COIMA – Privacy and Cookie Policy

This Privacy and Cookie Policy describes the purposes and methods relating to COIMA SGR S.p.A.’s collection and processing of the personal data concerning a user (the ”User”) who interacts with the website http://www.coima.com/ (“Website”) and the various services that it offers, and how COIMA SGR S.p.A. uses cookies and/or other tracking tools on the Website.

The information in this Privacy and Cookie Policy is provided pursuant to Article 13 of Regulation (EU) no. 679 of 27 April 2016 (“Regulation” or “GDPR”), the Measures issued by the Italian Data Protection Authority and the European authority Guidelines.

Information regarding data processing is only provided for the Website and for processing by the Company and does not extend to processing performed by third parties by means of any other websites the User may be able to consult via links. The Company does not accept liability for any such further processing, since the User is responsible for consulting the individual privacy policies of the relevant third-party websites.

1. Data Controller

COIMA SGR S.p.A., with registered office in Milan (Italy), Piazza Gae Aulenti, 12, 20154, (“Company” or “Data Controller”).

2. Data processing procedures

The Data Controller processes the User’s data with the aid of all appropriate security measures to prevent unauthorised access to or unauthorised disclosure, modification or destruction of the data. Processing takes place using both manual and IT and/or telematic tools, with organisational procedures and methods strictly correlated and restricted to the stated purposes.

3. Purposes and legal basis of data processing

Through the Website, the Company may process Users’ data for the following purposes:

• • Contact with the Company. The User may contact the Company to request information using the Company’s contact data provided on the Website. In this context, the Company will process the personal data contributed voluntarily by the User (e.g. email address, telephone number and/or other information contributed by the User on their own initiative) in order to receive, correctly manage and reply to the communications and/or requests received from them. The legal basis for the processing is the performance of a service specifically requested by the User, and in the event of refusal to contribute the personal data the Company will be unable to manage and respond to the communication or request for information (Article 6(1)(b) GDPR).
• • Pursuance of the legitimate interests of the Company and/or third parties. The User’s data may also be used in order to exercise the rights and/or pursue the legitimate interests of the Company and/or third parties, such as the management of complaints and litigation, credit recovery and the prevention of fraud and/or unlawful activities. In these cases, although the contribution of the User’s personal data is not compulsory, it is still necessary to the extent that these data are closely linked to and useful for the pursuance of the said legitimate interests, which do not prevail over the User’s fundamental rights and freedoms, and in the event of refusal to contribute them the Company may be unable to provide the services requested (e.g. request for information from the Company (Article 6(1)(f) GDPR).
• • Fulfilment of applicable legal and/or other obligations. The Company may use the personal data contributed by the User or otherwise acquired during their interaction with the Website for purposes linked to the fulfilment of legal obligations and compliance with domestic and EU regulations and standards, and obligations deriving from measures issued by the legally empowered authorities, which constitute the legal basis of the processing (Article 6(1)(c) GDPR).

4. Categories of data processed

Through the Website, the Company receives and collects information about any User who browses the Website’s pages and uses the web services it provides. Specifically, the Company acquires and processes the following information.

4.1 Data collected from browsing and cookies

When the User visits the Website, it collects data such as the pages viewed, the links or buttons the User clicks, the date and time of access, the User’s IP address, the browser used for navigation and the operating system used (“navigation data”). The Company uses these data for the sole purpose of producing statistics on use of the Website, for purposes relating to its operation and for assessing the efficacy of its services. Navigation data might also be used to identify those responsible in the event of IT crimes against the Website.

For information about collection of the User’s data using cookies and similar technologies, please read the Cookie Policy in Section 8.

4.2 Data provided voluntarily by the User

The Company only collects information contributed voluntarily by Users and those necessary for pursuance of the purposes set out in section 3 above and performance of the services specifically requested. In addition, the Company may collect and process additional personal data contributed voluntarily by the User in the context of the services offered by the Website, such as if the User contacts the Company to report problems or malfunctions, exercise their rights with regard to the processing of personal data, etc. The Company will only process these data for purposes strictly related to the User’s request. Failure to contribute these data may make it impossible to obtain the service requested.

5. Disclosure of data to third parties

Data contributed by the User and collected by the Website in the context of the relative services (e.g. IP address) will not be disseminated and may be disclosed, for the purposes and by the procedures described in this Privacy and Cookie Policy, to the following categories of entities:

• • COIMA platform companies, for organisational purposes or in-house controls, for pursuance of the legitimate interests of the Company and/or third parties, and for the performance of services requested/fulfilment of requests made by Users;
• • companies, associates, consultants or professionals contracted by the Company to perform technical or organisational functions (e.g. IT service providers), or with which the Company cooperates (including the other COIMA companies) for the provision and functioning of its services, or for possible communication activities;
• • people, companies or professional practices providing assistance and consulting services to the Company, with particular but not sole reference to accounting, administrative, legal, tax and financial matters;
• • entities having a right to access the data under the law or by order of the authorities.

Entities in the aforesaid categories will use the data as independent data controllers in accordance with the law, or as data processors formally designated by the Company.
The list of entities to which data are or may be disclosed can be requested from the Company using the contacts provided in the “User’s Rights and Contacts” section.

6. Data storage

Data are processed for the time necessary for performance of the activities described in section 3 above, and are erased on expiry of the purposes for which they were collected and processed.
The Company will reply to email enquiries without further processing of the personal data contributed, unless it is necessary to retain the data for longer to fulfil the user’s request.
Information collected via cookies will be stored for the times stated in each table provided in section 8 below.

7. User’s rights and contacts

In the cases envisaged by the law and when applicable, the User may exercise their rights under the Regulation. Specifically, the User is entitled to:

• • obtain confirmation that their personal data are being processed and, if so, to ask the data controller for access to information regarding the processing (e.g. purpose, categories of data processed, recipients or categories of recipients of the data, storage period, etc.);
• • request the rectification of inaccurate or incomplete data;
• • ask the data controller to erase the data (e.g. if the personal data are no longer necessary with regard to the purposes for which they were collected, in the event of withdrawal of the consent which is the basis for the processing, etc.);
• • request restriction of processing (e.g. if the User disputes the accuracy of the data; if the processing is unlawful and the User opposes the erasure of the personal data; if the data are necessary for the exercise or defence of legal claims of the User, even if the data controller no longer needs them; in the event of exercise of the right to object, for the time necessary for the data controller to verify whether there are legitimate grounds);
• • withdraw consent to the processing of the data at any moment, without prejudice to the processing based on the consent given prior to the withdrawal;
• • receive the personal data concerning them in a commonly used, machine-readable format (e.g. pdf), and transmit them to another data controller, or obtain their transfer directly from one data controller to another, if technically feasible (“data portability”).

The User is also entitled to oppose the use of the personal data relating to them, in whole or in part, for legitimate reasons.

These rights may be exercised directly by writing to the email address: privacy@coimasgr.com .

To conclude, if the User considers that the processing of their personal data is in breach of data protection legislation, they may lodge a complaint with the relevant Supervisory Authority (in Italy www.garanteprivacy.it).

8. Collection of data via Cookies

8.1 About cookies

Cookies are short text files which the websites visited by the user send to the terminal via which they accessed the Internet (usually to the browser), where they are stored and then re-transmitted to the same websites at the same user’s next visit. Every cookie is unique in relation to the browser and device used to access the Website.
Cookies may be installed by the owner or manager of the website users are visiting (“first-party cookies”) or by other providers (“third-party cookies”).
Cookies may be permanently stored on the user’s device, in which case they are not erased when the browser is shut down but remain until a set expiry date or until deleted by the User (“permanent cookies”) or may be erased automatically whenever the User leaves the Website or the browser is shut down (“session cookies”).
Cookies may be:

• • Technical: these cookies are necessary for the correct functioning of a website, i.e. they are used to store users’ information during their successive visits to the website. Therefore, they do not require the User’s consent;
• • Analytical: these cookies may be used, amongst other purposes, to assess the efficacy of one of the information company’s services, for the design of a website or to help to measure its “traffic”, i.e. the number of visitors, if required also subdivided by geographical, area, time of visit, or other characteristics. The use of analytical cookies installed and managed directly by the first party for statistical purposes (within the limits of a simple statistical count) does not require the User’s consent, as they are considered equivalent to technical cookies. However, if they are used by third parties, they can only be considered equivalent to technical cookies if their is no possibility that their use will lead to direct identification of the data subject (“singling out”). In other words, the User’s consent will not be required if: (i) the same cookie refers to not one but multiple devices, in order to create a reasonable degree of uncertainty regarding the digital identity of the subject which receives it (e.g. by masking appropriate parts of the IP address); (ii) the cookies are only used to produce aggregate statistics relating to a single website or mobile app, and; (iii) the third parties do not combine the analytical cookies, thus minimised, with other data processing, or share them with other third parties. Naturally, if they are not equivalent to technical cookies, they require the User’s consent;
• • Profiling: these cookies are used to link specific actions or recurrent patterns of behaviour in use of the functions provided by websites to specific identified or identifiable users, in order to group the various profiles in uniform groups of different size, to enable the data controller, amongst other things, to modulate the provision of the service in a more and more customised manner above and beyond the extent to which this is strictly necessary for its delivery, and to send advertising messages in line with the preferences expressed by the same user during their online browsing. These cookies cannot be used without the User’s consent.

The User’s consent is also required for “mixed” cookies (i.e. cookies installed and used for different purposes which do not have merely technical connotations).

8.2 Performance and Analytics Cookies

The cookies used on the Website are technical, analytical and profiling cookies (first and third party).

FIRST AND THIRD-PARTY TECHNICAL COOKIES

The following first and third-party technical cookies are installed:

8.3 Changing and managing cookie settings

a) Cookie banner

Consent to cookies is requested by means of the banner displayed on first access to the Site and subsequently at least 6 months after Users have specified their preferences (except as explained below).
By means of this banner, the User may: (i) agree to all cookies (by clicking “I agree to all cookies”), (ii) maintain the default settings, with installation of technical cookies only (by clicking “Only use necessary cookies””), or (iii) choose which cookies to install one by one (by clicking “Other options”).
The User can also manage their cookie preferences at any time using the area provided in the Website’s footer (“Review your cookie preferences”).
It should be noted that, in addition to the above, the Company may also re-display the banner:
(i) in the event of significant changes to one or more data processing conditions (e.g. in case of a change in the “third parties”), in order to inform Users about the changes made;
(ii) if the Website is unable to determine whether a cookie has already been saved in the device.

b) Browser settings

Most browsers (Internet Explorer, Firefox, Chrome, etc.) are configured to accept, manage and disable cookies through their own settings. Browser settings can be used to block or delete cookies received from this or any other Website, by changing the browser’s settings using its relevant function.

The settings for managing cookie preferences can normally be found in the “options” or “preferences” heading of the browser menu.

The following are the links to the instructions for the listed browsers:

Internet Explorer – http://windows.microsoft.com/en-gb/windows-vista/block-or-allow-cookies

Chrome – https://support.google.com/chrome/answer/95647

Firefox – https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Opera – http://www.opera.com/help/tutorials/security/privacy/

Safari – http://support.apple.com/kb/PH17191

Otherwise, users can manage their cookie choices using the www.youronlinechoices.org or www.aboutcookies.org websites.

Please bear in mind that disabling all cookies, including strictly necessary cookies, could interfere with browsing of the Website and prevent use of some of its functions.

Users who do not wish to be tracked by analytical cookies supplied by Google can also install the specific Google Analytics Opt-out Browser Add-on available at: https://tools.google.com/dlpage/gaoptout.

9. Third-Party Plugins

The Website may also incorporate social network plugins and/or buttons to make it easier for the user to share content on their social networks of choice. These plugins do not set a cookie, but if one is already present on the user’s computer they can read it and use it within the limits of its settings. The collection and use of information by these third parties is regulated by their respective privacy policies, which users are advised to read.

10. Use of other websites

Users are advised to read the privacy and cookie policies of any websites they visit via the links provided on the Website.
Please note that the cookie preferences set on this Website will not be active on the websites of other companies.

11. Transfer to non-EU countries

Unless this is strictly necessary for the purposes set out in this Privacy and Cookie Policy, the Company will not transfer Users’ personal data to entities based outside the European Economic Area (“EEA”). If data are transferred outside the EEA, the Company will adopt all necessary measures to guarantee compliance with the provisions of Chapter V of the Regulation. For information regarding any transfer of personal data collected by means of cookies of third parties based in non-EU countries, reference should be made to the privacy policy of the third party, available on its website and specified in the text of this Privacy and Cookie Policy.

12. Changes to the Privacy and Cookie Policy

The Company reserves the right to amend this Privacy and Cookie Policy at any time, notifying users via publication on the Website.
Users are kindly requested to check the Website for updates. In case of particularly significant changes and/or major impacts to the User’s rights, the Company may inform the User via other means (e.g., by sending an email).

Privacy and Cookie Policy updated to 10 October 2025