FUELS UP

Article 1 – Subject matter and scope

1.1 These Terms govern access to and use of the App by users, as well as the contractual relationships that arise between the Controller and each category of user. They apply also to mere consultation of the App and prevail over any different conditions communicated by the user, unless specifically accepted in writing by the Controller.

1.2 The App is an information society service within the meaning of Directive (EU) 2015/1535, qualifying as an online intermediation service pursuant to Regulation (EU) 2019/1150 and as an online platform service pursuant to Regulation (EU) 2022/2065 (the "DSA"). Through the App, registered Professionals may publish commercial information regarding their goods or services, and Customers may consult such information, locate the nearest points of sale, conclude at a distance the contracts for the purchase of goods or services and pay through the integrated Payment Functionality. Customers may also publish reviews and ratings of Professionals, as provided in article 13 below.

1.3 Save as provided in article 6 in relation to the Payment Functionality, the Controller is not a party to the contracts entered into between Customers and Professionals, acting solely as a technological intermediary pursuant to articles 4, 5, 6 and 8 of the DSA and article 16 of Italian Legislative Decree of 9 April 2003, no. 70. In accordance with article 8 of the DSA, no general obligation to monitor published content rests on the Controller.

Article 2 – Categories of users

2.1 The App may be used by two distinct categories of users. The first comprises Customers, being natural persons of full legal age who use the App for purposes unrelated to any business, commercial, craft or professional activity carried out by them, and who therefore qualify as consumers pursuant to article 3, paragraph 1, letter a), of Italian Legislative Decree of 6 September 2005, no. 206 (the "Italian Consumer Code"). The second comprises Professionals, being natural or legal persons who use the App in the exercise of their entrepreneurial or professional activity in order to offer goods or services to Customers, including authorised owners or operators of motor fuel filling stations; Professionals qualify as business users pursuant to article 2, point 1, of Regulation (EU) 2019/1150 and as traders pursuant to article 3, letter g), of the DSA.

2.2 The general provisions apply cumulatively together with the special provisions addressed respectively to Customers (articles 4-7) and to Professionals (articles 8-12). In case of conflict, the special provisions prevail.

Article 3 – Registration and account

3.1 Access to the functionalities of the App requires the registration of an account, distinct on the basis of the category of user. Registration as a Professional is subject to approval by the Controller, which verifies the identity of the entity, the documentation of registration with the competent authorities and the completeness of the information provided pursuant to article 8 below.

3.2 The user warrants the truthfulness, accuracy, completeness and currentness of the data provided and undertakes to communicate any variation thereof without undue delay. Access credentials are strictly personal; the user is responsible for their custody and for any activity carried out through the account, unless the user proves that the unauthorised access was due to a fact not attributable to them. In case of suspected compromise, the user shall inform the Controller without delay.

3.3 Registration is reserved to natural persons of full legal age. By accepting these Terms, the user declares to be of full legal age and to have full legal capacity. The Controller reserves the right to suspend and delete any account traceable to underage persons and to consider as ineffective, pursuant to articles 2 and 1425 of the Italian Civil Code, the contracts concluded through the App by minors. Where it is subsequently ascertained that the contracting party was a minor, the refund of any payment made is coordinated by the Controller with the Professional that supplied the goods or services, according to the applicable technical procedures; the Controller reserves the right to charge to the Professional the administrative costs of case management, without prejudice to the Professional's right to seek recourse against the minor or their legal representatives for the value of the goods or services actually consumed. The Controller may also refuse or suspend registration where the data provided is incomplete, manifestly untrue or such as to reasonably suggest an unlawful use of the App.

Article 4 – Customers: pre-contractual information, orders and price

4.1 Before the conclusion of each distance contract with a Professional, the Customer receives, through the interface of the App, the information referred to in article 49 of the Italian Consumer Code, including the identity of the Professional, the main characteristics of the goods or services, the total price inclusive of taxes, the payment and delivery terms and the existence or exclusion of the right of withdrawal. The same information, together with the order confirmation, is made available to the Customer on a durable medium, including through a dedicated section of the App showing the history of operations or by another suitable means pursuant to article 51, paragraph 7, of the Italian Consumer Code.

4.2 The order submitted through the App constitutes a binding contractual proposal addressed to the Professional. The contract is concluded upon receipt of the order confirmation on a durable medium. Before the order becomes binding, the Customer expressly confirms it through the function made available for that purpose, which is presented in a manner that makes the Customer unambiguously aware of the associated obligation to pay, in accordance with article 51, paragraph 2, of the Italian Consumer Code.

4.3 The applicable price is the one shown on screen before confirmation, inclusive of all taxes. Any commissions or ancillary costs are separately highlighted.

Article 5 – Customers: right of withdrawal and exceptions

5.1 Pursuant to article 52 of the Italian Consumer Code, the Customer has a period of fourteen days within which to withdraw, without providing any reasons, from the distance contracts concluded through the App, save the exceptions set out in article 59 of the same Code.

5.2 As regards the supply of motor fuel, the right of withdrawal is excluded by operation of law pursuant to article 59, paragraph 1, letter f), of the Italian Consumer Code, applicable to goods which after delivery, by their nature, become inseparably mixed with other items: this is the case of fuel once dispensed into the vehicle's tank of the Customer, where it mixes with any fuel already present. Such exclusion operates directly by virtue of the law, independently of any specific consent of the Customer.

5.3 For contracts to which the right of withdrawal still applies (for example ancillary services not immediately performed), the Customer exercises it by means of an explicit statement to the Professional, also using the standard withdrawal form referred to in Annex I, part B, of the Italian Consumer Code, reproduced at the end of this document.

Article 6 – Payment Functionality

6.1 The Payment Functionality allows the Customer to pay the price of the goods or services purchased from the Professional directly through the App, by scanning the QR code exhibited at the point of sale. The technical execution of the payment is entrusted to Stripe Payments Europe Limited, an authorised e-money institution based in Ireland, and to the Stripe group entities operating in the United States for fraud prevention and regulatory back-end purposes (jointly, the "PSP"), in compliance with Italian Legislative Decree of 27 January 2010, no. 11. The integration is implemented in Stripe Connect Express mode, whereby each Professional holds a dedicated Stripe sub-account directly registered in the Professional's name. The relationship between the Customer and the PSP is governed by the PSP's contractual terms and privacy notice, made accessible at the time of payment.

6.2 The Customer pays the price using a credit or debit card tokenised by the App through the PSP's SDK. Where the App provides for the saving of the payment method for subsequent uses, this occurs in accordance with the security standards applied by the PSP, and the Customer may manage its revocation through the available functionalities, with consequent deletion of the relevant information. The Controller neither manages nor stores the identifying data of the Customer's payment cards (card number, security code, expiry date), which are transmitted by the App interface directly to the certified environments of the PSP in compliance with PCI-DSS standards. The Controller receives from the PSP only the outcome of the transaction and the data strictly necessary for the management of the contractual relationship, including amount, date, transaction identifier and reconciliation data.

6.3 The payment made by the Customer through the App is credited directly to the Professional's Stripe sub-account, save the possible deduction of the Controller's intermediation commission referred to in article 9 below, where activated pursuant to article 9.2, settled through the split-payment mechanism integrated into Stripe Connect Express. The Customer is therefore discharged for the payment made directly vis-à-vis the Professional, pursuant to article 1188 of the Italian Civil Code.

6.4 Following the authorisation of the payment by the PSP, the Professional receives evidence of the payment having been made, according to the operational procedures applicable to its relationship with the PSP, for the purposes of performing the transaction.

6.5 The fiscal document relating to the sale of the goods or services (till receipt, receipt, invoice) is issued by the Professional. The Controller does not issue any fiscal document to the Customer.

Article 7 – Customers: warranties and complaints

7.1 The conformity of the goods or services supplied to the Customer is governed by articles 128 et seq. of the Italian Consumer Code. The legal guarantee of conformity and any further liability concerning the quality, safety, dispensed quantity and fitness for use of the goods or service rests exclusively on the Professional that supplied them.

7.2 Complaints regarding the goods or services are addressed directly to the Professional through the contact details made available in the App. Complaints regarding the functioning of the App or the obligations undertaken by the Controller towards the Customer are addressed to the Controller at the contact details indicated at the beginning of this document; the Controller responds within thirty days from receipt.

7.3 Pursuant to articles 141 et seq. of the Italian Consumer Code, in case of a dispute with the Controller the Customer may initiate the alternative dispute resolution procedure before a body registered in the list referred to in article 141-decies of the Italian Consumer Code, as well as resort to the online dispute resolution platform referred to in Regulation (EU) 524/2013, where applicable.

Article 8 – Professionals: registration, identification, content

8.1 Registration as a Professional is reserved to the owners or legal representatives of commercial operators who intend to offer goods or services to Customers through the App and is subject to approval by the Controller. Upon registration and pursuant to article 30 of the DSA, where applicable, the Professional communicates and keeps updated its name, address, telephone and electronic contact details, Italian tax code and VAT number, any licences, authorisations or registrations required by sector-specific legislation, and the details of the payment account. The Controller verifies the authenticity of the documentation before enabling the account and may request additional documentation, making the activation or the continuation of the account conditional upon receipt thereof.

8.2 The Professional is exclusively responsible for the truthfulness, accuracy, completeness and currentness of the content published through the App, for the lawfulness of the goods or services offered, and for their compliance with applicable safety, fiscal, environmental and administrative provisions. In accordance with article 6 of the DSA, the Controller acts promptly upon obtaining knowledge of manifestly illegal content, without prejudice to the internal complaint handling mechanism referred to in article 11.

8.3 The Professional warrants compliance of its offering with sector-specific legislation, including, for operators of motor fuel filling stations, the obligations to communicate and transmit prices to the Italian Ministry of Enterprises and Made in Italy pursuant to article 51 of Italian Law of 23 July 2009, no. 99 and to Italian Decree-Law of 14 January 2023, no. 5, converted with amendments by Italian Law of 10 March 2023, no. 23. The Professional shall keep the prices and any other commercial information published in the App constantly updated, in full consistency with those actually displayed at the point of sale, by carrying out the update without delay in case of variation. The Professional is exclusively responsible for any discrepancy between the prices published in the App and those applied at the point of sale, as well as for the related consequences vis-à-vis the Customer, public Authorities and third parties. The publication of information within the App does not constitute, in any case, a substitute means of compliance with the regulatory obligations resting upon the Professional.

Article 9 – Professionals: Payment Functionality and commissions

9.1 The Professional's adherence to the Payment Functionality takes place through the opening and onboarding of a sub-account with the PSP in Stripe Connect Express mode, registered in the Professional's name. Customer payments are credited directly to the Professional's sub-account, in accordance with the PSP's contractual terms that the Professional accepts upon onboarding with the PSP itself.

9.2 For the intermediation, platform and payment facilitation services rendered by the Controller to the Professional, the Controller is entitled to a commission, expressed as a percentage or fixed value according to the price list in force published in the Professional area of the App. The commission is technically deducted by the PSP from the value of each transaction through the split-payment mechanism integrated into Stripe Connect, and credited to the Controller's Stripe account. The commission is subject to separate invoicing by the Controller to the Professional with VAT. The current price list is consultable in the App at any time. Until the Controller activates the commission in accordance with the notice procedure set out in paragraph 9.3, no commission is due by the Professional and Customer payments are credited in full to the Professional's sub-account, net only of the fees applied directly by the PSP. The split-payment and deduction mechanism described in this article and in article 6.3 operates from the activation of the commission onwards.

9.3 In accordance with article 3, paragraph 2, of Regulation (EU) 2019/1150, the introduction of the commission, where not already operative, and any subsequent variation of the price list are communicated to the Professional with at least fifteen days' prior notice through the Professional area and by notification to the registered e-mail address. The Professional who does not intend to accept the introduction or the variation may terminate the agreement without penalty within the same term.

9.4 In case of refund to the Customer, in whole or in part, of a transaction, the amount is returned to the Customer through the technical flows operated by the PSP, with corresponding pro rata reversal of the Controller's commission where technically possible, save different agreements between the Professional and the Controller.

Article 10 – Professionals: ranking, suspension, termination

10.1 In accordance with article 5 of Regulation (EU) 2019/1150, the main parameters that may determine the ranking of Professionals in the search and visualisation results within the App include the geographical distance of the point of sale from the Customer's position, the relevance of the offered goods or services to the search criterion, the currentness of the published information and, where a rating system is available, the average rating received from Customers through the review system referred to in article 13. Where available, the Customer may use filters to modify the ranking according to further criteria. Any paid promotional spaces are signalled in a distinguishable manner pursuant to article 26 of the DSA.

10.2 The Controller may restrict, suspend or terminate the provision of the Service to the Professional in cases of serious or repeated violations of the Terms or of applicable law, of publication in the App of manifestly illegal content, of publication of untrue or non-updated information or prices, of failure to comply with information or financial obligations towards the Controller, of loss of the registration requirements with the competent Authorities (including sector licences and authorisations), of supervening technical unsuitability of the Professional to use the Service, of repeated and well-founded complaints by Customers, of reports from public Authorities, of reasonable grounds of security, of protection of Customers or of protection of the image and integrity of the platform. Save for cases of urgency, of imperative obligations of law or of repeated violations, termination decisions are communicated with at least thirty days' prior notice and with indication of the specific reasons, pursuant to article 4 of Regulation (EU) 2019/1150. In cases of urgency, of serious violations or of immediate risk for Customers or for the Service, the suspension takes effect immediately and the communication of the reasons follows within fifteen days.

10.3 Suspension or termination do not prejudice the Controller's right to payment of commissions already accrued.

Article 11 – Professionals: internal complaint handling

11.1 Pursuant to articles 11 and 12 of Regulation (EU) 2019/1150, within the limits of applicability set therein, the Controller sets up an internal complaint handling system for complaints submitted by Professionals, free of charge, accessible through the Professional area of the App and aimed at addressing complaints within reasonable terms and in a transparent manner. In the absence of an amicable settlement, the Parties may resort to the mediators identified in the App, without prejudice to the right to bring the matter before the competent judicial authority. The Italian Communications Authority (AGCOM) supervises the application of the P2B Regulation.

Article 12 – Professionals: indemnity

12.1 The Professional indemnifies and holds harmless the Controller, its directors, employees, collaborators and assignees from any claim, action, dispute, sanction, loss, cost or expense (including legal fees, technical consultancy fees and administrative case management costs) raised by third parties, including Customers, public Authorities, supervisory bodies, out-of-court dispute settlement bodies and other Professionals, as a consequence of the violation of these Terms or of applicable law by the Professional, of the lack of truthfulness, accuracy or updating of the content and prices published, of the non-conformity of the goods or services offered, of the dispensing of fuel in violation of safety, environmental, fiscal or administrative rules, as well as of any other conduct of the Professional or of its representatives, employees or collaborators that gives rise to liability of the Controller vis-à-vis third parties. The indemnity also extends to administrative sanctions possibly imposed on the Controller as a consequence of conduct attributable to the Professional. The Controller shall promptly inform the Professional of any claim or action triggering the indemnity obligation and the Professional shall provide to the Controller any necessary defensive cooperation.

Article 12-bis – Professionals: good faith, conforming use and anti-circumvention

12-bis.1 The Professional undertakes to use the App exclusively for the commercial purposes declared at registration, in compliance with the principles of good faith and fairness pursuant to articles 1175 and 1375 of the Italian Civil Code. The use of the App is in any case prohibited for purposes or with modalities that constitute, even potentially, money laundering or financing of unlawful activities pursuant to Italian Legislative Decree 231/2007, tax evasion or avoidance, fictitious transactions, price manipulation, artificial alteration of metrics, ratings or reviews, unauthorised access or attempts of unauthorised access to sections of the App not intended for the Professional, reverse engineering, decompilation or unauthorised reproduction of the App's software components, mass or systematic extraction of data published by other users through scraping or automation techniques, solicitation of other Professionals to leave the platform, or systematic diversion of Customers outside the App for transactional purposes that should go through the App itself.

12-bis.2 The Professional undertakes to cooperate in good faith with the Controller in case of internal investigations, reports by public Authorities, fiscal or administrative assessments, judicial proceedings and other lawful requests of information connected with the use of the App. Cooperation includes the timely provision of documentation, clarifications and any useful element, without prejudice to legal protections.

12-bis.3 Breach of the obligations under this article constitutes serious non-performance and entitles the Controller to suspend or terminate the Service with immediate effect pursuant to article 10.2, without prejudice to the application of the indemnity under article 12 and to any further legal remedy.

Article 13 – Reviews and content generated by Customers

13.1 Registered Customers may publish textual reviews and numerical ratings of Professionals relating to the goods or services purchased through the App. The Controller adopts reasonable and proportionate measures, appropriate to the nature of the Service, to verify that the reviews come from persons who actually used the reviewed product or service, in compliance with articles 22 and 23 of the Italian Consumer Code, as amended by Italian Legislative Decree of 7 March 2023, no. 26, with the requirements of lawfulness set out in articles 19 and 20 of Italian Law of 11 March 2026, no. 34, and with article 23, paragraph 1, letter bb-ter), of the Italian Consumer Code.

13.2 The Controller operates in compliance with the principles of lawfulness of online reviews set out in articles 19 and 20 of Italian Law no. 34/2026, adopting suitable measures, proportionate to its size and to the evolution of the implementing guidelines of the competent Authorities, so that reviews relate to recent consumption experiences and their continuing representativeness is assessed over time. The interested Professional may represent to the Controller the loss of currentness or representativeness of a review, including by reason of corrective measures adopted, attaching supporting elements; the Controller responds within reasonable terms with a reasoned decision. Against the decision, the Professional may submit an internal complaint pursuant to article 11.

13.3 Customers undertake to publish content that is truthful, referred to their personal experience, not infringing third-party rights, not offensive or defamatory, not contrary to mandatory rules, public order or morality. Content containing identifying personal data of third parties, confidential commercial information, promotional content for products or services other than those subject of the review, and content falling within categories of illegal content under applicable law is prohibited. The purchase, sale or transfer of reviews, appreciations or interactions on any basis, as well as the publication of reviews in exchange for discounts, free goods or any other form of incentive granted by the Professional or by third parties, is prohibited pursuant to article 20 of Italian Law no. 34/2026.

13.4 The Customer who publishes content warrants ownership thereof and grants the Controller a non-exclusive, royalty-free, transferable, sub-licensable licence, for the Italian territory and for the maximum duration permitted by law, for the sole purposes of publication, reproduction and dissemination of the content through the App and the Controller's communication channels.

13.5 In accordance with articles 16, 17, 20 and 21 of the DSA, the Controller allows the reporting of illegal content, through the functionalities that may be available within the App or to the contact details indicated at the opening of this document, and accompanies any moderation decision (removal, demotion, disabling of access) with a statement of reasons sent to the Customer concerned and to the Professional subject of the content. The Professional is also entitled, pursuant to article 19, paragraph 2, of Italian Law no. 34/2026 and to article 16, paragraph 2, of the DSA, to report to the Controller reviews that do not comply with the lawfulness requirements set out above, requesting their removal. The Customer and the Professional are also entitled to internal complaint against moderation decisions, to be submitted through the internal system referred to in article 11, and to recourse to certified out-of-court dispute settlement bodies pursuant to article 21 of the DSA.

13.6 The Controller reserves the right to remove or not publish reviews manifestly untrue, attributable to coordinated campaigns, or defamatory or infringing third-party rights, providing reasoned notice to the Customer who published them.

Article 14 – Push notifications

14.1 The App may send notifications to the user for technical and service purposes functional to the performance of the contract and to the continuity of the Service (by way of example: payment confirmations, status updates, security alerts, communications regarding the Terms and the privacy notice). Any further communications of a commercial or promotional nature, where introduced in the future, will be sent exclusively upon the user's specific consent and in accordance with the supplementary notice that will be published for such purpose.

14.2 The user may at any time disable the reception of notifications from the operating system settings of the device or through the App settings. The disabling of service notifications may compromise the usability of certain functionalities, in particular the immediate feedback on the outcome of payments.

Article 15 – Intellectual property

15.1 All intellectual and industrial property rights relating to the App, including software, source codes, graphical interfaces, trademarks, logos, databases and editorial content, belong exclusively to the Controller or its licensors. Access to the App does not entail any transfer of such rights, save for the personal, non-exclusive, non-transferable and revocable licence for the use of the Service in compliance with the Terms.

15.2 Save for the cases permitted by article 64-quater of Italian Law of 22 April 1941, no. 633, any unauthorised use of the App is prohibited, including reverse engineering, decompilation, reproduction or systematic extraction of substantial parts of the database pursuant to articles 102-bis and 102-ter of the same law.

Article 15-bis – Availability of the Service

15-bis.1 The Service is provided in the state in which it is at the time of access ('as is') and within the limits of contingent availability ('as available'). The Controller makes no explicit or implicit warranty, beyond those mandatorily required by law, regarding continuous, uninterrupted, error-free availability or specific performance levels of the Service, of the telecommunications access network or of the third-party infrastructures on which the Service relies.

15-bis.2 The Controller may carry out scheduled or extraordinary maintenance, software updates, infrastructural changes or security tests that entail the temporary total or partial unavailability of the Service. Where reasonably possible, such interventions are communicated with adequate prior notice; otherwise, proportionate measures are adopted to minimise the impact on users.

15-bis.3 The Controller is not liable for malfunctions, delays, unavailability or errors of the Service arising from causes not directly attributable to it, including those arising from malfunctions of the user's device, of the telecommunications access network, of the PSP's systems, of cloud service providers, of store operators, of cartographic service providers or of other third-party components, save for cases of wilful misconduct or gross negligence.

Article 16 – Limitation of liability

16.1 To the extent permitted by applicable law and save as provided in paragraph 16.4 below, the Controller is not liable for indirect, consequential damages, loss of profit, loss of opportunities, loss of customers, loss of chance, reputational harm, loss of goodwill, loss of data, costs of substitution of the Service or loss of expected profits resulting from the use of, or the inability to use, the App, as well as for damages arising from temporary interruptions, technical malfunctions, unavailability of the Service, loss or alteration of data caused by malfunctions of third-party systems (including the PSP, cloud service providers, telecommunication operators and store operators), force majeure events and any other cause not directly attributable to the Controller.

16.2 Save for mandatory provisions for consumer protection, the Controller's liability for direct damages arising from the use of the App is in any case limited, vis-à-vis the Professionals, to the lesser of the aggregate amount received as commission from the Professional in the calendar year in which the event occurs and the amount of Euro 5,000.00 per single event and Euro 20,000.00 in aggregate per calendar year and cumulatively for all Professionals; vis-à-vis the Customer, it is limited to twice the price of the transaction to which the damage relates.

16.3 The Controller is not liable for the goods or services offered by Professionals, pursuant to and within the limits of articles 4, 5, 6 and 8 of the DSA and article 16 of Italian Legislative Decree no. 70/2003. The removal of content upon notice does not, in itself, entail general knowledge of the content conveyed through the Service.

16.4 No provision of the Terms excludes or limits the Controller's liability in cases of wilful misconduct, gross negligence, personal injury, violation of mandatory consumer-protection obligations or otherwise unwaivable liability.

16.5 Where any limitation, cap or exclusion of liability set out in this article were to be held, by a competent authority or court, wholly or partially unenforceable, invalid or ineffective, such limitation, cap or exclusion shall be deemed automatically reduced and applied to the maximum extent permitted by the applicable mandatory law, rather than disapplied in its entirety, so as to preserve to the greatest possible degree the allocation of risk agreed between the parties.

Article 16-bis – Force majeure and extraordinary events

16-bis.1 Neither party is liable for non-performance or delayed performance of the obligations undertaken under these Terms where such non-performance or delay is caused by events of force majeure or by extraordinary events not reasonably foreseeable or avoidable. Such events include, by way of example and not limitation, natural disasters, acts of war or terrorism, extended blackouts, strikes and labour disputes, pandemics and related restrictive measures, cyber-attacks including ransomware, security breaches of third-party systems, interruptions or malfunctions of telecommunications networks, interruptions or discontinuation of services by critical suppliers (including the PSP, cloud service providers, store operators, cartographic service providers), measures, orders or restrictions of public Authorities, regulatory changes of immediate application, and any other circumstance presenting the features of extraordinariness and unforeseeability pursuant to article 1218 of the Italian Civil Code.

16-bis.2 The party suffering the force majeure event shall notify the other party, as soon as reasonably possible, of the nature and estimated duration of the event, adopting proportionate measures to limit its consequences. During the persistence of the event, mutual obligations are suspended, save for mandatory legal obligations. Where the event continues for more than ninety days in a manner that renders the continuation of the relationship impossible or excessively burdensome, either party may withdraw without penalty by written notice to the other.

16-bis.3 Payment obligations accrued before the occurrence of the force majeure event remain in any case unaffected.

Article 17 – Amendments, duration, termination

17.1 The Controller may amend the Terms for organisational, technical, regulatory or product evolution reasons. Amendments are communicated with at least fifteen days' prior notice, in accordance with article 3, paragraph 2, of Regulation (EU) 2019/1150 where applicable. Upon expiry of the term, continued use of the App constitutes acceptance. Amendments that worsen economic conditions or the user's rights do not operate to the user's detriment without renewed acceptance. Amendments affecting personal data processing require a new notice pursuant to article 13, paragraph 3, GDPR.

17.2 The Controller may introduce new functionalities, modify existing ones, temporarily suspend or definitively discontinue specific modules of the Service, in line with technological, organisational or market evolution. Amendments that significantly affect the user's rights are communicated within the terms set forth in paragraph 17.1 above. Merely improving, security-related or regulatory alignment changes may be implemented without prior notice, without prejudice to the update of the pertinent sections of this document. Such new functionalities may include optional premium or subscription-based features offered to Customers or to Professionals; any feature entailing a charge will be clearly identified as such and will be subject to the Customer's or Professional's prior and specific acceptance of the applicable economic conditions before any payment obligation arises.

17.3 The user may terminate at any time by requesting the cancellation of its account in accordance with the procedures set out in article 17-ter, without prejudice to accrued monetary obligations. Without prejudice to the express termination clause referred to in article 1456 of the Italian Civil Code, the Controller may terminate the contract by operation of law in case of violation of articles 3, 4, 8, 9, 13 and 14, or of repeated violations of the Terms or of applicable law.

Article 17-bis – Assignment of the contract and survival of clauses

17-bis.1 The Controller may assign this contract, in whole or in part, or its contractual position or individual rights and obligations arising therefrom, to controlling, controlled, affiliated companies or companies belonging to the same group, or to third parties in the context of extraordinary transactions such as mergers, demergers, business or business-branch contributions, sales of business or business branches, acquisitions or corporate reorganisations. Assignment operates without the need for the user's consent, without prejudice to the Controller's obligation to provide prior notice through adequate forms of communication. The user's right to terminate the contract is preserved where the assignment entails detrimental modifications to its rights, as provided in article 17.1.

17-bis.2 The user may not assign this contract or any right or obligation arising therefrom to third parties without the prior written consent of the Controller.

17-bis.3 Clauses that, by their nature or by express provision, are to produce effects after the termination of the relationship remain effective between the parties. Such clauses include, in particular, those relating to indemnity (article 12), good faith and anti-circumvention (article 12-bis), intellectual property (article 15), limitation of liability (article 16), force majeure (article 16-bis), processing of personal data for defensive purposes and compliance with legal obligations (Part II), governing law and jurisdiction (article 18), as well as the confidentiality of information acquired during the relationship.

Article 17-ter – Deletion of the account and associated data

17-ter.1 The Customer and the Professional may at any time request the deletion of their account through the functionalities made available within the App or through the dedicated web page indicated by the Controller, reachable via the institutional website or the links published in the application stores.

17-ter.2 The deletion request entails the deactivation of the account and the initiation of the procedures for the deletion or anonymisation of the associated personal data, within the limits permitted by applicable law and save for data whose retention is necessary for compliance with legal obligations, for fiscal, accounting, fraud-prevention, IT-security purposes, for the protection of the Controller's rights, or for the handling of pending disputes.

17-ter.3 The deletion of the account does not automatically entail the deletion of data contained in fiscal documents, transaction records, security logs or other archives whose retention is imposed by law or justified by an overriding legitimate interest of the Controller. Such data will be retained for the periods indicated in Part II – Privacy Notice.

17-ter.4 Any reviews and ratings published by the Customer may be retained by the Controller in anonymised form, namely irreversibly disconnected from the identifying data of the author, in order to preserve the integrity and reliability of the rating system towards other users. Data anonymised in this manner do not constitute personal data within the meaning of Recital 26 of the GDPR.

17-ter.5 Once the deletion procedure is completed, the user will no longer be able to access the reserved functionalities of the App nor retrieve data, content, history of operations or information associated with the deleted account, save as otherwise provided by law.

17-ter.6 The Controller completes the deletion or anonymisation of data not subject to retention obligations within thirty days of the request, save for exceptional technical needs or manifestly unfounded, excessive or repetitive requests that require additional time within the limits permitted by articles 12 and 17 of the GDPR.

Article 18 – Governing law and jurisdiction

18.1 These Terms and the contracts concluded through the App are governed by Italian law, save for mandatory consumer protection provisions that may be applicable. For disputes with Customers, the court of the place of residence or domicile of the consumer is exclusively competent, where such place is located within the territory of the Italian State, pursuant to article 33, paragraph 2, letter u), of the Italian Consumer Code. For disputes with Professionals, the Court of Treviso is exclusively competent.

Article 19 – Specific approval of burdensome clauses

19.1 Pursuant to and for the purposes of articles 1341 and 1342 of the Italian Civil Code, by accepting these Terms the Professional declares to have read and to specifically accept the following clauses: article 9 (commissions, unilateral amendments with prior notice and regulation of refunds), article 10 (suspension and termination of the Service), article 12 (indemnity), article 12-bis (good faith, conforming use and anti-circumvention), article 15-bis (availability of the Service 'as is' and 'as available'), article 16 (limitation of liability and economic cap), article 16-bis (force majeure and extraordinary events), article 17 (unilateral amendments to the Terms, changes to the Service and express termination clause), article 17-bis (assignment of the contract and survival of clauses), article 18 (exclusive jurisdiction of the Court of Treviso) and article 20 (severability and other final provisions). The specific approval of the clauses listed above is collected, in addition to and separately from the general acceptance of the Terms, through the technical means made available by the Controller for that purpose at the time of registration, and is recorded and retained by the Controller for evidentiary purposes. The Professional acknowledges to have had full awareness of the content of each of the clauses listed above and declares to have accepted them in an informed and conscious manner, pursuant to articles 1341 and 1342 of the Italian Civil Code. Such specific acceptance is not required from Customers, to whom the mandatory regime set forth in articles 33 et seq. of the Italian Consumer Code applies.

Article 20 – Final provisions

20.1 Language. The Italian version of this document constitutes the official version and prevails in case of discrepancy with any translation made available in other languages for mere informational convenience.

20.2 Interpretation. Article headings are indicative and irrelevant for interpretation purposes. The provisions of the document are read in a manner consistent with the overall purpose of the contract and with the principles of good faith and fairness pursuant to articles 1366 and 1375 of the Italian Civil Code. Lists of examples, where not expressly qualified as exhaustive, are to be construed as non-exhaustive.

20.3 Severability. The declaration of nullity, ineffectiveness or invalidity, in whole or in part, of one or more clauses of this document does not entail the nullity or ineffectiveness of the other clauses, which remain fully effective between the parties. The clause declared null, ineffective or invalid is replaced, by way of integration pursuant to article 1419, paragraph 2, of the Italian Civil Code, by the applicable legal provision or by the valid clause that best achieves the economic-legal arrangement originally pursued by the parties.

20.4 Tolerance. Tolerance by one party in respect of a violation of the other party's obligations does not constitute a waiver of the rights arising from the tolerated violation, nor does it preclude the tolerating party from requesting timely performance of obligations at a later time.

20.5 Communications. Save as otherwise provided in these Terms, communications between the parties are made through the functionalities made available by the App, to the e-mail address registered by the user, or to the Controller's contact details indicated at the opening of this document. General communications by the Controller may be made through notices published within the App or on the Controller's institutional website.

20.6 Entire agreement. These Terms, together with the Privacy Policy, the Cookie Policy and the documents expressly referred to, constitute the entire agreement between the Controller and the user in relation to the matter regulated, superseding any prior understanding, declaration or agreement, written or oral, entered into between the parties in relation to the same subject matter.

Article 1 – Categories of personal data processed

In connection with the purposes set out in article 2 below, the Controller processes the following categories of personal data. Firstly, identification and contact data (name, surname, address of residence or domicile, e-mail address, telephone number). For Professionals, fiscal and commercial identification data are processed in addition (Italian tax code, VAT number, registered office, Companies' Register details and registration with sector registers, licences and authorisations, details of the PSP sub-account for the crediting of consideration). Credentials and authentication data are processed (username, password, any additional authentication factors); where the user chooses to access through Google Sign-In authentication, the identifiers provided by the Google authentication service strictly necessary to enable the session are processed. Navigation and technical data are processed (IP address, unique device identifiers, device type, operating system, language settings, session data and interaction data with the App). Technical and diagnostic data are processed only to the extent actually collected and only through the technologies disclosed in this notice and in Part III. Diagnostic or crash reports generated at the level of the operating system or of the application stores are processed by the respective providers under their own privacy policies. Any technology entailing processing that requires consent pursuant to article 122 of the Italian Privacy Code is activated only upon collection of the data subject's specific consent and following the update of this notice. Data relating to the use of the App are processed (searches, transactions completed, orders, communications with the Controller and with Professionals). Customer device geolocation data are processed, collected during the use of the function for searching the nearest stations and subject to consent granted through the device's operating system. Data relating to payment operations are processed (amount, transaction outcome, unique transaction identifier, reconciliation data) to the extent transmitted to the Controller by the PSP; data identifying payment cards remain excluded from the Controller's processing, being managed directly by the PSP within its certified infrastructure. Content published by Customers in the form of reviews and ratings of Professionals is processed, including review text, numerical rating, date of publication and identifier of the Customer author. Data deriving from complaints, reports of illegal content and support communications are finally processed.

Article 2 – Purposes and legal bases

The purposes of the processing and the related legal bases are set out below. The registration and management of Customer and Professional accounts, the provision of the App's functionalities, the conclusion and performance of contracts between Customers and Professionals through the Payment Functionality, the management of order confirmations, refunds and reconciliations, and the sending of notifications related to the performance of transactions are based on the necessity to perform the contract to which the user is a party, pursuant to article 6, paragraph 1, letter b), of the GDPR.

The processing of Customer geolocation data is based on the specific consent of the data subject, pursuant to article 6, paragraph 1, letter a), of the GDPR. Geolocation is activated only after the Customer has granted the relevant permission to the device's operating system, in the "while using the App" mode or equivalent, and entails the repeated acquisition and update of the device's approximate position while the Customer is actively using the function for searching the nearest stations and the related map and route-display functionalities, for the sole purpose of keeping the map of the nearby stations and the navigation indications up to date in real time as the Customer moves. The position is processed on the device and transmitted, in a transitory manner, solely to the extent necessary to render the map and route services; it is not subject to persistent storage on the Controller's server systems and is not stably associated with the user's profile. Processing ceases when the Customer leaves the relevant function or closes the App, or upon revocation of the permission. The Customer may revoke consent at any time from the device's operating system settings; in such case, manual search by municipality or postal code remains available.

The publication, moderation and retention of Customer reviews of Professionals, as well as the related application of the notice and action mechanism referred to in articles 16-21 of the DSA, are based on the performance of the contract entered into by Customers upon acceptance of the Terms and on the legitimate interest of the Controller in ensuring a transparent and truthful rating system that feeds the ranking parameters referred to in article 10 of the Terms, pursuant to article 6, paragraph 1, letters b) and f), of the GDPR.

The sending of notifications connected to the operation of the Service is based on the legitimate interest of the Controller in ensuring the continuity and security of the Service, pursuant to article 6, paragraph 1, letter f), of the GDPR.

Accounting, fiscal, anti-fraud and DSA traceability obligations, including the issuance and retention of commission invoices, accounting records, document retention, the traceability of commercial operators and the substantiation of moderation decisions, are based on the necessity to comply with legal obligations to which the Controller is subject, pursuant to article 6, paragraph 1, letter c), of the GDPR, with particular reference to article 2220 of the Italian Civil Code, Italian Presidential Decree no. 600/1973, Italian Presidential Decree no. 633/1972 and articles 16-30 of the DSA.

The security of the Service, the prevention of fraud and abuse, the maintenance of security logs, the identification and defence against unauthorised access and the management of complaints and disputes are based on the legitimate interest of the Controller in ensuring the integrity of its infrastructure, its users and its rights, pursuant to article 6, paragraph 1, letter f), of the GDPR.

The processing of aggregated, pseudonymised or anonymised data for purposes of analysing the operation of the Service, detecting technical anomalies, measuring performance and improving functionalities is based on the legitimate interest of the Controller pursuant to article 6, paragraph 1, letter f), of the GDPR. Similar processing on an individual basis and through technologies requiring consent under article 122 of the Italian Privacy Code will be activated only upon collection of the data subject's specific consent.

Future processing for further purposes, such as direct marketing, behavioural profiling, sending of promotional push notifications, personalised commercial communications, loyalty or Customer-preferences programmes, integrations with rewards systems or commercial partnerships, advanced telemetry and product analytics on an individual basis, is qualified as modules that may be activated at a later stage. Such processing will be operational only following the publication of a supplementary notice pursuant to article 13, paragraph 3, of the GDPR and, where required, the collection of the data subject's specific consent.

The provision of data necessary for the performance of the contract, for compliance with legal obligations and for the protection of the Controller's legitimate interest is required for the conclusion and performance of the contract; failure to provide such data makes use of the App or of the relevant functionalities impossible. The provision of geolocation data is optional: failure to provide it entails only the impossibility of using the search for the nearest stations, manual search remaining available. Consent granted for future processing may be revoked at any time.

Article 3 – Processing methods

Processing is carried out predominantly by electronic means, adopting technical and organisational measures adequate to ensure the security, confidentiality, integrity, availability and resilience of systems and data, pursuant to articles 24, 25 and 32 of the GDPR, in line with the applicable industry standards and proportionate to the risks inherent in the processing. No solely automated decision-making producing significant legal effects on the data subject within the meaning of article 22 of the GDPR is in place.

Article 4 – Retention period

Personal data are retained for the time strictly necessary to pursue the purposes for which they were collected, in accordance with the principles of storage limitation and data minimisation.

Customer identification, contact and account data are retained for the entire duration of the relationship and, upon request of cancellation, are deleted or anonymised within thirty days of receipt of the request, save data that must be retained for legal obligations or for defensive purposes. Identification and fiscal data of Professionals are retained for the entire duration of the relationship and, upon termination, for a maximum period of ten years, in consideration of the duration of the commercial and fiscal liability connected with the transactions intermediated by the Controller.

Transaction and payment data are retained for ten years from the date of the transaction, in accordance with article 2220 of the Italian Civil Code, Italian Presidential Decree no. 600/1973 and Italian Presidential Decree no. 633/1972. Commission invoices and any other fiscal document are retained for ten years from issuance.

Geolocation data collected upon the Customer's request are not retained beyond the time strictly necessary to process the related query.

Content published by Customers (reviews and ratings) is retained for the entire duration of publication and for a further five years from the termination of the publishing Customer's relationship with the Controller, save earlier deletion upon request or due to a moderation decision. Data relating to moderation decisions and to the associated reasons are retained for five years from the decision, pursuant to article 17 of the DSA.

Any technical and security logs retained are kept for the time strictly necessary for the relevant purposes, save longer retention periods for defensive or investigative needs. Data relating to complaints, reports and disputes are retained for the duration of the proceedings and for a further five years from their closure, save longer prescription terms provided by law.

In case of prolonged inactivity of the account, the Controller may proceed, upon adequate notice to the user, with the deactivation or cancellation of the account itself and with the anonymisation or deletion of the associated data, save data to be retained for legal obligations.

Article 5 – Recipients and transfers outside the EEA

Personal data are accessible to the Controller's personnel specifically authorised and adequately instructed pursuant to article 29 of the GDPR and article 2-quaterdecies of the Italian Privacy Code. Data may also be disclosed to the categories of recipients set out below, each within the limits and for the purposes of their respective competence.

For the technical management of the Service, the Controller relies on Google Ireland Limited and Google LLC, providers of the Firebase Cloud Messaging services for push notifications and Firebase App for the basic technical functionalities, of the Google Maps Platform services for the cartographic display of stations and for navigation directions, and of the Google Sign-In authentication service for alternative access to the App. Such providers are appointed as data processors pursuant to article 28 of the GDPR for the purposes of Service performance. Transfer of data to Google LLC in the United States is covered by Google's certification under the EU-U.S. Data Privacy Framework, adequacy decision of the European Commission of 10 July 2023, and in the alternative by the standard contractual clauses approved by the European Commission pursuant to article 46, paragraph 2, letter c), of the GDPR.

For the execution of payment transactions, the Controller relies on Stripe Payments Europe Limited (Ireland) and Stripe, Inc. (United States), acting as autonomous controllers for the regulatory and anti-fraud obligations within their competence pursuant to Italian Legislative Decree no. 11/2010, and as data processors pursuant to article 28 of the GDPR for the technical aspects of payment execution. Transfer of data to Stripe, Inc. is covered by Stripe's certification under the EU-U.S. Data Privacy Framework and, in the alternative, by the standard contractual clauses.

For the management of the cloud infrastructure, the Controller relies on hosting service providers with data centres located within the European Economic Area, appointed as data processors pursuant to article 28 of the GDPR.

Data may also be disclosed to Professionals, to the sole extent strictly necessary for the execution of the Customer's purchase operations; to the Controller's legal, fiscal, accounting and auditing advisors, for the management of professional and compliance obligations; to judicial and administrative Authorities where disclosure is required by law or by an order of the Authority. Dissemination of data is not envisaged, save for the case of reviews published by Customers, which by their nature are accessible to the other users of the App.

The list of recipients indicated above may be supplemented as a consequence of the introduction of new technologies or services supporting the Service. The update is reflected in this notice, without prejudice to the safeguards provided by applicable law regarding data processors and extra-EEA transfers.

Article 6 – Rights of the data subject

In accordance with articles 15-22 of the GDPR, the data subject has the right to access their personal data and obtain a copy thereof, to obtain the rectification of inaccurate data and the integration of incomplete data, to obtain erasure in the cases provided for, to obtain restriction of processing, to receive their data in a structured, commonly used and machine-readable format and to transmit them to another controller, to object to processing based on legitimate interest and to processing for direct marketing purposes where activated, to revoke at any time the consent granted without prejudice to the lawfulness of the processing carried out previously, and not to be subject to solely automated decisions producing significant legal effects.

Requests are sent to info@annibale-group.it or legal@pec.annibale-group.com, or through the account management functionalities that may be available within the App. The Controller responds without undue delay and in any case within one month from receipt, with the possibility of a reasoned extension of two months in particularly complex cases pursuant to article 12, paragraph 3, of the GDPR. The data subject is also entitled to lodge a complaint with the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali (Piazza Venezia 11, 00187 Rome, Italy; protocollo@gpdp.it; protocollo@pec.gpdp.it) or to bring proceedings before the competent judicial Authority.

Account deletion. The data subject may request at any time the deletion of its account directly from the App or through the dedicated web procedure made available by the Controller. The request is handled pursuant to article 17 of the GDPR. The deletion of the account entails the erasure or anonymisation of the personal data no longer necessary for the purposes for which they were collected, save for data that the Controller is required to retain for legal obligations, fiscal, accounting, security or fraud-prevention needs, or for the establishment or defence of rights in legal proceedings. Any published reviews may be retained in anonymised form, as provided in article 17-ter of the Terms. Requests may also be submitted to the privacy contact details indicated in this notice; the Controller responds within the terms set out in article 12 of the GDPR.

Article 7 – Amendments to this notice

The Controller may amend this notice to adapt it to regulatory, jurisprudential, organisational or technological developments. Amendments are communicated to data subjects through adequate forms of communication. Substantial amendments to the purposes or to the legal bases of the processing require renewed explicit acceptance. The future activation of additional processing (in particular direct marketing, behavioural profiling, promotional push notifications) will be preceded by the publication of a supplementary notice pursuant to article 13, paragraph 3, of the GDPR and, where required, by the collection of the data subject's specific consent.