PERSONAL DATA PROCESSING NOTICE ("PRIVACY POLICY")

Service: European Funds Monitoring Provider: Massimo Gabellone, a sole trader registered in Albania under NUIS M21306029D Version: 1.1 — 21/09/2026 Applicability: this notice applies (a) to anyone visiting the Provider's website, as a stand-alone notice under Art. 13 GDPR; (b) to anyone activating the "European Funds Monitoring" service, as an integral part of the Service Agreement under its Art. 12.8.

1. Data controller

1.1 Controller. The data controller is Massimo Gabellone, a sole trader registered in Albania under NUIS M21306029D, with registered office at Rruga Riza Cerova, nd. 2, hy. 7, ap. 40, postal code 1001, Tirana (Albania), tel./WhatsApp +355 692882052, email monitoring@massimogabellone.com.

1.2 Contacts. The data subject may contact the controller at the email address in point 1.1 for any question on the processing of personal data or to exercise the rights set out in section 7.

1.3 DPO. The controller is not required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR. Requests are handled directly by the controller at the address in point 1.1.

2. What personal data we process

2.1 Client entity data. For the activation and supply of the Service we process the identifying data of the collective entity: name, legal form, registered office, tax code/VAT number or equivalent national identifier, and the professional profiling data (sector, territory, type of activity) entered in the profiling form.

2.2 Data of the person completing the form. We process the identifying data of the person who completes the profiling form on behalf of the entity: name, surname, role and contact email.

2.3 Payment data. For bank transfer payments, the controller processes exclusively the data necessary to reconcile the credit and manage accounting: Client name, amount, credit date, payment reference and, where visible, the account reference from which the payment originates. No online payment provider is used in the active service phase.

2.4 Browsing data — server statistics and Google Analytics. When the website is visited we process technical data collected automatically, such as IP address, date and time of the request, browser and device type, pages visited. These data are necessary for the technical operation of the website, for security (prevention of attacks and unauthorised access) and for the diagnosis of any malfunction. This part of the processing takes place server-side and does not require the user's consent, as it is necessary to provide the requested service.

If the user gives consent through the cookie banner, the website also uses Google Analytics 4 (provided by Google LLC, with registered office in the United States), configured to collect aggregate visit statistics: pages viewed, geographic origin of visitors, device type, traffic sources. The configuration adopted provides for: anonymisation of the IP address; disabling of Google Signals and of data sharing with Google; data retention period set to the minimum (2 months); processing in the EU region where technically possible. Google Analytics uses cookies of limited duration (_ga, _ga_XXXXX) to recognise user sessions. No data is used for behavioural advertising, remarketing or the creation of personal profiles. The user may withdraw consent at any time by reopening the cookie banner from the website footer.

2.5 Cookies. The website uses:

- technical cookies strictly necessary for operation (for example: user session management, storage of the preferred language, storage of the cookie preferences themselves). These cookies do not require prior consent;

- third-party Google Analytics cookies used for the visit statistics described in point 2.4. These cookies require the user's prior consent and are activated only after express acceptance through the cookie banner.

On the first visit to the website, the user receives a cookie banner allowing them to: accept all cookies; refuse non-technical cookies (in which case the website works normally but without Google Analytics); customise the choice per category. The choice made is recorded and remains valid until changed by the user. The user may at any time change or withdraw their preferences through the "Cookie preferences" link in the website footer.

3. Purposes and legal bases of the processing

3.1 Supply of the Service (performance of the contract). We process the data of the Client entity and of the person completing the form to activate and supply the Service, generate the reports, manage the contractual relationship and provide assistance. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.2 Payments. We process the data necessary for the management of bank transfers and of Service activations. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.3 Tax and accounting obligations. We process the data to comply with the tax, accounting and administrative obligations provided for by law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

3.4 Security and defence in legal proceedings. We process the technical browsing data (point 2.4) to ensure the security of the website and prevent unauthorised access, and we process the contractual data for the defence of any claims in judicial or out-of-court proceedings. Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR), consisting in protecting the integrity of the website, preventing abuse and protecting its rights in the event of litigation. The controller has carried out a balancing assessment against the rights of the data subject, considering that interest to prevail by reason of the strictly technical and defensive nature of the processing.

3.5 Visit statistics. If the user gives consent through the cookie banner, we process the browsing data to collect aggregate statistics on visits to the website through Google Analytics 4 (point 2.4). Legal basis: consent of the data subject (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time through the "Cookie preferences" link in the website footer, without affecting the lawfulness of the processing carried out before withdrawal.

3.6 Communications. We process the contact email address to send the operational communications relating to the Service (delivery of reports, expiry notices, suspension or reactivation notices) and the reminders provided for by the contract. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). We do not send promotional communications, direct marketing or newsletters without the specific prior consent of the data subject.

4. Recipients of the data

4.1 Provider's bank. The bank where the Provider's account is held processes the transfer data according to its own notice and for executing the transaction. The Provider receives from the bank the information necessary to verify the credit and record the payment.

4.2 Statistics provider. If the user gives consent through the cookie banner, the browsing data are processed by Google LLC (Google Analytics 4, with registered office in the United States) for the production of aggregate statistics on visits to the website (point 2.4). Google acts as a processor on behalf of the controller under the Data Processing Amendment (DPA) accepted by the controller when configuring the service.

4.3 Hosting and email provider. The service (monitoring.massimogabellone.com) is hosted on Hetzner Online GmbH servers (Germany, EU); the mailbox of the massimogabellone.com domain is managed through Serverplan S.r.l. (Italy). Both act as processors on behalf of the controller.

4.4 Advisers and authorities. The data may be communicated to the controller's tax and accounting advisers, within the limits of their respective duties and of legal obligations, and to public authorities that request them in the cases provided for by law.

4.5 No transfer to third parties. The personal data are not sold, assigned or communicated to third parties for commercial or marketing purposes.

4.6 Processors. The parties indicated in points 4.2 and 4.3 that process data on behalf of the controller are appointed as processors under Art. 28 GDPR, with the relevant data processing agreements (DPA) signed by the controller.

5. Transfer of data outside the European Union

5.1 Application of the GDPR. The controller is established in Albania, a third country in relation to the European Union without an adequacy decision under Art. 45 GDPR. As the Service is also offered to entities established in the European Union, the processing of the personal data of the relevant data subjects falls within the scope of the GDPR under Art. 3(2)(a).

5.2 Processing in Albania. The processing carried out directly by the controller takes place in Albania. It does not constitute a "transfer" under Chapter V of the GDPR, since the controller does not transmit the data to a different controller or processor: it is the controller itself that processes them at its own establishment. The processing also complies with Albanian Law No. 124/2024 "Për mbrojtjen e të dhënave personale", which fully transposes Regulation (EU) 2016/679 (GDPR).

5.3 Transfers to providers established outside the EU. The transfers of data to Google, indicated in section 4, are governed by the Standard Contractual Clauses approved by the European Commission by Decision 2021/914 (SCC), adopted by the provider within its data processing agreement signed by the controller. For Google Analytics the guarantees described in point 2.4 (anonymisation of the IP address, disabling of data sharing) also apply. A copy of the clauses is available on request at the address in point 1.1.

5.4 Other providers. The other providers indicated in section 4 are established in the European Union (Serverplan S.r.l., Hetzner Online GmbH) or process the data only to the extent strictly necessary for the supply (advisers and authorities referred to in point 4.4).

6. Data retention period

6.1 Contract and profiling data. The data relating to the Client and to the person completing the form are retained for the duration of the contract and for the 10 years following its termination, for tax, accounting and litigation-defence purposes, in line with Art. 12.5 of the Service Agreement. After that period, the data are erased or anonymised.

6.2 Payment data. Bank transfer data are retained by the controller for the period applicable to contractual, tax and accounting data. The bank retains its own data according to its notice and legal obligations.

6.3 Browsing data — server statistics. The technical data processed server-side are retained for the time strictly necessary for the security and diagnostic purposes, and in any case no longer than 12 months, save for the need to investigate cybersecurity breaches or to defend claims in judicial proceedings.

6.4 Browsing data — Google Analytics. The data collected through Google Analytics are retained according to the parameters configured by the controller, with the retention period set to the minimum (2 months), as indicated in point 2.4.

6.5 Criteria for the retention period. The 10-year period in point 6.1 corresponds to the retention period provided for by Albanian tax and accounting law (Law No. 25/2018 "Për kontabilitetin dhe pasqyrat financiare") and coincides with the time reasonably necessary for the judicial defence of the rights arising from the contract. The controller applies that period uniformly to all contractual data, since the technical separation of the data by distinct purpose would entail a disproportionate burden compared with the benefit, and in any case the data remain necessary for the judicial defence until the same period. The processing remains compliant with the principle of storage limitation (Art. 5(1)(e) GDPR).

7. Rights of the data subject

7.1 Rights. The data subject may exercise the following rights provided for by Arts. 15-22 GDPR and the applicable Albanian law:

- access (Art. 15 GDPR): to obtain confirmation of the processing and a copy of the data;

- rectification (Art. 16 GDPR): to correct inaccurate data or complete them;

- erasure (Art. 17 GDPR): to request the erasure of the data, in the cases provided for;

- restriction (Art. 18 GDPR): to restrict the processing, in the cases provided for;

- portability (Art. 20 GDPR): to receive the data in a structured, commonly used and machine-readable format;

- objection (Art. 21 GDPR): to object to processing based on legitimate interest;

- withdrawal of consent (Art. 7(3) GDPR): to withdraw at any time the consent given for Google Analytics through the cookie banner, without affecting the lawfulness of the processing carried out before withdrawal.

7.2 How to exercise them. The data subject exercises the rights by writing to the controller's email address indicated in point 1.1. The controller replies without undue delay and in any case within one month of the request, a period extendable by a further two months in the case of complex requests.

7.3 Complaint to the supervisory authority. The data subject may lodge a complaint with the competent supervisory authority: for clients established in the European Union, the supervisory authority of their own Member State; for the Albanian rules, the Commissioner for the Right to Information and Protection of Personal Data (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale).

8. Changes to this Privacy Policy

8.1 Updates. The controller may amend this notice to adapt it to regulatory changes, new processing purposes or changes in the providers indicated in section 4. The updated version is published on the website with the date of the last update.

8.2 Communication of changes. Substantial changes affecting the rights of data subjects are communicated by email to active Clients with at least 30 days' notice before they take effect. For website visitors, the version in force is always the published one.

8.3 Processing already carried out. Changes to this notice do not affect the lawfulness of the processing carried out before they take effect.