INFORMATION PURSUANT TO ART. 13 – 14 OF THE REG. EU No. 679/2016 (“ GDPR ”)

This Information Notice describes which of your personal data is collected by Siryo SpA , for what purposes, and how it is processed. Below, you will also find the information you need to exercise your rights under the GDPR.

In general, we collect your data when you browse the web”Website” https://www.siryo.it (hereinafter the ” “Website” “) and when you contact us through the “Website” or interact with us through our social media page on LinkedIn (hereinafter the ” Social Media Page “). We inform you that the personal data collected during these processes will be processed as indicated below.

1. Who processes your data: data controller

Siryo SpA , VAT number 08335170729, with registered office in Piazza Massari n. 19 – 70122 Bari , e-mail: info@siryo.it (hereinafter “ Data Controller ”) is the controller of your personal data .

Limited to the data collected through our Social Media Page, LinkedIn is a joint controller of your personal data, as published on the platform. For more information, please read their privacy policy.

2. What data we process – Type of data processed

Your contact information. We retain the information you provide us (e.g., contact information, first and last name) when you contact us through the “Website”, or when you contact us through our Social Media Page, through public comments, or through private messages.

Information about your use of the “Website” and your activities on the “Website”. Your use of the “Website” involves the Data Controller processing data about your browser and device.

3. Where we get your data – How we collect data :

Directly from you . For example, if you contact us by email, through the “Website”, or ask us a question through our Social Media Page .

Through the use of the “Website” ‘s features . We use cookies on the “Website” to collect data on your usage. To learn more, please read the Cookie Policy below.

4. Why and for how long we process your data – Purpose and legal basis of data processing; retention period
   a) To respond to your requests collected through the Web”Website” and Social Media Page. For example, we will use your data to respond to requests received through the Web”Website” in the “Contacts” section, by email, or via our Social Media Page, whether in the form of public comments or private messages.

The legal basis for this processing is the execution of a contract to which the data subject is a party, or the fulfillment of pre-contractual obligations, and the retention period is equal to the time necessary to respond to the data subject’s requests.

b ) To evaluate unsolicited applications or applications for open positions. We will process your data to evaluate applications received by email when you access the “Work with Us” section or when you apply for a specific open position. The legal basis is the fulfillment of pre-contractual obligations. For more information, please consult the information available at this link . If, instead, you wish to apply for an open position in a company within the Data Controller’s Group, you will be redirected directly to that company’s web”Website”, which will process your data as an independent data controller and in accordance with the information notice  it will make available to you.

1. c) To prevent or control illegal conduct or to protect and enforce rights. We may use your data to prevent the infringement of our intellectual property rights (for example, counterfeiting of our and/or our partners’ trademarks) or theft or other illegal activities, insofar as permitted by applicable law.

The legal basis for this processing is the legitimate interest of the Data Controller. Your data will be retained for the period of time reasonably necessary to enforce our rights from the moment we become aware of the unlawful act or potential unlawful act.

5. Nature of the provision of personal data

For the purpose referred to in the previous paragraph, Providing your data is optional, but failure to provide it will prevent us from processing your requests and/or examining your CVs.

6. Where your data is processed – data transfer

The data will be processed and stored at the Data Controller’s offices and IT systems. We may use service providers or rely on companies that act as data processors under agreements compliant with Article 28 of the GDPR. When located in third countries, these providers operate on the basis of standard contractual clauses in accordance with the European Commission’s decision on data protection clauses or pursuant to an adequacy decision by the European Commission regarding the level of data protection. These providers possess only the personal data necessary to perform their functions and may use it solely to perform these services on our behalf or to comply with legal requirements. You can obtain information on transfers to third countries by writing to the Data Controller’s address indicated above.

Exclusively regarding the data collected on our Social Media Page, the same will be stored on the aforementioned platform, in accordance with the latter’s privacy policy, which we invite you to consult.

7. Who we share your data with – recipients of personal data

Without prejudice to the fact that, where required by law, we will obtain your prior consent and complete any formalities required by law, we may share your data with the following third parties (including as data processors):

Our service providers We may share your personal data with third parties so that they can provide us with services. They will act as data processors and with whom we will enter into an agreement compliant with Art. 28 GDPR to protect your data. These parties will only possess the data necessary to perform their functions and may use it only to perform these services on our behalf or to comply with legal requirements. You can

obtain a complete list of these data processors by writing to the Data Controller at the addresses indicated above .

Where permitted or required by law, we may also share personal data requested by a government agency or other authorized individual or organization in order to protect or exercise your rights or the rights of third parties, or to limit or prevent fraud and other illegal activities.

8. Minors

The “Website” is not intended for children under 18, but is intended for an adult audience. If you are a parent or guardian and believe your child has provided us with information, you can contact us.

9. Security measures

We adopt the security measures required by law. We adopt security measures to protect your data. The standard security measures we use depend on the type of data we process and meet the requirements of the law and the standards of European government agencies.

10. Cookies

What are cookies? Cookies are small text files that web”Website”s send to users’ terminals when they visit them. They are stored there before being retransmitted to the same web”Website”s on subsequent visits.

List of cookies

Cookie Name	Supplier	Purpose	Duration	Type
Google Analytics	Google	Recognized users fot statistical analysis	About TWO years	GA1.1.1435869183.1747118283
Google Analytics (GA4)	Google	Manages sessions and interactions	About TWO years	ga_785CJHQBNV
Q Translatex	John Clause	Save the language chosen by the user	About one years	qtrans_front_language — it

11. Your rights

You can contact the Data Controller to request access to your personal data, rectification, erasure, or restriction of processing, to object to processing, and to request data portability, where processing is carried out using automated systems.

When exercising your right of access, you have the right to know whether your data is being processed, the purpose of the processing, the categories of data processed, the recipients or categories of recipients to whom your data has been disclosed (and, if they are located in a third country, based on what guarantees), the retention period of your data (or the criteria used to determine the retention period), whether automated processing is taking place (for example, through profiling), the logic behind such processing, and the source of the data (if not initially collected by us). You can exercise your rights by contacting the Data Controller at the addresses indicated above.

You have the right to lodge a complaint with the competent supervisory authority.

You can also exercise your rights regarding the processing of your personal data through our Social Media Page by contacting LinkedIn as set forth in their privacy policy.

12. What we do if we change this policy

We may make changes to our privacy policy. We will also post an updated version on the “Website” . Please check the “Website” periodically for updates.

Version updated on 07/31/2025