Below is the information required by the GDPR relating to the processing of personal data provided for the purpose of purchasing Yamamay products on the e-commerce website www.yamamay.com (hereinafter, "Site") (hereinafter, "Products "), As better described in the general conditions of sale. 1. Identity and contact details of the data controller Inticom S.p.a., c.f. and p. IVA 02649140122, with registered and operational headquarters in Via Carlo Noè 22, 21013 - Gallarate (VA), e-mail address privacy@pianofortegroup.com, P.E.C. inticomspa@certimprese.it (hereinafter, the "Owner"). 2. Purpose of processing, legal bases and data retention times WHY ARE YOUR PERSONAL DATA PROCESSED? To allow the user to register on the Site and use the related services. WHAT IS THE LEGAL BASIS THAT MAKES THE PROCESSING LAWFUL? The execution of a contract of which the interested party is a party. HOW LONG DO WE KEEP YOUR PERSONAL DATA? For the entire duration of the contractual relationship and for the following 10 years, as the ordinary limitation period. Once the storage terms indicated above have elapsed, the data will be destroyed, deleted or made anonymous, compatibly with the technical cancellation and backup times. 3. Provision of data The data marked with an asterisk are necessary for the purpose of purchasing the Products, while the others are optional. 4. Categories of recipients. The data may be disclosed to other third parties also operating as independent owners, such as public authorities and professional firms. The data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, such as natural and / or legal persons who carry out functional activities for the purposes indicated above (eg IT services, communication and marketing services, customer care), also operating outside the European Union. In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (third country deemed adequate by the European Commission pursuant to art.45 of the GDPR with a decision of 28 June 2021), as well as may be transferred to its sub-processors established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, lett. c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. Furthermore, the data are processed by the employees of the Data Controller - belonging to the corporate functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions. 5. Rights of the interested party The interested party can exercise the rights referred to in Articles from 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him is being processed and, in this case, access to the same and to the information referred to to art. 15, the correction of inaccurate data, the integration of incomplete data, the deletion of data in the cases provided for by art. 17, the limitation of processing in the cases provided for by Article 18 of the GDPR, as well as opposing, for reasons related to their particular situation, the processing carried out for the legitimate interest of the owner. Furthermore, in the event that the processing is based on consent or on the contract and is carried out with automated tools, the interested party has the right to receive the data in a structured format, commonly used and readable by an automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). Furthermore, the interested party, at any time, has the right to revoke the consent given for marketing purposes, as well as to oppose the processing for this purpose, including the profiling connected to it. In the case of communications sent by e-mail, the interested party may also object by clicking on the "unsubscribe" link at the bottom of each e-mail. For the exercise of rights, the interested party can contact the Data Controller at the contact points indicated in paragraph 1. The interested party has the right to lodge a complaint with the competent supervisory authority in the Member State in which he habitually resides or works or in the State in which the alleged violation has occurred.

Below is the information required by the GDPR regarding the processing of the e-mail address (hereinafter, "Data") given in order to subscribe to the newsletter service, i.e. the periodic sending of e-mail communications containing updates on products, offers and initiatives from the Yamamay world (hereinafter, "Newsletter Service"). 1. Identity and contact details of the data controller Inticom S.p.a., tax code and p. IVA 02649140122, with registered and operational headquarters in Via Carlo Noè 22, 21013 - Gallarate (VA), e-mail address privacy@pianofortegroup.com, P.E.C. inticomspa@certimprese.it (hereinafter, the "Owner"). 2. Purpose of processing, legal bases and data retention times WHY ARE PERSONAL DATA PROCESSED? To provide the Newsletter Service. WHAT IS THE LEGAL BASIS THAT MAKES THE PROCESSING LAWFUL? The execution of a contract of which the interested party is a party. HOW LONG DO WE KEEP PERSONAL DATA? Until your withdrawal from the Newsletter Service in the manner indicated in point 5 below. Once the retention terms indicated above have elapsed, the Data will be destroyed, deleted or made anonymous, compatibly with the technical cancellation and backup times. 3. Provision of data The user is only asked for the e-mail address, which is necessary for the provision of the Newsletter Service; therefore, any refusal to provide it will make it impossible to use the Newsletter Service. The provision of a discount coupon on the user's first order represents a mere incentive for users to subscribe to the Newsletter Service and to make the Controller's activities better known. It is understood that the user is always allowed to withdraw from the Newsletter Service, without this resulting in the inability to benefit from this discount coupon. 4. Withdrawal from the Newsletter Service To stop receiving the e-mails referred to in the Newsletter Service, the user can click on the unsubscribe link at the bottom of each e-mail. 5. Categories of recipients. The data may be communicated to third parties operating as independent owners, such as public authorities and professional firms. The Data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, such as natural and / or legal persons who carry out functional activities for the purposes indicated above (eg IT services, mass sending of communications) also operating outside the European Union ("EU"). In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (third country deemed adequate by the European Commission pursuant to art.45 of the GDPR with a decision of 28 June 2021), as well as may be transferred to its sub-processors established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, lett. c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. Furthermore, the Data is processed by the Data Controller's employees - belonging to the corporate functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions. 6. Rights of the interested party The interested party can exercise the rights referred to in Articles from 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him is being processed and, in this case, access to the same and to the information referred to to art. 15, the correction of inaccurate data, the integration of incomplete data, the deletion of data in the cases provided for by art. 17, the limitation of processing in the cases provided for by Article 18 of the GDPR. Furthermore, in the event that the processing is based on consent or on the contract and is carried out with automated tools, the interested party has the right to receive the data in a structured format, commonly used and readable by an automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). For the exercise of rights, the interested party can contact the Data Controller at the contact points indicated in paragraph 1. The interested party has the right to lodge a complaint with the competent supervisory authority in the Member State in which he habitually resides or works or in the State in which the alleged violation has occurred.

Below is the information required by the GDPR regarding the processing of personal data provided by filling out the online form "Contact us" and using the relative customer care service. 1. Identity and contact details of the data controller Inticom S.p.a., tax code and p. IVA 02649140122, with registered and operational headquarters in Via Carlo Noè 22, 21013 - Gallarate (VA), e-mail address privacy@pianofortegroup.com, P.E.C. inticomspa@certimprese.it (hereinafter, the "Owner"). 2. Purpose of processing, legal bases and data retention times WHY ARE PERSONAL DATA PROCESSED? To respond to requests for information or assistance. WHAT IS THE LEGAL BASIS THAT MAKES THE PROCESSING LAWFUL? The execution of a contract of which the interested party is a party. HOW LONG DO WE KEEP PERSONAL DATA? The data will be kept for the time necessary to process the request and in any case no later than 1 year, except for further terms required by law. Once the retention terms indicated above have elapsed, the Data will be destroyed, deleted or made anonymous, compatibly with the technical cancellation and backup times. 3. Provision of data The provision of data marked with an asterisk is necessary for the correct management of the request; therefore, failure to provide it will not allow the sending of the same. 4. Categories of recipients. The data may be disclosed to third parties operating as independent owners, such as public authorities and professional firms. The data may also be processed, on behalf of the Data Controller, by third parties, designated as Data Processors pursuant to art. 28 of the GDPR, such as natural and / or legal persons who carry out functional activities for the purposes indicated above (eg IT services, customer care), also operating outside the European Union ("EU"). In particular, the data will be transferred to the company that deals with the management and maintenance of the Site, namely VTEX Ecommerce Platform Limited, located in the United Kingdom (third country deemed adequate by the European Commission pursuant to art.45 of the GDPR with a decision of 28 June 2021), as well as may be transferred to its sub-processors established outside the EU. In the event that these sub-processors are established in countries without an adequacy decision pursuant to art. 45 of the GDPR, the standard contractual clauses adopted by the European Commission pursuant to art. 46, par. 2, lett. c) of the GDPR, with the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law. Furthermore, the data are processed by the employees of the Data Controller - belonging to the corporate functions responsible for pursuing the aforementioned purpose - who have been expressly authorized to process and who have received adequate operating instructions. 5. Rights of the interested party The interested party can exercise the rights referred to in Articles from 15 to 22 of the GDPR, where applicable, and, in particular, obtain from the Data Controller confirmation that personal data concerning him is being processed and, in this case, access to the same and to the information referred to to art. 15, the correction of inaccurate data, the integration of incomplete data, the deletion of data in the cases provided for by art. 17, the limitation of processing in the cases provided for by Article 18 of the GDPR. Furthermore, in the event that the processing is based on consent or on the contract and is carried out with automated tools, the interested party has the right to receive the data in a structured format, commonly used and readable by an automatic device, as well as, if technically feasible, to transmit them to another holder without impediments (right "to data portability"). For the exercise of rights, the interested party can contact the Data Controller at the contact points indicated in paragraph 1. The interested party has the right to lodge a complaint with the competent supervisory authority in the Member State in which he habitually resides or works or in the State in which the alleged violation has occurred.