Privacy and Data Protection Policy

1. PURPOSE

The purpose of the document is to describe the principles of Personal Data Protection.

2. SCOPE

The indications contained in this document apply to the entire organization of the Lutech Group.

3. DEFINITIONS AND ABBREVIATIONS

The abbreviations used within the document are indicated below. See the Glossary for commonly used definitions.

4. LIABILITY

The following table shows the responsible function and the participating functions for this process.

5. DESCRIPTION

The protection of personal data for the companies of the Lutech Group is an integral part of its ethical commitment: to protect the rights, freedoms and dignity of the person, to promote fairness and transparency in relationships, to guarantee the security and confidentiality of information. These values, expressed in the Group's Code of Ethics, define a climate of trust towards employees, customers, suppliers and institutions, and make compliance with personal data protection regulations (GDPR among all but not only) not only a legal obligation, but a moral duty.

5.1 Our principles

The Lutech Group adopts and implements the principles of Personal Data Protection in all processing:

1. Lawfulness, fairness and transparency
2. Purpose limitation
3. Data Minimization
4. Accuracy
5. Retention limitation
6. Integrity and confidentiality

These principles are derived from European legislation (GDPR) and are implemented in the Group through the Personal Data Protection Management System (SGPDP), with which policies, procedures and controls are aligned. Through the SGPDP, these principles are transmitted to all Group companies that apply them in harmony with their respective local regulations.

In addition, in line with the Code of Ethics, Lutech adds transversal ethical commitments: non-discrimination, protection of the person, ethics of information, transparency in relationships and responsibility in the use of Artificial Intelligence (AI) (POL-980) in a safe and respectful way for the fundamental rights of the people themselves.

5.2 How we pursue them

5.2.1 in-house

Within the Group, the protection of personal data is guaranteed through the Personal Data Protection Management System (GSPDP) which defines roles, responsibilities, processes and tools. The CEO, the Group DPO and the Group Data Privacy Manager coordinate the activities, while the Privacy Organizational and Operational Managers ensure the correct execution of the processing. Accountability is pursued with continuous training of staff with respect to the privacy role they hold, binding instructions, audits and monitoring, as well as the keeping of processing records.

Each internal project is based on the principles of privacy by design and by default, with risk assessments and, where necessary, DPIA. Security is guaranteed by appropriate technical and organizational measures, integrated with the Information Security Management System (ISMS) according to the international standard ISO 27001.

Transfers of personal data within Group companies are covered by specific agreements and the rights of Data Subjects are managed through dedicated processes and clear channels, while the culture of confidentiality is promoted as an ethical value.

5.2.2 four our costumers

In relations with Customers, Lutech operates as Data Processor or Sub-Processor in compliance with the contractual instructions and the rules of the GDPR and local ones. The appointments are then formalized with contractual acts in compliance with local personal data protection regulations, which define -among others- security measures, retention terms and clauses for any Sub-Processors.

Each treatment is managed at the order level and has a life cycle aligned with the contract, ensuring registration, traceability and transparency. For international transfers , the Group adopts the EU Standard Contractual Clauses (SCCs).

Lutech collaborates in customer audits, provides evidence and promptly notifies any incidents, maintaining an ethical and transparent approach to information.

5.2.3 towards other stakeholders

With Suppliers and Partners, Lutech applies selection criteria based on ethics, quality and compliance, imposing privacy clauses and controls on the chain of Sub-Processors.

In its relations with the Public Administration and institutions, the Group acts with legality, fairness and transparency, maintaining an ethical approach.

Lutech cooperates fully with the Supervisory Authorities, managing requests and inspections according to internal procedures and with the supervision of the DPO.

The Group also guarantees correct and accessible information to shareholders and public opinion, publishing documents and policies on the intranet and, where necessary, on the corporate website.

5.3 Actions implemented

Through the SGPDP, the Lutech Group maintains a structured approach to governance, roles, processes and tools. At Group level, the DPO informs and monitors compliance, while the Data Privacy Manager manages the System and tools, ensures the keeping of Records and risk assessments. CIO and CSO oversee security and infrastructure.

In the subsidiaries, the Privacy Representatives implement the policies and processes locally, bringing them into line with local privacy regulations and coordinate with the Group. The Organisational Managers guarantee the compliance of the processing and the training of the Operational Managers, who carry out the actual processing activities. The System is supported by Registries, contract templates, standards, application tools (TOO-045) and centralized repositories (TOO-039), as well as continuous training programs for all roles.

5.4 Our commitment is continuous

The Lutech Group is committed to constantly improving its Management System, updating policies and tools based on regulatory and technological developments. Periodic audits by the DPO and monitoring are planned, with action plans to manage both any improvement actions and non-compliance. Training is continuous, to consolidate the culture of data protection and security.

The Group maintains a transparent relationship with the Authorities and stakeholders, ensuring timeliness and fairness in communications, especially in the event of violations. Every operational choice is guided by the principles of the Code of Ethics, to guarantee legality, integrity and protection of people and their fundamental rights.

The complete training material is made available to the entire Group population, through the Training Management tool. This training material covers in depth crucial topics such as principles, roles and responsibilities, compliance and transparency actions, and security. The training also includes specific content to support managerial roles in the operational management of their obligations and enable them to address the particular needs and challenges of the organization.