PRIVACY NOTICE PURSUANT TO SEC. 13 OF EU REGULATION NO. 679/2016 (“GDPR”)

Dear Friend,

F.C. Internazionale Milano S.p.A. (hereinafter, Inter), with registered office in 20124 Milan, Viale della Liberazione no. 16/18, corporate capital of Euro 19,195,313.34, fiscal code and number of registration with the Companies’ Register of Milan 80066310154, in its quality of data controller, provides you with this Privacy Notice pursuant to sec. 13 of GDPR.

1. Data collected, purposes and legal ground

Inter processes the personal data of the subjects involved in the processing (hereinafter, Data subject) and in particular of the fans that purchase tickets for the matches of the team “F.C. Internazionale”, season tickets for the entire season 2020/2021 and onwards, supporter cards (tessere del tifoso) or Inter Club cards (hereinafter, jointly referred to as the Services). The data are provided directly by the Data subject, for the following purposes: a) requirements related to the purchase of the Services and further purposes connected to the purchase of the Services and attendance to the football events, such as providing information/material related to the events; b) administrative/accounting purposes resulting from the purchase of the Services; c) statistical purposes on anonymised data; d) delivery of newsletters on the activities of the team “F.C. Internazionale” and marketing communications concerning discounts, offers, services, membership programs and events of Inter and Inter Store, additional to those referred to in lett. h) below; e) purposes of delivery of customer satisfaction surveys or questionnaires with regard to Inter’s products and services; f) profiling purposes; g) delivery of commercial and promotional communications concerning products and/or services of Inter’s selected partners; h) delivery of updates and/or advertising materials in relation to Inter’s products and/or services of the same nature as those already purchased or used by the Data subject, unless otherwise indicated by the Data subject. The legal basis for data processing is the execution of a contract (for the purposes under lett. a) and b) above), and the Data subject’s consent (for the purposes under lett. d), e), f), g)), and the legitimate interest of Inter to offer products and services of the same nature as those already purchased by the Data subject in accordance with Article 6.1(f) of the GDPR, unless the Data subject objects at the time of receipt of the notification or subsequently (for the purpose under lett. h)). In particular, Inter may carry out direct marketing activities in the absence of the express consent of the Data subject (by virtue of an assessment of the prevalence of its interest in sending direct marketing communications, in the absence of real prejudice to the interests, rights and fundamental freedoms of the Data subject and as provided for in Recital 47 of the GDPR which qualifies the processing of personal data for direct marketing purposes as a “legitimate interest”), but only until receipt of an objection to such processing by the Data subject.

Please note that, inside and in the surrounding areas of the San Siro Stadium in Milan, a video surveillance system is operating in compliance with the provisions of the Decree of the Ministry of the Interior of 6 June 2005. The aforementioned video surveillance system is aimed at managing the safety of the sports facility and the prevention and repression of crimes during the sporting events (for any further information, please refer to the relevant Privacy Notice posted at the San Siro Stadium). It should also be noted that, in application of the INTER’S CODE OF CONDUCT (hereinafter, the Code) and of the “System of Rating” established by the F.I.G.C.’s Protocol of 4 August 2017, any images acquired through the video surveillance system can also be used for the purpose of detecting conducts held by the fans in violation of the provisions of the Code. In particular, the verification of any conducts contrary to the values of sport and the public sense of decency, as well as discriminatory conducts of any kind or detrimental to the image of the team "F.C. Internazionale", may lead to the imposition of interdictory or inhibitory measures against the infringer.

2. Means of processing

Inter hereby informs you that: a) for the above mentioned purposes the data shall be processed also by computer, telematic, paper and manual instruments, in compliance with the confidentiality and safety rules provided by the law; b) in case of expressed consent to the profiling activity referred to under point 1 lett. f) above, this will entail an

automated activity in order to allocate the Data subject into a category of subjects with homogeneous characteristics (in terms of purchase preferences) on the basis of the Services previously purchased, any market surveys that may have been completed, the relevant demographic class and the activities attended by the Data subject during the use of the Services.

3. Optional Data disclosure

The provision of the data is optional. Any refusal to provide the data for the purposes relating to the purchase of the Services, attendance to the events and administrative/accounting purposes, referred to under point 1 lett. a) and b) shall lead to the impossibility to subscribe and to enjoy the related services offered by Inter. Also a subsequent possible opposition or revocation of the processing of data for the aforementioned purposes shall result in the immediate blocking of the supply of the Services. The processing of the data for the purposes indicated herein also occurs in the absence of the Data subject express consent, as it is necessary to perform the obligations connected to the purchase of the Services by the Data subject. The data will be also processed in anonymous form for the statistical purposes ones referred to point 1 lett. c). Any refusal to provide consent to the data processing for the further purposes referred to under point 1 let. d), e), f) and g), namely for the delivery of newsletters on the activities of the team “F.C. Internazionale”, marketing communications concerning products and services of Inter or Inter’s partners and customer satisfaction surveys shall not have any consequences, profiling activities, shall not lead to any consequences subject to the impossibility for the Data subject to be informed about any market surveys and any marketing and promo-advertising initiatives from Inter or partners and to receive commercial communications of interest. Any opposition to the processing for the direct marketing purposes indicated in point 1 lett. h) shall not lead to any consequence, subject to the impossibility of receiving advertising material relating to Inter’s products and services of the same nature as those already purchased or used by the Data subject.

4. Dissemination and communication of Data

The data shall not be disseminated. Within the organization of the data controller, the data may be processed by the relevant offices entrusted with the execution of the processing activities (i.e. Administration, Commercial, Marketing, IT). In the performance of its activities and of its information, cultural, promo-advertising, marketing, profiling, merchandising and sponsorship initiatives, Inter, in its quality of data controller, may communicate the data to the third parties mentioned in Footnote1 and appointed as data processor for the purposes of managing the provision of the Services and attendance to the related events or for any further purposes to which the Data subject has agreed. In some cases, the subjects who cooperate with Inter to provide the Services operate as independent data controllers, provided in this case to the Data subject, under their own responsibility, a suitable privacy notice. The complete list of data processors appointed by Inter, and of independent data controllers, can be easily known at no charge by sending a request to the email address indicated under point 7 of this Privacy Notice.

5. Location and period of Data storage

The data shall be stored on servers located within the European Union. Inter may transfer personal data to companies belonging to the Inter/Suning Group, some of which are based in People's Republic of China, for the purposes of the provision of planning and organisational services with regard to the business activity carried out by Inter. With regard to the aforementioned country, there is no adequacy decision of the European Commission. Before proceeding with the transfer of data towards third countries that are not members of the European Union for which there is no adequacy decision, Inter adopts all appropriate guarantees in accordance with applicable legislation, so that the data transfer is fully legitimate and the rights of the Data subjects are guaranteed, even in the absence of their consent. In particular, Inter adopts the system of standard contractual clauses approved by the European Commission for the transfer of data to non-EU countries. Any data collected for the purposes indicated under point 1 lett. a) and b) shall be retained for as long as necessary for the provision of the Services, and subsequently for a period not exceeding the statutory limitation period. Any data collected for the purposes of processing indicated under point 1 lett. d), e) and g) shall be retained until the Data subject withdraws his/her consent to receiving commercial communications from Inter or Inter’s partners or requests the deletion of data, except for cases where Inter needs to retain such data to defend its rights in relation to any disputes that are on-going at the time of the request, or upon formal request from public

authorities. The data collected for the purposes of processing indicated under point 1 lett. f) shall be retained until the Data subject withdraws consent to the marketing activities described therein, or presents a request for deletion of such data, subject to the foregoing. Any data collected for the purposes of processing indicated under point 1 lett. h) shall be retained until the Data subject objects to the receipt of advertising material relating to Inter’s products and services of the same nature as those already purchased or used by the Data subject, except for cases where the data are also processed for other legitimate purposes, including the case in which it is necessary to retain the data in order to provide a Service to the Data subject, to defend the rights of Inter in relation to any disputes that are on-going at the time of the request, or upon formal request from public authorities.

6. Data subject’s rights

The Data subject has the right to: a) obtain the termination of processing for direct marketing purposes, also in relation to services identical to those already provided by Inter; b) obtain information in relation to the purposes for which data are processed, to the period of processing and to the subjects to whom the data are communicated (right of access); c) obtain the rectification or integration of incorrect data concerning the Data subject (right to rectification); d) obtain the deletion of data concerning the Data subject in the following cases: (i) the data are no longer necessary for the purposes for which they were collected; (ii) the data subject has withdrawn his/her consent to the processing of data, if these are processed on the basis of his consent; (iii) the Data subject has opposed the processing of data concerning him/her, in case these are processed for our legitimate interest; or (iv) the processing of data does not comply with the law. However, it is to be noted that the retention of data by Inter is also lawful if it is necessary in order to fulfil a legal obligation or to ascertain, exercise or defend a right in Court (cancellation right); e) to obtain that the data concerning the data subject are only stored without any further use in the following cases: (i) the Data subject disputes the accuracy of the data, for the period that is necessary for allowing Inter to verify the accuracy of such data; (ii) the processing is unlawful but the Data subject objects to the deletion of the data; (iii) the data are necessary for ascertaining, exercising or defending a right in Court; (iv) the Data subject has opposed the processing and is awaiting the verification of the possible prevalence of Inter’s legitimate interest to the processing (limitation right); f) receive in a common, structured, commonly used and machine-readable format, all data concerning the Data subject, if these are processed under a contract or on the basis of the Data subject’s consent (portability right).

Please also note that the Data subject has the right to contact the Data Protection Authority in order to enforce his/her rights with regard to the data processing.

7. Data controller’s contact details

The data controller pursuant to art. 24 of the GDPR is F.C. Internazionale Milano S.p.A., with registered office in 20124 Milan, Viale della Liberazione no. 16/18, corporate capital of Euro 19,195,313.34, fiscal code and number of registration with the Companies’ Register of Milan 80066310154. The data controller can be contacted for any requests or reports at the following contact details: UFFICIO LEGALE INTERNO – 20124 Milan, Viale della Liberazione no. 16/18- TEL. +39 02 82719080. The data controller has appointed a data protection officer pursuant to sec. 37, 38 and 39 of the GDPR, which is domiciled for the position at the address of F.C. Internazionale Milano S.p.A. and can be contacted at the email address privacy@inter.it for any matter concerning the data processing. By sending an email to privacy@inter.it, the Data subject can also exercise any rights referred to under point 6 of this Privacy Notice.

Footnote1: a) Mailing Companies; b) Shippers; c) Couriers; d) Companies that generally carry out enveloping, delivery and transport of correspondence; e) Companies and/or collaborators that manage on-site operations related to the football events; f) Companies that manage payment authorization systems (so-called payment gateways); g) Subsidiaries and affiliated companies pursuant to art. 2359 of the civil code; h) Companies affiliated with Inter; i) Consultants of Inter; l) Companies that conduct sport marketing activities and activities in collaboration and/or co-marketing with Inter; m) Ticketing providers in on-line and physical stores; n) Data management companies; o) Insurance companies; p) Providers for electronic invoicing. An updated list of the above-mentioned companies and consultants (i.e. data processors under art. 28 of the GDPR, and in some cases independent data controllers) is available at the registered office of Inter and may be known simply by sending a request at the email address privacy@inter.it