SINGLE FORM FOR THE EXERCISE OF PRIVACY RIGHTS

Data Request Form Code PRV-MOD-04-001_v01 - Rev. 06/2026

(Pursuant to Arts. 15-22 of the European Regulation EU 2016/679 - GDPR)

This form is provided by NICOLE DI STAMBAZZI ISABELLA (hereinafter "Nicole Rimini" or "Seller") to allow users of the site scarpe-da-ballo.com to exercise their rights regarding their personal data in a formal and structured manner.

Please complete the form in all its parts and submit it to the Data Controller through one of the following official channels:

• Via Email (Support): nicole@scarpedaballo-nicole.it

• Via Email (Management): isa@scarpedaballo-nicole.it

• Via PEC (Certified Email): nicole94@cert.cna.it

⚠️ Mandatory Security Measure: In order to verify the legitimacy of the request, protect the privacy of our customers, and avoid fraudulent communications to unauthorized third parties, the applicant is required to attach to this form a photocopy (or clear scan) of a valid identity document. The document will be used exclusively for identity verification purposes and will be deleted immediately once the procedure is completed.

1. DATA SUBJECT DETAILS (THE DATA OWNER)

(Please fill in with the details of the natural person to whom the personal data specifically refers)

• First Name: ______________________________________________________

• Last Name: ___________________________________________________

• Tax Code: ______________________________________________

• Email Address (used on the store): _____________________________

• Phone Number: __________________________________________

• Postal Address (Shipping/Billing): ____________________________________________

2. TYPE OF REQUEST AND REGULATORY REFERENCES

(Select with an "X" the specific right(s) you intend to exercise)

• [     ] Right of Access (Art. 15 GDPR)

• What the regulation provides: The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them is being processed and, if so, to gain access to the data and information regarding purposes, categories of processed data, recipients, and the retention period.

• Your request: I wish to receive confirmation of the processing of my data, obtain a copy in electronic format, and receive the full privacy policy regarding how it is managed by the store.

• [     ] Right to Rectification (Art. 16 GDPR)

• What the regulation provides: The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning them without undue delay, as well as the completion of incomplete personal data.

• Your request: I wish to request the correction, updating, or completion of my personal data should it be incorrect, outdated, or incomplete.

• [    ] Right to Erasure / Right to be Forgotten (Art. 17 GDPR)

• What the regulation provides: The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay. Legal note: This right encounters a structural limit (Art. 17, para. 3) where the processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defense of legal claims.

• Your request: I wish to request the permanent deletion of all my data from your archives and systems (Shopify account, marketing lists), with the understanding that only data required by law (e.g., commercial invoices for 10 years) or linked to ongoing disputes will be retained.

• [    ] Right to Restriction of Processing (Art. 18 GDPR)

• What the regulation provides: The data subject has the right to obtain from the data controller the restriction of processing when they contest the accuracy of the data, when the processing is unlawful but they oppose the erasure, or when the data is necessary for the data subject to establish, exercise, or defend a legal claim, even if the controller no longer needs it.

• Your request: I wish to request that the processing of my personal data be temporarily restricted (by flagging them in the databases to block future use) in the cases provided for by the regulation.

• [    ] Right to Data Portability (Art. 20 GDPR)

• What the regulation provides: The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format and has the right to transmit those data to another controller without hindrance.

• Your request: I wish to receive the data I provided to the store in a standard electronic format (CSV or PDF) or request its direct transfer to another provider, where technically feasible.

• [    ] Right to Object (Art. 21 GDPR)

• What the regulation provides: The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing, including profiling to the extent that it is related to such marketing.

• Your request: I wish to permanently object to the processing of my data for direct marketing purposes, including the sending of promotional newsletters or commercial communications via WhatsApp Business.

3. REQUEST DETAILS

(Optional space: enter any useful details or specific instructions to facilitate the search for data within the platform, for example by indicating order numbers placed, registration dates, or specific communications)

4. DECLARATION AND SIGNATURE (PURSUANT TO ART. 12 GDPR)

By signing this form, I declare under my personal responsibility that the information provided is accurate and that I am the legitimate data subject (or the legally authorized person) to whom the personal data being requested pertains.

Aware that submitting false, untruthful, or fraudulent requests constitutes a serious violation of the law, I fully indemnify the Data Controller, Nicole Rimini, from any civil or criminal liability arising from the submission or modification of data following incorrect or untrue information provided by me.

• Place and Date: _______________________

• Signature of Data Subject: _______________________

⏳ INFORMATION NOTE ON RESPONSE TIMES (ART. 12, PARA. 3 GDPR)

Pursuant to Article 12, para. 3 of the GDPR, the Data Controller shall provide the data subject with information on action taken on a request under Articles 15 to 22 without undue delay and in any event at the latest within one month (30 days) of receipt of the request.

That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The data controller shall inform the data subject of any such extension, together with the reasons for the delay, within one month of receipt of the request.

• Cost of service (Art. 12, para. 5 GDPR): The information provided and any communications and actions taken are free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the data controller may charge a reasonable fee taking into account the administrative costs incurred or refuse to act on the request.