Notice on the Use of Tracking Pixels in Emails

Introduction 
This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR), as well as Article 122 of Italian Legislative Decree No. 196/2003 (Italian Data Protection Code) and the Provision of 17 April 2026 issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) concerning the use of “tracking pixels” in email communications. This notice also supplements the other privacy notices available on the website and, together with them, provides all the information required under Article 13 of the GDPR and the other applicable provisions issued by the Italian Data Protection Authority.

Scope of this Notice 
Our company uses tracking technologies based on so-called “tracking pixels” or “tracking beacons” in its email communications in order to collect certain information relating to recipients, which may include personal data. Accordingly, the purpose of this notice is to explain clearly and precisely the purposes for which such technologies are used and how they operate.

Definition of Tracking Pixels 
Tracking pixels, also known as pixel tags or tracking beacons, are very small images embedded in emails and loaded via a hyperlink. When the recipient opens an email, code embedded in the message may automatically trigger a request to a server to download the image. This mechanism allows the sender to collect information, for example, about whether messages have been opened and, where technically detectable, whether they have been deleted, forwarded or archived, as well as information relating to the recipient, such as their IP address and the type of device used.

Tracking Pixels Used and Their Purposes 
The purposes for which our company may use tracking pixels are set out below:

1. Anonymous and aggregated statistics: tracking pixels are used to obtain overall statistics on email open rates, with a view to improving email deliverability and combating spam, including for the benefit of users themselves. The recipient’s consent is not required for this use
2. Security: tracking pixels may be necessary to implement specific security measures, for example in connection with authentication procedures used to provide services requested by the user, where information confirming that a message has been opened is relevant. The recipient’s consent is not required for this use.
3. Corporate or service communications: tracking pixels are used for particularly important communications where it is relevant to ascertain whether the recipient has actually become aware of the communication by obtaining information as to whether the message has been opened, for example communications concerning contractual amendments, security incidents, deadlines and compliance requirements. The recipient’s consent is not required for this use.

Data Collected Through Tracking Pixels 
Tracking pixels may allow our company to collect certain personal data relating to recipients that are strictly connected with information about the opening of messages, such as the IP address, the type of device used, the time spent viewing messages and similar information. Such data will be processed in full compliance with applicable data protection legislation, limiting the processing to what is strictly necessary to achieve the purposes pursued, in accordance with the principle of data minimisation established by the GDPR.

Technical Settings to Prevent Tracking
Recipients are reminded that tracking, irrespective of the purpose of the communication, can only take place if image downloading is enabled. If the user reads the email exclusively in plain-text format, the tracking pixel, like other images, is not downloaded and therefore cannot perform its tracking function.

Legal Basis for Processing 
Where tracking pixels are used for statistical or security purposes and/or for sending corporate or service communications, the processing is necessary to optimise the services provided to users. Depending on the circumstances, the legal basis for the processing may be the legitimate interests pursued by the Data Controller and the recipients, the performance of a contract or steps taken at the request of the data subject prior to entering into a contract, and/or compliance with a legal obligation to which the Data Controller is subject.

Recipients or Categories of Recipients of Personal Data 
Personal data may be disclosed to third parties solely for the purpose of complying with legal or contractual obligations or fulfilling requests made by the user. Personal data will under no circumstances be disseminated to the public.

Persons Authorised to Process Personal Data 
Personal data will be processed exclusively by specifically appointed and duly authorised personnel.

Data Subject Rights 
Users are entitled to exercise all rights provided for under the GDPR, including the right to request access to and rectification of their personal data, erasure of their personal data, restriction of processing, the right to object to processing, and the right to data portability. Users also have the right to lodge a complaint or submit a report to the competent supervisory authority, namely the Italian Data Protection Authority (Garante per la protezione dei dati personali), or to seek a judicial remedy before the competent courts.

Transfers to Third Countries 
Any transfer of personal data to a third country outside the European Union or to an international organisation will take place on the basis of an adequacy decision adopted by the European Commission or, in the case of transfers referred to in Articles 46, 47 or Article 49(2) of the GDPR, on the basis of appropriate safeguards.

Data Controller 
The Data Controller is Nexion S.p.A., with registered office in Correggio (RE), Strada Statale 468 No. 9, Italy

Data Protection Officer 
The Data Protection Officer (DPO) is Dr Juri Torreggiani, whose office is located at Via Piccard No. 16/G, Reggio Emilia, Italy. Any request for clarification or further information may be addressed to the Data Protection Officer.

This notice may be supplemented, either orally or in writing, with additional information or guidance in order to address any further information requirements concerning privacy and data protection matters and to reflect future regulatory developments.

Execution date: 21 October 2026