PRIVACY POLICY

Privacy Art Backers S.r.l.

EU Regulation 679/2016 (“GDPR”).

1. June 23, 2021

ART BACKERS S.R.L. (“Art Backers” or the “Data Controller“) is committed to the protection of the Personal Data entrusted to it. Therefore, their management and security are guaranteed with the utmost care, in accordance with the requirements of the privacy legislation set out in EU Regulation 679/2016 (GDPR)

This information explains who we are, for what purposes we may use your data, how we manage them, to whom they may be disclosed (eg user companies, facilities, public bodies, etc. ..), where they may be transferred and what are your rights.

Background

This privacy policy applies to all sales of physical products such as audiocassettes, vinyls, posters, t-shirts (hereinafter, “Physical Products” or “Physical Product”) and of so-called “Non Fungible Tokens” or “NFT” (hereinafter, “NFT“), related to the image and name of the Italian singer and composer Alessandro Mahmoud (aka “Mahmood“), and concluded remotely on the web page nft.mahmood.it (hereinafter, the “Website“), as better described in the General Terms and Conditions of Sale available on the Website and to which full reference is made (the “General Terms and Conditions“).

Art Backers S.r.l. will acquire personal data related to the users of the Web Page and to the purchasers of the Physical Products and of the NFT (hereafter, altogether “Users” or “User“) and will treat them in the respect of the law rules about personal data treatment, with particular reference to the GDPR and to the D.lgs 196/2003 and subsequent modifications and integrations.

Who will process my data?

Your data will be processed, as Data Controller, by:

The list of external Data Processors for the processing of Personal Data is available at the Data Controller’s registered office or upon request by contacting privacy@artbackers.com.

1. Why do you need my data?

The Data Controller will use Users’ data exclusively for the following purposes:

1. Purposes related to the management of the contractual relationship for the sale of Physical Products and NFT on the basis of the General Conditions. In this context, Personal Data will be processed for the following purposes: establishment, management and termination of the contractual relationship with Art Backers; fulfillment of accounting and fiscal obligations; fulfillment of legal obligations (for example: anti-terrorism checks); anti-money laundering checks; fiscal and accounting audits; management of disputes; provision, support, updating and information about the products sold and the services offered and the available features.

Art Backers will perform the treatment:

• with reference to letter a) above, because it is necessary for contractual fulfilments; to fulfil legal obligations, to which Art Backers is subject; because the processing is necessary to pursue a legitimate interest (e.g. anti-money laundering checks, use of video surveillance tools to protect company assets, fraud prevention, safeguarding of strategic company interests, for commercial relations).

It follows that the provision of personal data is necessary or mandatory for the purposes referred to in paragraph a) and can be carried out even without your consent.

Any partial or total failure to provide Data for the purposes under letter a) above will result in the partial or total impossibility to achieve the above purposes. The extent and adequacy of the Data provided will be evaluated from time to time, in order to determine the consequent decisions and avoid the processing of Data exceeding the purposes pursued.

We will not use your personal data for purposes other than those described in this policy, without informing you in advance and, where necessary, obtaining your consent.

1. How will you use my data?

Art Backers aims to protect the data of its customers, imprinting their treatment to the principles of fairness, lawfulness and transparency. We inform you, therefore, that your personal data will be treated through the use of tools and procedures that guarantee maximum security and confidentiality, through archives and paper media, with the help of digital media, computer and telematics. The communications referred to in point 2) above may be made by traditional means (e.g., paper mail, telephone calls with operator), automated (e.g., telephone calls without operator) and similar (e.g., fax, e-mail, sms, mms).

However, you have the right to exercise the right of opposition which, in the absence of your indication to the contrary, will refer to both traditional and automated communications.

1. How long will you keep my information?

Your Personal Data will be kept, starting from their receipt/update, for a period of time consistent with the purposes of processing described above.

Below is the duration of the different treatments:

1.  
2. Will you share my information with other individuals?

Your data may be communicated to partners of Art Backers for the management of contracts with you, and to third parties (including credit recovery companies, professionals, public bodies, auditing or supervisory bodies), to fulfill the obligations arising from the law, regulations, community rules or for aspects relating to the management and execution of the contractual relationship.

Your personal data will not be disclosed to third parties for marketing purposes unless you have expressly consented to such disclosure and have received adequate information about it.

For all the purposes indicated in this statement, your data may also be communicated abroad, within the European Union, in compliance with the rights and guarantees provided for by current legislation. If the data must be transferred to a subject located in a third country outside the European Union, this can be done only after verifying that the country in question guarantees an “adequate” level of protection and in compliance with current legislation also in light of the judgment of the European Court of Justice in the case of Facebook Ireland Ltd, Maximillian Schrems, n. C-311/18.

The Data will also be processed by Art Backers’ internal resources, adequately trained, who operate as authorized personnel for the processing of Data in accordance with art. 29 GDPR.

Access to archived Data may be carried out by public authorities, in the cases and modalities provided for by the laws in force.

Your Personal Data is not subject to disclosure.

In order to send service communications, or periodic mass communications also of a commercial and promotional nature, the email address of the interested party is included in a list of contacts through the service offered by third party suppliers. The list of such suppliers is available at the head office or upon request at privacy@artbackers.com

1. Marketing consent in favor of Universal Music Italia S.r.l.

On the basis of your express consent, the company Universal Music Italia S.r.l. with registered office in Via Benigno Crespi, 19, Milan (MI), Tax Code and VAT number: IT03802730154, licensee of the image rights of Mahmood’s name and art, may process your data for purposes related to marketing activities, sending information material and commercial promotion. In this context, with your specific consent, your personal data will be processed by Universal Music Italia S.r.l. for the following purposes: market research; economic and statistical analysis; social, cultural and solidarity initiatives; updates on training initiatives; sending advertising/information/promotional material and updates on Universal Music Italia S.r.l. initiatives, promotions and offers; communications and information on Universal Music Italia S.r.l. activities and on the events in which Universal Music Italia S.r.l. participates. Any possible exercise of the rights under Art. 7 below, concerning the processing of personal data entrusted, on the basis of marketing consent under Art. 6.1, lett. a) GDPR, to Universal Music Italia S.r.l, must be addressed to the latter by email at privacy.officer@umusic.com. To this end, by declaring that you have read this information, you declare that you have also read the privacy policy of Universal Music Italia S.r.l. available at the following link https://www.universalmusic.it/popular-music/privacy-policy/

1. What are my rights?

At any time, you will have the right to ask:

1. access to your personal data;
2. their rectification in case of inaccuracy of the same;
3. cancellation;
4. the limitation of their treatment.

You will also have:

the right to oppose their treatment:

• if processed for the pursuit of a legitimate interest of Art Backers except where required by law;
• if processed for direct marketing purposes;

the right to their portability, i.e. to receive in a structured, commonly used and machine-readable format the personal data you have provided.

We will take care of your request with the maximum effort to ensure the effective exercise of your rights. Finally, you will have the right to complain to the national supervisory authority (Garante Privacy).

1. Can I revoke my consent after giving it?

Yes, you may revoke your consent at any time, but you may not:

• undermine the lawfulness of processing based on consent given before revocation;
• affect further processing of the same data based on other legal grounds (for example, contractual or legal obligations to which Art Backers is subject).

1. I still have questions…

For further information on this policy or on any privacy issue, or if you wish to exercise your rights or revoke your consent, you can contact privacy@artbackers.com directly or visit the website of the Privacy Guarantor www.garanteprivacy.it.

Summary information on other rights of the data subject.

The GDPR confers on the data subject a series of rights that under the WP 260 Transparency Guidelines it is mandatory to summarize in their main content within the disclosure. Below these rights are summarized and summarized:

Right of access (to one’s own personal data only): The right to obtain from the data controller confirmation as to whether or not personal data concerning the data subject are being processed and, if so, to obtain access to the personal data and to be informed of the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients in third countries or international organizations; where possible, on the intended period of retention of personal data or, if this is not possible, on the criteria used to determine this period; where the data have not been collected from the data subject, the right to receive all available information about their source; the right to receive information about the existence of automated decision-making, including profiling and meaningful information about the logic used, as well as the importance and expected consequences of such processing for the data subject.

Right of rectification and integration: The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration. The data controller shall inform each of the recipients to whom the personal data have been transmitted of any rectification, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests.

Right to erasure: the data subject has the right to obtain from the data controller the erasure of personal data concerning him without undue delay (and where there are no specific reasons of art. 17 paragraph 3 of the GDPR that on the contrary relieve the holder from the obligation of cancellation) if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; or if the data subject revokes consent and there is no other legal basis for processing; or if the data subject objects to processing for marketing or profiling purposes, also by revoking consent ; if the personal data have been processed unlawfully or concern information collected from minors, in violation of art. 8 of the GDPR. The data controller shall inform each of the recipients to whom the personal data have been transmitted of any cancellation unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests.

Right to restriction of processing: the data subject has the right to obtain from the data controller the restriction of processing (i.e., within the meaning of the definition of “restriction of processing” provided by Article 4 of the GDPR: “the marking of personal data stored with the aim of limiting their processing in the future”) when one of the following applies: the data subject disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; the processing is unlawful and the data subject objects to the erasure of the personal data and instead requests that its use be restricted; although the data controller no longer needs the personal data for processing purposes, the personal data are necessary for the establishment, exercise or defence of legal claims; the data subject has objected to the marketing processing, pending verification as to whether the legitimate reasons of the data controller prevail over those of the data subject. If the processing is restricted such personal data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of substantial public interest The data subject who has obtained the restriction of processing shall be informed by the data controller before the restriction is lifted. The data controller shall inform each of the recipients to whom the personal data have been transmitted of any restriction, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests.

Right to object: the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her carried out by the controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or carried out for the purpose of pursuing the legitimate interests of the controller or of a third party (including profiling). In addition, if personal data are processed for direct marketing or commercial profiling purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes.

Right not to be subjected to automated decisions, including profiling: the data subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which significantly affects him or her in a similar way, except where the automated decision is necessary for the conclusion or performance of a contract between the data subject and a data controller; is provided for by law, subject to measures and safeguards; and is based on the data subject’s explicit consent.

However, for utility, the link to Articles 15-23 of the GDPR on the rights of the data subject is provided below.