With this document, HiWay Media S.r.l., data controller for users of the StreamWay+ platform (hereinafter "the Platform"), provides users (the "Data Subjects") with detailed information on the use of cookies and other tracking tools within the Platform, in accordance with the Italian Data Protection Authority (Garante) Decision of 10 June 2021 ("Cookie Guidelines") and the EDPB Guidelines 05/2020.

This Cookie Policy applies to all environments through which the Platform is accessible: website, mobile apps and CTV (Connected TV) applications.

Art. 1 — Cookies and Similar Technologies: Definitions

Cookies are small text files stored on the Data Subject’s device (browser, app) when visiting a website or using an application. They may be sent by the Platform operator (first-party cookies) or by third parties whose elements are integrated in the Platform (third-party cookies).

The Platform also uses similar technologies: SDKs (Software Development Kits) on mobile apps, identifiers on CTV/Connected TV applications, and local storage. These technologies are subject to the same rules applicable to cookies.

Cookies serve different purposes: they enable the technical functioning of the website/app, store user preferences, collect statistical information on Platform usage, and track user behaviour for advertising or profiling purposes.

Art. 2 — Data Controller and Responsibility for Cookies and Similar Technologies

For cookies/SDKs used by HiWay Media for technical and non-profiling technical purposes, HiWay Media acts as the Data Controller. For cross-catalogue personalisation and co-marketing purposes, HiWay Media and its Partners may act as joint controllers pursuant to Art. 26 GDPR. Suppliers processing data on behalf of HiWay Media via cookies/SDKs act as data processors under Art. 28 GDPR, on the basis of compliant agreements and bound by instructions and adequate measures.

Art. 3 — Types of Cookies/SDKs Used and Legal Bases

3.1 Strictly Necessary Technical Cookies (no consent required)

Essential for the functioning of the Platform and the provision of the Service. They do not require prior consent and cannot be disabled without compromising essential functionalities.

These include:

• Session and authentication cookies: keep the User’s login session active;
• Security cookies: protect against CSRF attacks, bots, and unauthorised access;
• Video player cookies (DRM player): required for playback of Content with anti-piracy protection;
• Cookie consent management cookies: store the choice made in the consent banner;
• Load balancing cookies: required for traffic distribution across the CDN infrastructure.

3.2 Non-Essential Preference and Functionality Cookies (with consent)

They store User choices that are not essential for the provision of the Service, but useful to improve the experience (e.g. preferred language, player display preferences, non-strictly necessary accessibility settings).

3.3 Analytics Cookies (with consent, unless fully anonymised)

They collect aggregated and anonymous information on Platform usage (number of visits, pages viewed, navigation paths, session duration). Where processing is fully anonymised and the IP address is masked before any transmission to the provider, these cookies are equivalent to technical cookies and do not require consent. Otherwise, prior consent is required.

3.4 Profiling and Marketing Cookies (mandatory consent)

They track the User’s browsing behaviour to build profiles and send personalised advertising messages. They require prior, explicit and granular consent from the Data Subject, in accordance with the Garante’s Cookie Guidelines.

3.5 Partner Channel Cookies (mandatory consent)

Some Partner Channels integrated into the Platform may use their own or third-party cookies (e.g. video players, Channel analytics, audience measurement tools). These cookies are subject to the same consent rules as profiling cookies.

For more detailed information on the use of cookies by each Partner Channel, please refer to their respective privacy notices, accessible via the link on the Channel page.

3.6 IP-Based Geolocation (technical, no consent required)

HiWay Media uses the User’s IP address, automatically acquired at the time of connection, to determine the user’s country for the purpose of complying with geographical restrictions on Content licence rights and for tax obligations related to the VAT rules on electronic services. This processing takes place without the need for consent, as it is strictly necessary for the provision of the Service and compliance with legal obligations.

Art. 4 — Consent Management Platform (CMP)

Upon first access to the StreamWay+ Platform, the Data Subject is shown a consent banner that allows them to:

• Accept all cookies (technical, analytics, profiling, Partner cookies);
• Reject all non-technical cookies with the same ease as accepting them (the “Reject” button is placed at equal prominence to the “Accept” button);
• Manage preferences by category (analytics, preferences, profiling, Partner cookies) and by individual third parties, via the "Manage preferences" button, with no pre-ticked boxes for non-technical categories.

No non-strictly necessary cookie is installed before the Data Subject has expressed their choice.

The Data Subject may modify their preferences at any time via:

• The "Manage Cookies" link in the Platform footer (web);
• The "Privacy and Cookies" section of the Personal Area (for registered users);
• The Cookie Settings of the mobile app or CTV application, in equivalent and unobstructed ways.

Rejection is as easy as acceptance. The Data Subject’s choice is stored for 12 months, after which a new expression of consent will be requested.

Art. 5 — Dynamic List of Cookies/SDKs and Third Parties

The Platform makes available a dynamic and updated list of cookies/SDKs used, indicating for each: domain or provider, purpose, duration, legal basis, any extra-EU transfer, and link to the third party’s notice. The list covers web, mobile apps and CTV applications and is accessible via the “Manage Cookies” panel, continuously updated in the event of changes. The static tables in Art. 3 are provided for illustrative purposes only and are subject to periodic update.

Art. 6 — Extra-EU Data Transfers

Where the use of cookies/SDKs involves transfers to countries outside the EU/EEA, such transfers take place in compliance with Chapter V GDPR, as described in the Privacy Policy.

Art. 7 — Cookie Retention

Session cookies are deleted when the browser/app is closed. Persistent cookies have varying durations as indicated in the dynamic list. Consent preferences are stored for 12 months, after which a new expression of consent will be requested.

Art. 8 — Withdrawal of Consent

The User may at any time withdraw or modify their consent via the "Cookie Settings" panel, accessible from the website footer (“Manage Cookies” link), from the “Privacy and Cookies” section of the Personal Area, and from the app/CTV settings. Withdrawal does not affect the lawfulness of processing based on consent given prior to withdrawal. Modification or withdrawal of consent takes effect immediately for cookies not yet installed; cookies already stored on the device may be removed via the procedures described in Art. 9.

Art. 9 — Managing Cookies via Browser

Regardless of preferences expressed in the consent panel, the Data Subject may also manage cookies through their browser settings. Please note that disabling first-party technical cookies may compromise essential Service functionalities (login, Content playback, purchases).

Art. 10 — Deleting Cookies

Cookies already stored may be deleted via the browser settings (“History” or “Browsing data” section) or via the StreamWay+ cookie management panel ("Delete all non-necessary cookies" button).

Art. 11 — Cookies and Data Security

HiWay Media’s use of cookies complies with applicable law. Data collected via cookies is stored in electronic archives protected by adequate security measures to prevent data loss, unauthorised access, and unauthorised disclosure. Data collected via cookies is processed exclusively by personnel authorised by HiWay Media and by the data processors appointed pursuant to Art. 28 GDPR. The technical and organisational security measures adopted in relation to processing carried out via cookies are described in detail in the Privacy Policy.

Art. 12 — Amendments to the Cookie Policy

HiWay Media reserves the right to update this Cookie Policy as a result of: (i) regulatory changes; (ii) implementation of new tracking tools; (iii) changes to the purposes of use of existing cookies. Updates are published in this section of the Platform. Changes involving the use of new non-technical cookies require a new expression of consent from the Data Subject. The effective date of each version is always indicated on the Platform.

Art. 13 — Contact and Complaints

For questions or requests relating to this Cookie Policy or the processing of data via cookies:

HiWay Media S.r.l. E-mail: [PRIVACY EMAIL] PEC: [HIWAY MEDIA PEC] Postal address: [FULL ADDRESS]

For complaints regarding the use of cookies, the Data Subject may contact the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): www.garanteprivacy.it

[CITY], [DATE] HiWay Media S.r.l.