Information pursuant to Art. 13 of the General Data Protection Regulation

Revision 00 dated 02.04.2026 – Payment

1. Data Controller

• Company name: Loomoon s.r.l.
• Registered office: via Alice Barbi, 7 – 40017 San Giovanni in Persiceto (BO)
• Contact details: customerservice@loomoon.games

2. Purpose of the processing

2.1. Entering into the sales contract: Carrying out all technical, administrative and logistical activities necessary to perform the sales contract.

2.2. Promoting similar products: Sending commercial communications regarding products similar to those purchased.

3. Legal basis for the processing

3.1. Entering into the sales contract: Pre-contractual measures, the contract and the related legal obligations.

3.2. Promoting similar products: Art. 130.4 of Italian Legislative Decree No. 196 of 2003.

4. Personal data subject to processing

4.1. Entering into the sales contract: Personal identification data, contact details, payment details, and all data necessary to fulfil the contractual obligations falling within our responsibility.

4.2. Promoting similar products: The email address provided at the time of purchase.

5. Personal data retention period

5.1. Entering into the sales contract: The data will be retained for no longer than necessary to achieve the purpose referred to in paragraph 2.1, and therefore according to the following criteria:

• the need to perform the contract;
• the need to comply with applicable legal obligations, including, among others, the obligation to retain accounting records for ten (10) years;
• the need to establish, exercise or defend a legal claim.

5.2. Promoting similar products: The data will be retained for no longer than necessary to achieve the purpose referred to in paragraph 2.2, and therefore according to the following criteria:

• the need to promote products similar to those purchased;
• two years after the most recent purchase;
• in any case, no later than the exercise of the right to object to the processing.

6. Requirement to provide data

6.1. Entering into the sales contract: The provision of data is necessary. Without such data, it will not be possible to enter into the sales contract.

6.2. Promoting similar products: The provision of data is necessary. Without such data, it will not be possible to enter into the sales contract.

7. Recipients of the data

7.1. Persons authorised to process data: Within the limits relevant to the processing purposes indicated above, the data may be disclosed to internal personnel expressly authorised and instructed to process such data.

7.2. Data Processors: Within the limits relevant to the processing purposes indicated above, the data may be disclosed to service providers whose services are necessary for the processing activities, appointed as Data Processors and appropriately instructed, such as:

• the electronic invoicing service provider;
• the web agency service provider;
• the email service provider;
• the accounting and tax data processing service provider.

7.3. Data Controllers: The data may be disclosed to Public Authorities in accordance with applicable legislation.

The data may also be disclosed to other Data Controllers where necessary to achieve the stated purpose, such as the bank.

8. Disclosure and transfer of data

8.1. Disclosure of data: The data will not be publicly disclosed.

8.2. Transfer outside the EU: No data will be transferred to non-European countries.

9. Rights of data subjects

9.1. Right of access (Art. 15 GDPR): You may request confirmation as to whether or not personal data concerning you are being processed, obtain further information regarding the information contained in this notice, and receive a copy of the data, provided that doing so does not adversely affect the rights and freedoms of others.

9.2. Right to rectification (Art. 16 GDPR): You may request the correction or completion of data you have provided or that are otherwise in our possession if they are inaccurate.

9.3. Right to erasure (Art. 17 GDPR): You may request that the data collected or processed be erased.

9.4. Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of personal data; in such cases, the data will not be processed, except for storage, without your consent, subject to the exceptions expressly provided for in paragraph 2 of the same Article.

9.5. Right to data portability (Art. 20 GDPR): You may request to receive your data, or to have them transmitted to another Data Controller indicated by you, in a structured, commonly used and machine-readable format.

9.6. Right to object (Art. 21 GDPR): You may object at any time to the processing of data based on a legitimate interest, unless there are compelling legitimate grounds for the processing that override your rights, for example for the establishment, exercise or defence of legal claims; your objection will always prevail over our legitimate interest in processing data for marketing purposes.

9.7. Right not to be subject to automated decision-making (Art. 22 GDPR): You may request not to be subject to a decision based solely on automated processing, including profiling.

10. Complaint to the supervisory authority

10.1. Right to lodge a complaint (Art. 77 GDPR): You may lodge a complaint with the supervisory authority of the Member State in which you habitually reside, work, or where the alleged infringement occurred.

10.2. Italian supervisory authority: Garante per la Protezione dei Dati Personali

10.3. Contact details: Piazza Venezia, 11, 00187 Rome (RM) – protocollo@pec.gpdp.it

11. Automated decision-making, including profiling

11.1. Entering into the sales contract: No automated decision-making processes, including profiling, are carried out.

11.2. Promoting similar products: No automated decision-making processes, including profiling, are carried out.