of sending advertising messages in line with the preferences expressed by the User while browsing.

Cookies may also be classified as:

Cookies may always be disabled. When browsing Walliance Websites, this can be done by referring to the link available in the footer of the Website page, Cookie Policy. In other cases, please refer to the instructions provided by the browser used to browse the Website.

The Website, including its related subdomains, uses the following types of cookies and allows Users to deselect them, except for third-party cookies, for which the User must refer directly to the relevant methods for selecting and deselecting the respective cookies, available through the relevant links:

Finally, Unclassified Cookies are cookies that are currently being classified together with the individual cookie providers.

Third-party cookies are cookies from websites or web servers other than those of the Data Controller, used for the third parties' own purposes, including profiling cookies. Please note that the third parties listed below, together with links to their respective privacy policies, act as independent Data Controllers with respect to the data collected through the cookies they send. The User must therefore refer to their personal data processing policies, information notices and any consent collection mechanisms concerning the selection and deselection of the respective cookies.

Links to the respective cookie policies are provided below:

More specifically, the cookies sent directly by Walliance through the Website are listed at the following link: https://www.walliance.eu/cookies.

Subject to the User's consent, Walliance may use tracking technologies in communications sent by email, such as tracking pixels and tracked links. These technologies make it possible to detect certain interactions with communications received, including, by way of example, message openings, clicks on links, the date and time of the interaction, as well as any technical information such as device information, IP address or user agent, where processed by the systems used.

The data collected in this way may be processed for the purpose of measuring the effectiveness of communications sent, improving the relevance of content, optimizing marketing activities and, where applicable, managing automated workflows and personalizing subsequent communications.

For these activities, Walliance may rely on third-party providers, including Intercom and SparkPost, duly appointed as Data Processors where necessary.

The legal basis for the processing is the User's consent pursuant to Article 122 of the Privacy Code. Such consent may be freely withdrawn at any time through the link available in the footer of each promotional and marketing email or by accessing the "Preferences" section within the User's Account.

As tracking technologies are integrated into the platforms used for promotional and marketing communications, namely Intercom and SparkPost, failure to provide consent or subsequent withdrawal of consent will result in the cessation of promotional and marketing communications.

It is understood that withdrawal of consent to tracking and commercial communications will not in any way affect the use of the services offered by Walliance. The User will continue to be able to access the platform normally, manage their account and investments and receive all technical, operational, contractual or otherwise strictly necessary communications relating to the provision of the services.

Data relating to interactions with email communications will be retained for the period necessary to pursue the purposes described above and, in any event, in compliance with the retention periods set out in this Privacy Policy.

The data provided to us by the User through the Websites will be processed by the Data Controller for the following purposes:

a) purposes relating to the provision of the requested services (e.g. contact requests, newsletter subscription, registration, submission of offerings by Investors and Issuers, resolution of issues relating to the use of the Website, complaints, etc.).

The provision of the User's data for the purposes referred to under point a) is optional. However, failure to provide such data may make it impossible to provide the requested functionalities. The legal basis for processing the User's data for these purposes is Article 6(1)(a) GDPR.

b) research/statistical analysis purposes relating to aggregated or anonymous data, without the possibility of identifying the User, aimed at measuring the functioning of the Website, measuring traffic and evaluating usability and interest.

The processing of the User's data for these purposes is optional. Therefore, failure to provide consent for such purposes will not affect the use of the services.

The legal basis for processing the User's data for these purposes is Article 6(1)(a) GDPR.

c) purposes relating to compliance with obligations imposed by applicable legislation.

The provision of the User's data for the purpose listed under point c) above is mandatory. The legal basis for processing the User's data for these purposes is Article 6(1)(c) GDPR. Failure to provide such data would prevent the Data Controller from complying with the obligations imposed by applicable legislation.

d) Marketing purposes

The data provided may be processed, subject to the User's explicit and specific consent, for the purpose of sending promotional and Marketing communications, including newsletters and market research, through automated means (SMS, MMS, email, push notifications, fax) and non-automated means (postal mail, telephone calls with an operator).

With reference to promotional and marketing communications sent by email, Walliance may also use, subject to the User's consent, tracking technologies such as tracking pixels and tracked links, as described in Section 2.4 above.

The legal basis for processing the User's data for these purposes is Article 6(1)(a) GDPR.

Commercial profiling and direct Marketing activities are optional and depend on the User's free choice. Therefore, failure to provide the relevant consents will not affect the use of the services.

The User's personal data are processed by the Data Controller, or by third parties carefully selected on the basis of their reliability and expertise and appointed as Data Processors for this purpose, only insofar as necessary to achieve the purposes described above, mainly through automated means but also in paper form, for the period strictly necessary to achieve the purposes for which they were collected.

Specific security measures are implemented to prevent data loss, unlawful or improper use and unauthorized access, in full compliance with applicable legislation.

The User's personal data may be made available to employees or collaborators of the Data Controller belonging, depending on the relevant processing activity, to administrative, commercial, legal, accounting or IT system administration functions. Such persons operate under the direct authority of the Data Controller, are appointed as Data Processors or persons authorized to process personal data pursuant to Articles 28 and 29 GDPR and receive appropriate operational instructions in this respect.

The User's personal data may be communicated to external parties whose activities are necessary and functional to the provision of the functionalities of the Websites.

The User's personal data may be communicated to third parties such as individuals, companies or professional firms providing assistance and consultancy services to the Data Controller, duly appointed as Data Processors; persons, entities or authorities to whom communication of the User's personal data is mandatory pursuant to applicable legislation or orders issued by competent authorities; persons delegated and/or appointed by the Data Controller to carry out activities strictly related to the pursuit of the purposes described above, including technical maintenance of systems, duly appointed as Data Processors; commercial partners and service providers whose services are functional to software development and the provision of services related to the Website.

Where necessary, the Data Controller reserves the right to obtain the User's specific consent.

In particular, it is specified that the legal basis for the processing and subsequent disclosure to the party proposing the specific listing, acting as an independent third-party data controller, of the contact details (e.g. first name, last name, email address, telephone number) collected through the information request form available on the Listings Portal provided by Walliance Group SpA as part of the Direct Investments service, is the User’s specific and informed consent (Art. 6(1)(a) GDPR). Such consent to the disclosure of data to the parties proposing the listings is collected at the same time as the submission of the contact and further information request addressed directly to the party proposing the listing.

The User's personal data will not be publicly disclosed by the Data Controller unless the User has provided explicit and specific consent. Data may be transferred abroad, to countries within the European Union, to countries outside the European Union that have been the subject of an adequacy decision by the European Commission, or to countries that have not been the subject of such adequacy decision, in accordance with and within the limits established by Articles 44 to 49 GDPR.

The User's personal data are stored and processed through IT systems owned by the Data Controller and managed by the Data Controller itself or by third-party technical service providers. The data are processed exclusively by specifically authorized personnel, including personnel responsible for carrying out extraordinary maintenance operations.

The data will be retained for the period strictly necessary for the contractual or legal purposes for which they were provided to the Data Controller and, in any event, for no longer than ten years following the termination of any relationship with the Data Controller.

At any time, pursuant to Articles 15 to 22 GDPR, the User may exercise the right to:

request confirmation as to whether or not personal data concerning them are being processed; obtain information regarding the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the envisaged retention period; obtain rectification and erasure of data; obtain restriction of processing; obtain data portability, namely receive the data from the Data Controller in a structured, commonly used and machine-readable format and transmit those data to another Data Controller without hindrance; object to processing at any time, including processing for direct Marketing purposes; object to automated decision-making relating to natural persons, including profiling; request from the Data Controller access to and rectification or erasure of personal data or restriction of processing concerning the User, or object to processing, as well as exercise the right to data portability; withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal; lodge a complaint with the competent supervisory authority (the Italian Data Protection Authority, "Garante per la protezione dei dati personali", www.garanteprivacy.it).

Requests may be submitted by sending an email to: privacy@walliance.eu.

This Privacy Policy may be amended to reflect legislative or technological changes, changes in the collection and use of data, or to allow us to add new functionalities or services.

In the event of amendments, Walliance will inform the User: (i) through a popup notice published on the main page of the Website and/or (ii) by taking any other action that the Data Controller considers appropriate.

Any amendments will become effective from the time they are published, and continued browsing of the Website after that time will constitute acceptance of such amendments.

The User declares that they have read the information provided herein and consents to the processing of all their data in the manner described above.

Last updated: 11 September 2026