PRIVACY POLICY

(pursuant to Regulation (EU) 2016/679 – GDPR)

Version 01/2026 – Updated on 01/01/2026

VERSIONE ITALIANO

1. Data controller

ELLEGI S.r.l., operating under the trade name CarMotion, with registered office at Via Francesco Crispi, 250 – 90139 Palermo (PA), Italy, Tax Code and VAT No.

04147860821 (hereinafter, the “Data Controller”), in its capacity as data controller, informs you that your personal data will be processed in compliance with the

applicable data protection legislation.

The Data Controller may be contacted at the following certified email (PEC) address: ellegisas@cgn.legalmail.it or mail addresse: info@carmotion.it

2. Categories of personal data processed

The Data Controller processes common personal data, including, by way of example and not limitation:

• personal and identification data (name, surname, place and date of birth);

• contact details (address, telephone number, email address);

• data relating to identity documents and driving licences;

• tax and administrative data (tax code, VAT number, company name);

• payment and invoicing data;

• data relating to the rental agreement;

• photographic images of the vehicle and its condition (delivery and return checklists);

• handwritten or digital signatures affixed to contractual documents;

• data necessary for the management of damages, accidents, disputes and administrative penalties.

3. Purposes of processing and legal bases

Personal data are processed for the following purposes:

A) Contractual and pre-contractual purposes

(no consent required – Article 6(1)(b) GDPR)

• management of quotation requests and reservations;

• conclusion and performance of the rental agreement;

• management of vehicle delivery and return;

• preparation and storage of checklists, including photographic documentation;

• management of damages, accidents, delays, post-rental charges and Delayed Charges;

• sending of service-related communications related to the rental;

• administrative, accounting and tax management.

B) Compliance with legal obligations

(no consent required – Article 6(1)(c) GDPR)

• compliance with obligations arising from laws, regulations or orders of public authorities;

• management and communication of data to the competent authorities in relation to administrative penalties and violations of the Highway Code.

C) Legitimate interest of the Data Controller

(Article 6(1)(f) GDPR)

• protection of company assets;

• prevention of fraud and unlawful conduct;

• management of complaints, disputes and debt recovery;

• exercise of the right of defence in judicial or out-of-court proceedings.

D) Direct marketing purposes

(consent required – Article 6(1)(a) GDPR)

The Data Controller does not ordinarily carry out direct marketing activities.

Any promotional communications may be sent only upon the explicit and specific consent of the data subject, which is normally denied by default at the time of signing

the rental agreement

4. Methods of processing

Personal data are processed using paper-based, IT and electronic tools, in compliance with the principles of lawfulness, fairness, transparency, data minimisation and

security provided for by the GDPR.

Data are stored on secure IT systems and accessed exclusively by authorised persons

5. Data recipients

Personal data may be disclosed to:

• employees and collaborators of the Data Controller, duly authorised;

• consultants, professionals and law firms;

• banks and payment service providers;

• insurance companies;

• companies providing IT and management services;

• public authorities and supervisory bodies, where required by law.

Such entities act, as applicable, as data processors or independent data controllers.6. Data transfers

Personal data are not disseminated nor transferred to non-EU countries, except where such transfer is necessary for the performance of the contract and in compliance

with the safeguards provided by the GDPR.

7. Data retention

Personal data will be retained:

• for the entire duration of the rental agreement;

• thereafter, for a period consistent with legal obligations (in particular tax and accounting requirements);

• for the time necessary to protect the rights of the Data Controller in the event of disputes or legal proceedings.

8. Rights of the data subject

The data subject may exercise the rights provided for by Articles 15–22 of the GDPR, including:

• right of access;

• right to rectification and updating;

• right to erasure (within the limits of the law);

• right to restriction of processing;

• right to object to processing;

• right to data portability;

• right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9. Exercise of rights

The rights may be exercised by sending a request:

• via certified email (PEC) to ellegisas@cgn.legalmail.it;

• via email to info@carmotion.it;

• or by registered letter with return receipt to the registered office of the Data Controller.

10. Updates to this Privacy Policy

This Privacy Policy may be subject to updates.

The updated version will always be available on the website www.carmotion.it.