Privacy Policy — version 2026-11-01

This privacy notice explains how All Indabox S.r.l. processes your personal data when you use the Parkito Platform, pursuant to Arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree (D.Lgs.) 196/2003 ("Italian Privacy Code"). Capitalized terms (Parkito Platform, Member, Host, Driver, Guest Driver, Booking, Parkito Services, Support Service) have the meaning given to them in the Terms and Conditions (version 2026-09-30). The use of cookies and other tracking tools is described in the Cookie Policy.

1. Who we are and how to contact us

Data controller: All Indabox S.r.l. ("Parkito", "we"), with registered office at via G. Mazzini n. 11, Bologna (BO), Bologna Companies Register, REA no. BO-568791, VAT no. and tax code 04099131205.

Data Protection Officer (DPO): Parkito has not appointed a DPO, as the conditions set out in Art. 37 GDPR are not met. For any privacy matter you can write to the contact details above.

2. Who this notice applies to

This notice concerns the natural persons who interact with the Parkito Platform, namely the parkito.app website, the iOS and Android applications, the toll-free number, the WhatsApp channels and Parkito's e-mails:

• Drivers, whether registered or Guests, and anyone who accesses the Parking Space with them;
• Hosts, whether private individuals, professionals or representatives of organisations and companies;
• purchasers of the Parkito Services: Shuttle Service, Area C Service and Devices;
• website visitors and subscribers to promotional communications;
• anyone who contacts the Support Service or submits a report under Art. 15 of the Terms.

Roles of Parkito and of Hosts. For the processing described in this notice, Parkito is an independent controller. When a Host receives a Driver's data through the Platform (name, vehicle, licence plate, times), the Host processes it as an independent controller and only to perform the Booking (Art. 5.4 of the Terms). For that processing, the Host is directly responsible for compliance with the GDPR.

3. What data we process, why and for how long

We process only the data necessary for each purpose. The table shows, for each purpose, the legal basis (Art. 6 GDPR) and the retention period. When the period expires, the data is deleted or anonymised; it is kept longer only if needed for a pending dispute or at the request of an authority.

Legitimate interest. Where we rely on legitimate interest, we have verified that your rights do not override it. You may object at any time on grounds relating to your particular situation (section 12). You can ask us for a summary of the assessment.

Mandatory data. The data necessary for registration, Booking, payment and legal obligations is essential: without it we cannot provide you with the service. Providing data for purposes based on consent is optional, and refusing does not affect the service.

Data of other people. If you book for another person or name someone who accesses the Parking Space with you, make sure you are entitled to share their data with us and inform them of this notice.

4. Identity verification and biometric data

Verification is required to publish Listings, receive payouts and, for Guest Drivers, access the Parking Space (Arts. 1.5 and 22.2 of the Terms). It is carried out through Veriff OÜ, which acts as our data processor.

1. Veriff captures an image of the document and of your face and compares them to confirm that the document is yours.
2. The comparison generates biometric data, which is processed only with your explicit consent, requested before the process starts.
3. Parkito receives only the result, your first and last name, and the document type and expiry date. It does not receive or store biometric templates.
4. Veriff deletes images and biometric data within 180 days of the verification, unless Veriff is subject to legal obligations.

You may withdraw your consent at any time, without affecting verifications already completed.

5. Promotional communications and e-mail tracking

We send you offers and news only in the following cases:

• you are already a customer: we may write to the e-mail address you provided during a Booking about services similar to those you purchased. You can object straight away when the address is collected and afterwards in every message (Art. 130(4) Italian Privacy Code);
• you have given your consent: for e-mails about other services, SMS, WhatsApp, promotional push notifications and calls with an operator;
• profiling: we tailor offers based on your Bookings only with a specific, separate consent.

Promotional e-mails may contain pixels and tracked links that record opens and clicks. We use them only if you have consented to promotional communications, as required by the Guidelines of the Italian Data Protection Authority (Garante) of 17 April 2026. Every promotional e-mail contains a link to unsubscribe or to disable tracking only while continuing to receive the messages. In service e-mails we measure opens only in aggregate and anonymous form, or for security purposes.

Communications about Bookings, payments, security and changes to the Terms are not promotional and reach you regardless of your preferences (Art. 29.4 of the Terms).

6. Geolocation

If you allow it through the browser or device permission, we use your location to show you nearby Parking Spaces and directions. Your location is used at the time of the search and is not kept in a history; we record only, in aggregate form, the number of searches and their outcome. If you have consented to analytics tools (see Cookie Policy), the coordinates of the searched location may appear in analytics events linked to a random browser identifier. You may revoke the permission at any time from your device settings; search by address remains available.

7. Who we share data with

We do not sell your personal data. We share it only with the parties listed below and only to the extent necessary.

Data processors (Art. 28 GDPR): providers that process data on our behalf, according to our instructions and under a contract that binds them to confidentiality and security.

The up-to-date list is available on request at the contact details in section 1.

Independent controllers: parties that receive the data and process it for their own purposes, in accordance with their own privacy notices.

Parkito staff access data only where necessary for their duties, as authorised persons bound by confidentiality (Art. 2-quaterdecies Italian Privacy Code).

8. Transfers outside the European Economic Area

Some providers are based in, or access data from, the United States. In these cases the transfer takes place only with one of the safeguards provided for by Arts. 45-46 GDPR:

• an adequacy decision, including Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework for certified providers;
• standard contractual clauses approved by the European Commission (Decision (EU) 2021/914), with supplementary measures assessed on a case-by-case basis.

The validity of the Data Privacy Framework is the subject of an appeal pending before the Court of Justice (Case C-703/25 P). If it were annulled, we will use standard contractual clauses or other appropriate safeguards. You can request a copy of the safeguards at the contact details in section 1.

9. Artificial intelligence and automated tools

We use artificial intelligence systems in the voice assistant for the toll-free number and in the WhatsApp assistant (Art. 17 of the Terms). At the start of each conversation we tell you that you are talking to an automated system, as required by Art. 50 of Regulation (EU) 2024/1689 and Art. 4 of Law 132/2025.

• What the assistant does: it reads the data of your Bookings, indicates available Parking Spaces and prices, and opens a request for an operator. It does not conclude Bookings, collect payment data or carry out cancellations.
• Data processed: phone number, voice, transcript and content of the conversation, data of the Booking mentioned.
• Risks and limitations: answers may contain errors; the information shown on the Platform at the time of booking prevails.
• Your choices: you can ask at any time to speak to an operator and object to processing through the assistant.
• Training: providers may not use your conversations to train their own models.

Automated filters. Messaging between Members uses filters that block or mask phone numbers, e-mail addresses and external links (Art. 14.2 of the Terms). The filter acts on the individual message. Measures on the account (suspension, blocking) are decided by a person, who assesses the case (Arts. 14.3 and 15 of the Terms).

Automated decisions. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22 GDPR. The automatic calculation of the price and reductions (Arts. 1.3 and 5.2.2) applies known rules that are the same for everyone.

10. Minors

Registration and Bookings are reserved for adults (Arts. 1.5 and 22.1 of the Terms). We do not knowingly collect data of persons under 18. If we discover an account belonging to a minor, we close it and delete the data.

11. Security

We protect data with technical and organisational measures appropriate to the risk (Art. 32 GDPR): encryption in transit and at rest, encrypted credentials, role-based and logged access, backups, separation of environments. In the event of a personal data breach, we notify the Garante within 72 hours and, if the risk is high, you as well (Arts. 33-34 GDPR).

12. Your rights

You may exercise at any time, free of charge, the rights provided for by Arts. 15-22 GDPR:

You can use your account settings. Account deletion is available in the app. We reply within one month, which may be extended by two months for complex requests; we may ask you to verify your identity.

13. Complaints

If you believe that the processing infringes the GDPR, you may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the authority of the EU Member State where you live or work. You may also apply to the courts.

14. Changes to this notice

We publish each new version with its effective date and a summary of the changes on the Change history page, where previous versions remain available. We inform you by e-mail or in the app of material changes. If a change requires new consent, we ask you for it before applying it.