Information pursuant to Art. 13 of the General Data Protection Regulation

Revision 00 dated 02.04.2026 – Personal account creation

1. Data Controller

• Company name: Loomoon s.r.l.
• Registered office: via Alice Barbi, 7 – 40017 San Giovanni in Persiceto (BO)
• Contact details: customerservice@loomoon.games

2. Purpose of the processing

To create and manage a personal account for accessing the website.

3. Legal basis for the processing

Consent (optional and always revocable) given by ticking the relevant box within the form.

4. Personal data subject to processing

Personal identification data, contact details, personal password, and data saved within the account.

5. Personal data retention period

The data will be retained for no longer than necessary to achieve the stated purpose, and therefore in accordance with the following criteria:

• the need to create and manage the personal account;
• a request to delete the personal account;
• 5 years after the last access to the personal account;
• in any case, upon withdrawal of consent.

6. Requirement to provide data

The provision of data is optional. However, without providing such data, it will not be possible to create a personal account.

7. Recipients of the data

7.1. Persons authorised to process data: Within the limits relevant to the processing purposes indicated above, the data may be disclosed to internal personnel expressly authorised and instructed to process such data.

7.2. Data Processors: Within the limits relevant to the processing purposes indicated above, the data may be disclosed to service providers whose services are necessary for the processing activities, appointed as Data Processors and appropriately instructed, such as:

• the web agency service provider.

7.3. Data Controllers: The data may be disclosed to Public Authorities in accordance with applicable legislation.

8. Disclosure and transfer of data

8.1. Disclosure of data: The data will not be publicly disclosed.

8.2. Transfer outside the EU: No data will be transferred to non-European countries.

9. Rights of data subjects

9.1. Right of access (Art. 15 GDPR): You may request confirmation as to whether or not personal data concerning you are being processed, obtain further information regarding the information contained in this notice, and receive a copy of the data, provided that doing so does not adversely affect the rights and freedoms of others.

9.2. Right to rectification (Art. 16 GDPR): You may request the correction or completion of data you have provided or that are otherwise in our possession if they are inaccurate.

9.3. Right to erasure (Art. 17 GDPR): You may request that the data collected or processed be erased.

9.4. Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of personal data; in such cases, the data will not be processed, except for storage, without your consent, subject to the exceptions expressly provided for in paragraph 2 of the same Article.

9.5. Right to data portability (Art. 20 GDPR): You may request to receive your data, or to have them transmitted to another Data Controller indicated by you, in a structured, commonly used and machine-readable format.

9.6. Right to object (Art. 21 GDPR): You may object at any time to the processing of data based on a legitimate interest, unless there are compelling legitimate grounds for the processing that override your rights, for example for the establishment, exercise or defence of legal claims; your objection will always prevail over our legitimate interest in processing data for marketing purposes.

9.7. Right not to be subject to automated decision-making (Art. 22 GDPR): You may request not to be subject to a decision based solely on automated processing, including profiling.

10. Complaint to the supervisory authority

10.1. Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with the supervisory authority of the Member State in which you habitually reside, work, or where the alleged infringement occurred.

10.2. Italian supervisory authority: Garante per la Protezione dei Dati Personali

10.3. Contact details: Piazza Venezia, 11, 00187 Rome (RM) – protocollo@pec.gpdp.it

11. Automated decision-making, including profiling

No automated decision-making processes, including profiling, are carried out.