PRIVACY POLICY – PERSONAL DATA PROCESSING INFORMATION
(pursuant to Article 13 of Regulation (EU) 2016/679)

1. Data Controller

The Data Controller of personal data is the company:
HAPPY CREW S.R.L., with registered office in MESSINA, Tax ID/VAT no. 03853060832, represented by its legal representative pro tempore.
Email: mailbox@happycrew.it – Certified Email (PEC): happycrew@pec.it
(hereinafter also referred to as “HAPPY CREW” or “Controller”).

2. Purpose of Processing and Legal Basis

Main purposes (necessary processing):
Personal data provided by Users will be processed for the following purposes:

• managing user registration and account;

• managing orders, deliveries, and support requests;

• fulfilling tax, accounting, and administrative obligations related to purchases;

• preventing and managing misuse or non-compliant use of the Platform;

• compiling internal statistics on an aggregated or anonymous basis.

Legal basis: performance of a contract (Art. 6.1.b GDPR), legal obligation (Art. 6.1.c), legitimate interest (Art. 6.1.f).

Additional purposes (optional processing, based on consent):
Only with the User’s free and specific consent, data may also be used for:

• Direct marketing: sending newsletters, promotional offers, discounts, surveys, and commercial communications, including via automated tools (email, SMS, push notifications, WhatsApp);

• Profiling: analyzing purchasing preferences and browsing behavior to personalize the user experience and deliver targeted content.

Legal basis: User consent (Art. 6.1.a GDPR).
Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

3. Types of Data Processed

The following categories of data may be processed:

• Identification and contact data (name, surname, email, phone);

• Login and account profile data (username, password, order history);

• Purchase and payment data (payment method, amount, transaction status);

• Location data (pickup port, selected ship);

• Browsing and preference data (via cookies or similar tools, as described in the specific Cookie Policy);

• Any other data required to perform the contract.

4. Processing Methods and Data Security

Data will be processed in paper and/or digital form, in accordance with principles of lawfulness, fairness, transparency, data minimization and relevance, and in ways that ensure security and confidentiality.

HAPPY CREW has implemented appropriate technical and organizational measures to prevent unauthorized access, loss, misuse, or alteration of the processed data.

5. Data Recipients

Personal data may be disclosed, solely for the purposes stated above, to:

• authorized employees and collaborators;

• technical and IT service providers (hosting, e-commerce platform, email marketing);

• tax, legal, and accounting consultants;

• public authorities or institutions, as required by law;

• third parties appointed as Data Processors pursuant to Art. 28 GDPR.

Data will not be disseminated or transferred outside the European Economic Area unless done in compliance with Articles 44 and following of the GDPR.

6. Data Retention Period

Personal data will be retained:

• for the entire duration of the contractual relationship;

• afterward, for no longer than 10 years from termination, for tax, administrative, regulatory, or legal defense purposes;

• for marketing and profiling purposes (with consent), until consent is withdrawn or for a maximum of 24 months.

At the end of the retention period, data will be deleted or irreversibly anonymized.

7. Data Subject Rights

The User has the right to:

• access their personal data and obtain a copy (Art. 15 GDPR);

• request rectification (Art. 16) or deletion (Art. 17);

• restrict processing (Art. 18) or object (Art. 21);

• withdraw consent at any time, without affecting prior processing;

• request data portability (Art. 20), where applicable;

• lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

To exercise rights: privacy@happycrew.it

8. Data Provision Requirement

Providing data for contractual purposes is mandatory. Failure to do so will result in the inability to complete the order or create an account.

Providing data for marketing and profiling purposes is optional, and refusal will not affect use of the Platform.

9. Policy Updates

This Privacy Policy may be modified or updated at any time. In case of significant changes, Users will be notified through appropriate means (e.g., banners, email, or platform notifications).

Location and Date: Messina, November 5, 2025

For acknowledgement and acceptance