Privacy Policy Lead Generation

I. OBJECTIVES

This privacy policy applies to the processing of personal data by any entity forming part of the Wellhub group of companies, including any direct or indirect parent company, subsidiary, affiliate or other entity under common control, as applicable (the “Company”, “we”, “us”), in connection with its lead generation activities. This may include personal data relating to individuals who express an interest in receiving information about the Company, its group companies, products, services, initiatives, events, business partnerships, professional collaborations or other commercial opportunities (the “Interested Parties”).

The Company is committed to protecting your privacy and process personal data in accordance with applicable data protection laws, including Regulation (EU) 2016/679, the General Protection Regulation (“GDPR”), and applicable Italian data protection laws.

Set out below is information that the Company is required to communicate to Interested Parties in connection with personal data collected during the Company’s lead generation. This policy may be amended from time to time.

All expressions of interest and related communications with the Company are treated as confidential in accordance with applicable data protection laws.

This policy operates in conjunction with applicable data protection laws and other relevant laws.

II. DEFINITIONS

Personal Data: any information relating to an identified or identifiable natural person, including any information or opinion provided to the Company as part of its lead generation activities. An identifiable natural person is someone who can be identified, directly or indirectly, including by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity. Such information may personally identify an individual or make the person’s identity reasonably apparent.

Sensitive Data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.

Processing: Any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

III. YOUR PERSONAL AND SENSITIVE DATA

This policy relates to Interested Parties’ Personal Data collected for the purpose of the Company’s lead generation activities.

If an Interested Party does not provide their Personal Data, the Company may be unable to respond, contact them, provide information about the Company, the Company’s products, service, initiatives and opportunities.

Personal Data collected during the lead generation activities may include:

a) identification and contact information, such as your name, surname, company, role, postal or email address, telephone number and country/location;

b) other contact details, such as social media handles you use on LinkedIn or other professional networking websites;

c) professional or business profile information;

d) information about your company, sector, business area, interests, preferences or needs;

e) information provided through forms, surveys, event registrations, campaigns, emails, calls or other communications with the Company;

f) any other information relevant to your interest in the Company, its products, services, initiatives or opportunities.

Sensitive Data is not requested by the Company as part of this process. Interested Parties should not provide Sensitive Data unless specifically requested and strictly necessary. The Company will only process Sensitive Data where permitted by applicable law and, where required, with the individual’s consent.

All information collected will be used and disclosed by the Company only as outlined in this document. The Company takes reasonable steps to ensure that an Interested Parties’ Personal and

Sensitive Data is held securely.

IV. HOW WE COLLECT YOUR PERSONAL DATA

It is the Company’s usual practice to collect information about Interested Parties directly from the Interested Parties themselves, when they provide such information by completing a lead generation form, a registration form, a survey, a campaign form or any other form made available by the Company.

We may also collect additional information directly from you if you decide to continue the interaction with the Company, for example by email, phone, video call, event participation or by providing additional documents or information.

We may also collect information about you because we are required or authorised by law to collect it.

If the relationship with the Company progresses, we may ask you to provide additional information reasonably necessary to assess or formalise the relevant relationship, such as evidence of identity, professional or company information, tax information, invoicing details or other information required by law or contract, which will be regulated by a separate privacy policy.

V. HOW WE USE YOUR PERSONAL DATA

Interested Parties’ Personal Data may be used in order to:

a) assess an Interested Party’s interest in learning more about the Company, its group companies, products, services, initiatives or opportunities;

b)respond to enquiries or requests submitted by Interested Parties;

c) contact Interested Parties by email, phone, LinkedIn or other communication channels;

d) send communications related to the Company, its group companies, products, services, initiatives or opportunities, where permitted by applicable law;

e) invite Interested Parties to calls, meetings, events, demos, discussions or other interactions with the Company;

f) manage and analyse the Company’s lead generation activities.

Unless authorised by applicable law, an Interested Parties’ Personal Data will not be used for any other purpose without the Interested Parties’ consent.

Where required by applicable law, the Company will rely on your consent. Where permitted by applicable law, the Company may also rely on its legitimate interest in carrying out lead generation activities.

You may object to receiving communications at any time by contacting us at marketing@wellz.com or by using the unsubscribe mechanism included in the relevant communication, where available.

VI. ACCURACY AND STORAGE OF PERSONAL DATA HELD

The Company will endeavour at all times to maintain an accurate record of each Interested Parties’ Personal Data.

To assist the Company to keep its records up to date, Interested Parties should ensure all Personal Data provided to the Company is accurate and up to date, and to notify the Company of changes where appropriate.

Personal Data held by the Company will be stored and managed in accordance with our general Privacy policy.

The Company will retain Personal Data for as long as necessary for the purposes described in this policy, including to manage lead generation activities, maintain records of relevant opportunities and comply with legal obligations.

Unless a longer period is required or permitted by law, Personal Data collected for lead generation purposes will generally be retained for up to 24 months from the last meaningful interaction with the Interested Party, or until the Interested Party withdraws consent or objects to the relevant processing, where applicable.

VII. INTERESTED PARTIES CAN ACCESS THEIR PERSONAL DATA

Interested Parties may request access to information that the Company holds about them, by contacting marketing@wellz.com.

If the Personal Data held is incorrect, Interested Parties may request that the Company amend our records by contacting marketing@wellz.com, and the Company will take reasonable steps to do so.

Interested Parties may also have the right to request deletion, restriction of processing, portability of their Personal Data and withdraw consent where processing is based on consent.

The Company may refuse to provide access to, correct or delete information where this is required or authorised by applicable law.

VIII. HOW TO CONTACT THE COMPANY

If you have any questions in relation to this lead generation privacy policy, or if you have a problem or complaint, please contact the Data Privacy Officer: DPO@gympass.com.