SPORTWIG.COM BUSINESS REFERRAL POLICY

pursuant to art. 13 Regulation (EU) 2016/679 (GDPR) on the processing of personal data

With this information, we would like to explain to you what information we collect if you access the referral program that we activate for business partners (so-called referral business) or the one provided for private users.

DATA CONTROLLER.

The Sportwig e-learning platform is managed, as Data Controller, by SW Holding S.r.l., with registered office in Via Sansovino 6 — 20045 Lainate (MI). In this capacity, we decide which personal data to process, with what means and purposes. For any request you can write to us, filling out the appropriate form on the

site.

We have also appointed a Data Protection Officer, Attorney Andrea Baldrati, who will be able to answer any questions or clarifications regarding the very way in which we process your data. He can be contacted at the following email: privacy@sportwig.com.

LEGAL BASES AND PURPOSES.

Every treatment must be based on an appropriate legal basis, taking into account the purposes for which the personal data are processed. The following table is intended to represent in a clear and concise manner the purposes and legal bases of the treatments carried out as Data Controller, to execute the

referral program.

Purposes of processing activities	Description of treatment activities	Legal basis for processing activities
Teacher registration procedure on Sportwig	We'll assign you a tracking code and URL that you can share with your customers. With respect to all users who access Sportwig.com through that code or that specific referral URL, you will be awarded a commission as agreed, while the user who has subscribed to our service will be offered an ad hoc discount . For individuals, the mechanism concerning the flow of data is the same, only the premium changes, here represented by a credit that can be spent on the platform.	Execution of the contract for the activation of the course. Sportwig's legitimate interest in storing the registration cookie. Legal obligation in relation to tax or accounting obligations.

IF YOU DON'T RELEASE YOUR DETAILS.

To follow up on our agreement, which involves the activation of a tracking code and URL, we ask you for your email and other data, such as your IBAN, necessary for the subsequent management of the commissions due. We remind you that, however, you are in no way obliged to provide us with such data, but that in the absence of them, it will be impossible for us to continue

with the agreement.

DATA RETENTION PERIOD OR POLICY.

Your data will be kept for the time necessary to pursue the purposes that we have indicated above. Specifically:

• We will keep payment receipts and invoices for 10 (ten) years from their issuance;
• We will also keep for 10 years from the conclusion of our commercial agreement those data that we may need to protect ourselves in the event of your disputes or complaints.

RECIPIENTS AND OTHER SUBJECTS TO WHOM THE DATA ARE COMMUNICATED.

Exclusively for the purposes indicated above, your data could be:

AUTHORIZED TO PROCESS: these are our employees or internal figures who process your data for the purpose of their respective tasks.

DATA PROCESSORS: they are third-party collaborators who process data on our behalf, through the conclusion of a special appointment agreement as Manager, by means of which the delegated operations are defined, as well as the security measures that they must adopt in order to better protect the information they obtain from us.

In particular, they may process your data:

• AWS (Amazon Web Services, Inc.), such as Website Hosting with data centers in the EU;
• Sendinblue, as a SaaS solution for relationship marketing, with server location in the EU. On this point you can learn more at this link
;
• Vimeo LLC, a video hosting and sharing platform that also declares to adhere to the new standard contractual clauses;
• OVHcloud, as an email provider with a data center in the EU;
• Legalmail by Infocert, our Italian PEC provider;
• Adamo, the management system used for billing and accounting purposes that guarantees the processing of data within the EU;

External professionals, such as our accountant for tax obligations;

RECIPIENTS: they are those who receive our communications of personal data, but who, following this communication, act as independent Data Controllers. Among these:

• Stripe, as a payment intermediary service;
• Banks or credit institutions;
• Judicial Authority and/or Public Security Authority, in cases expressly provided for by law or in the context of judicial proceedings also to ascertain or defend our right.

YOUR RIGHTS.

In your capacity as an interested party, you have the right to obtain access to your personal data from the Data Controller, in addition to the correction or cancellation of the same; you also have the right to limit or object to the processing that concerns you (articles 15 et seq. GDPR). In addition, you have the right to lodge a complaint with the Privacy Guarantor (art. 77 GDPR), or to go to the appropriate courts (art. 79 GDPR).