TERMS & CONDITIONS

Dear Customer,

MV Agusta Motor S.p.A. (hereinafter "MV Agusta" or "Company"), as Data Controller, wishes to inform you that, pursuant to art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data (hereinafter "European Regulation"), you need to proceed with the processing of personal data provided by you for the purposes referred to in paragraph 3. related to the purchase of products and services provided by the Company in accordance with current legislation and as set out below.

1. HOLDER AND CO-OWNER OF THE TREATMENT

The Data Controller is MV Agusta Motor S.p.A., in the person of its Delegate and legal representative pro tempore, domiciled at the registered office in Varese, 21100, Loc. Schiranna, Via G. Macchi 144 (hereinafter "Data Controller").

The Data Controller, for some processing operations as identified for the purposes referred to in paragraph 2, will be joined by the company Shopify International Limited, in the person of its Delegate and legal representative pro tempore, domiciled at the registered office in 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, which will act as co-owner of the processing, meaning for these "two or more companies that jointly determine the purposes and means of processing" as provided for in Article 26 of the European Regulation (hereinafter jointly with the Data Controller, the "Data Controller").

The Data Controllers have entered into a joint ownership agreement, pursuant to Article 26 of the European Regulation, by which they have undertaken to:

• jointly determine certain purposes and methods of Processing of your Personal Data;
• jointly determine, in a clear and transparent manner, the procedures for providing you with timely feedback should you wish to exercise your rights, as provided for in Articles 15, 16, 17, 18 and 21 of the European Regulation and in cases of portability of Personal Data as provided for in Article 20 of the European Regulation;
• jointly define this Information Notice in the parts of common interest, indicating all the information required by the European Regulation.

2. LEGAL BASIS AND METHOD OF PROCESSING

In consideration of the purchase of products and services provided by the Company, both at the point of sale and online (interaction with the Company's websites and internet applications, mobile, subscription to sites / apps and online initiatives such as newsletters, mailing lists, events, competitions and promotions), the legal basis on which the processing of your personal data is based is the legitimate interest of you and the data controllers, and consent to the processing by you. Therefore, the personal data and possibly also those belonging to particular categories processed by the Contributors are exclusively those provided by you when purchasing products and services provided by MV Agusta.

Your personal data may be processed both through computer tools and on paper.

Your personal data may be provided when you register at MV Agusta sales points using paper and/or electronic forms, when you participate in events, fairs and exhibitions in which MV Agusta participates or organises, or during your interaction with MV Agusta's websites, internet and mobile applications.

Incomplete or untrue communication of your personal data will make it impossible for the Owners to ensure the consistency of treatment, as well as its compliance with the obligations imposed by the regulations of reference.

At any time you may exercise your right to revoke the consent given, but such revocation does not affect the lawfulness of any processing that has taken place previously.

3. PURPOSE OF TREATMENT

Your personal data will be processed exclusively to allow the establishment, execution and termination of the purchase of products and services provided by the Company and the consequent obligations arising from legal obligations, judicial obligations, administrative, accounting, tax, financial, insurance, as well as the obligations arising from security activities of computer systems, networks and business information. In particular, your personal data, and any data belonging to particular categories, will be processed by the Company for the following purposes:

A) Purposes for the management of the relationship with customers:

1. to allow registration and authenticated access to the website www.mvagusta.com;
2. to respond to your requests for information and/or materials;
3. provide the products and assistance requested by you and the related services (for example, but not limited to: after-sales, marketing, App, etc ...);
4. execute obligations arising from a contract with you or activities of a pre-contractual nature, including by sharing data by MV Agusta to its sales network or to third parties contractual Company.

For Purpose A) it is necessary that you provide the Company with your personal data; your refusal would prevent MV Agusta from carrying out the above activities.

B) Further Purposes

1. sending of promotional newsletters, commercial or advertising communications, for direct sales, product surveys aimed at measuring your level of satisfaction and potential customers through e-mail (newsletters), telephone, SMS, MMS, chat, banners on the Site, instant messaging, social networks and traditional mail, including the sending of invitations to events in which MV Agusta participates or organizes, in sales and service points or by business partners.
2. profiling activities through the collection of information relating to your preferences, habits, lifestyle, information on your interaction with MV Agusta, for the creation of group and individual profiles ("profiling") and, if you give your consent for marketing activities, also for the sending of personalized promotional communications and offers. Further information will be obtained by comparing the data collected by the Company with the data that is generally available to the public (by way of example: social network profiles published by you; cookies and other tracking systems on the Site; tracking systems on your motorcycle - where applicable and only in compliance with the Regulations.

For the marketing and profiling purposes indicated above, your consent is optional; your refusal will not have any effect on the A) Purposes.

On the basis of the legitimate interest, the Company, in compliance with the European Regulation and within the limits of Italian law (art. 130, paragraph 4, Legislative Decree 196/2003 amended by Legislative Decree 101/2018), may use your e-mail address provided when purchasing products and services of MV Agusta (so-called "soft spam"). If you do not wish to receive communications for the Purposes B), you may notify MV Agusta at any time that, in this case, it will cease all activities without delay.

The Company may send you surveys without commercial purposes, which are not mandatory to improve the quality of Customer Service. Your data collected from survey responses (service and product surveys), together with other information we hold about you, may enable the Company to identify you.

In order to use the app's functionalities, you will need the data relating to your geographical location and your movements recorded by the GPS system of your Apple or Android device. The App features can be activated and deactivated at your discretion at any time, through the device on which the App is installed. Data relating to your geographical location and your movements are processed by MV Agusta only to activate the functionalities of the App when you request such functionalities. The data is recorded both on your device and on the servers of MV Agusta, and you can access and use it also through the platform of MV Agusta in case of subsequent replacement or loss of your device. You may at any time delete the data recorded through the App itself or through your account.

It may be possible to login to the App and the Website through social networks (so-called "social login"). In this case, your personal data used for the operation of the App or to register on the Site are acquired directly by you, unless you expressly request registration and the relevant login via social networks at first access, or subsequently if already registered. If you use these features, MV Agusta will store through the social network only the information from your profile that you expressly authorize the sharing from the social network. In any case, the Company will not send any of your personal data or information concerning you to social networks.

4. PERIOD OF RETENTION OF PERSONAL DATA

The data controllers intend to keep your personal data for a period of time not exceeding that necessary for the achievement of the purposes for which they are collected and processed.

The data recorded by the MV Agusta Apps will be kept for 12 months from your last access, while the Account, including the data you entered, will be deleted upon your specific request.

Your personal data that may be processed for the "Further Purposes" listed in point 2. above, will be kept for a maximum of 5 (five) years for non-customers and 10 years for customers and former customers, a term considered appropriate given the frequency of purchase of our products, considered luxury goods.

After the expiry of the retention period, personal data will be automatically deleted or made anonymous.

In any case, as we are unable to determine precisely the period of retention of your personal data, the Contributors undertake from now on to inspire the processing of your personal data to the principles of adequacy, relevance and minimization of the data, as required by the European Regulation, verifying annually the necessity of their conservation.

In addition, the Contributors must keep some of your personal data for the performance of all legal obligations and for administrative and fiscal purposes arising from these obligations. In this case, without prejudice to the principles listed above, the data controllers will keep this data for a maximum period of ten (10) years, in order to be able to meet any such needs or requests from the supervisory authorities.

This is without prejudice to the case in which the Contributors should need to maintain such data in order to comply with regulatory obligations, or to ascertain, exercise or defend concretely one of our rights in court.

5. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

They may become aware of your data, in relation to the purposes of processing set out above:

the subjects who can access the data in accordance with the provisions of the law provided for by the law of the European Union or that of the Member State to which the data controllers are subject;

our employees, provided that they have previously been designated as subjects acting under the authority of the Data Controller in accordance with art. 29 of the European Regulation or as System Administrators;

persons who carry out, within the European Union, in total autonomy, as separate data controllers, or as data processors appointed for this purpose by MV AGUSTA, purposes ancillary to the activities and services referred to in paragraph 3.The data subject shall have the right to obtain information about the processing of personal data, i.e. banking and insurance institutions, law firms and notaries, companies and tax consultants, companies offering accounting services, social security funds, IT assistance and consultancy companies as well as the design and implementation of software and/or websites, postal services, service centres, companies or consultants responsible for providing services to the Data Controller, within the limits of the purposes for which they were collected. MV Agusta provides these subjects with only the data necessary to perform the agreed services and they act as data processors, on the basis of the instructions received from MV Agusta.

Any communication of your personal data will take place in full compliance with the provisions of the law provided by the European Regulation and the technical and organizational measures taken by the Company to ensure an adequate level of security.

Finally, in order to provide you with MV Agusta products and services requested by you, other companies of the MV Agusta Group, importers, dealers and business partners may access your personal data on the basis of the applicable privacy law.

6. ANY TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION

Some of the companies of the MV Agusta Group, the sales network or third parties contractually linked to MV Agusta, which may have access to your personal data, are also established outside the European Union, in countries that do not guarantee an adequate level of protection for personal data according to the standards established by the European Regulation. In such a case, the Contributors shall take the necessary precautions for a legitimate transfer of data. You may request information on the transfer of your personal data abroad at any time by contacting the Holders.

7. THE RIGHTS OF THE DATA SUBJECT

In relation to the processing of your personal data, pursuant to the European Regulation, you as data subject have the right to:

• revoke your consent to the processing of your personal data at any time. It should be noted, however, that the revocation of consent does not affect the lawfulness of the processing based on consent prior to revocation, as provided for in art. 7, paragraph 3, of the European Regulation;
• ask the data controllers for access to your personal data, as provided for by art. 15 of the European Regulation;
• to obtain from the Data Controllers the rectification and integration of your personal data considered inaccurate, even by providing a simple supplementary declaration, as provided for by art. 16 of the European Regulation;
• obtain from the data controllers the cancellation of your personal data if there is even only one of the reasons provided for in art. 17 of the European Regulation;
• to obtain from the data controllers the limitation of the processing of your personal data if one of the hypotheses provided for in art. 18 of the European Regulation applies;
• receive your personal data from the Data Controllers in a structured format, commonly used and readable by automatic device, and have the right to transmit such data to another data controller without hindrance, as provided for in art. 20 of the European Regulation;
• object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out pursuant to art. 6, paragraph 1, letters e) or f), including profiling on the basis of these provisions, as provided for in art. 21 of the European Regulation;
• not be subject to decisions based solely on automated processing, including profiling, that produce legal effects that affect you or that significantly affect your person, if you have not previously and explicitly agreed, as provided for in art. 22 of the European Regulation. By way of example and not limited to, this category includes any form of automated processing of personal data aimed at analysing or forecasting aspects relating to consumer and purchasing choices, the economic situation, interests, reliability and behaviour;
• lodge a complaint with a supervisory authority, if it considers that the processing of your data violates the European Regulation. The complaint may be lodged in the Member State in which you are habitually resident, working or in the place where the alleged breach occurred, as provided for in Article 77 of the European Regulation.

To exercise each of your rights, you may contact the Holders by sending a written communication to the following addresses:

• MV Agusta Motor S.p.A., at its registered office in Italy, Varese, Loc. Schiranna, Via G. Macchi 144, 21100, or by sending an e-mail to the certified mail address mvagusta@pec.it or to the ordinary mail address info@mvagusta.com;
• Shopify International Limited, at the registered office in 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.