Information Notice on the Processing of Personal Data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

This Privacy Policy describes how Hiway Media S.r.l., acting as Data Controller, collects and processes the personal data of users (the “Data Subjects”) who register for and use the StreamWay+ platform.

Data Controllership Structure

• Hiway Media S.r.l. acts as Data Controller for all processing activities necessary to provide the Platform Services (account management, billing, security, fraud prevention, customer support, and technical analytics).
• For specific joint purposes (e.g., cross-catalog recommendations, unified audience segmentation, joint co-marketing campaigns), Hiway Media and its Partners may act as joint controllers pursuant to Article 26 GDPR. The essential content of such arrangements is described in Section 11.
• Partners access Data Subjects’ data relating only to their own Channels solely for service provision, acting as Data Processors under written agreements pursuant to Article 28 GDPR. Partners do not have access to the Platform’s full database.
• StreamWay+ users are customers of Hiway Media and not of individual Partner Channels.

1. Data Controller

Hiway Media S.r.l.

Registered office: [FULL ADDRESS]

VAT No.: [NUMBER]

Tel.: [NUMBER]

Email: [EMAIL]

Certified Email (PEC): [PEC]

Website: [URL]

For privacy-related communications: [PRIVACY EMAIL] or PEC [HIWAY MEDIA PEC]

[Data Protection Officer (DPO): to be appointed where required under Article 37 GDPR. If appointed: Name/Reference, Contact: [DPO EMAIL]]

2. Categories of Personal Data Processed

2.1 Browsing Data

IT systems automatically collect data such as IP addresses, device and browser information, requested resource URIs, timestamps, session duration, and server response codes. These data are used for statistical purposes, IT security, and to ascertain liability in case of unlawful activities.

2.2 Registration and Account Data

First name, last name, date of birth, email address, and encrypted password. These are necessary to access the Service.

2.3 Payment Data for Paid Packages

Tax identification number (where required for invoicing); payment data are processed exclusively by the Payment Service Provider ([PSP NAME]), acting as Data Processor under Article 28 GDPR. Hiway Media does not access or store credit card or payment account details.

2.4 Usage and Interaction Data

Viewing history per Channel, duration of use, viewing preferences, interface interactions, player events, and technical device logs. These are processed for service delivery, content personalization, and—subject to consent—for profiling and marketing purposes.

2.5 Geolocation Data (IP-based)

IP address is used to:

(i) enforce geographic licensing restrictions;

(ii) comply with tax obligations (VAT on digital services and Digital Services Tax).

2.6 Customer Support Data

Email address, request descriptions, attachments, and information provided through support channels.

2.7 Consent Records

Records of consent preferences (marketing, profiling, cookies), including timestamps, stored for accountability purposes under Article 5(2) GDPR.

3. Purposes and Legal Bases of Processing

Note: Consent for marketing purposes is optional, separate for each purpose and each Partner, and may be withdrawn at any time without affecting service provision.

4. Nature of Data Provision

Providing data under Sections 2.2 and 2.3 is mandatory for account creation and purchases; failure to provide such data prevents registration or transactions.

Providing data for profiling and marketing (purposes J, K, L) is optional and does not affect service use.

5. Data Recipients

5.1 Data Processors (Art. 28 GDPR)

Partners/Channels: access only their Channel data for service provision

Payment Service Provider ([PSP NAME])

Cloud infrastructure and CDN providers ([PROVIDER NAME])

CRM and customer support providers ([PROVIDER NAME])

Other appointed processors

5.2 Joint Controllers (Art. 26 GDPR)

Partners acting as joint controllers for shared purposes are listed in the Platform’s “Joint Controllership” section. Hiway Media acts as the single point of contact.

5.3 Public Authorities

Judicial authorities, law enforcement, tax authorities, Data Protection Authority, and communications regulators.

5.4 Partners for Marketing (with consent)

Upon consent, user contact data (email) may be shared with specific Partners for promotional communications.

6. International Data Transfers

Some Data Processors may operate outside the EU. Transfers comply with Chapter V GDPR (Articles 45–46).

7. Data Retention Periods

• Account data: until account deletion + 10 years
• Billing data: 10 years
• Usage data: duration of contract, then anonymized
• Support data: closure + 3 years
• Security logs: 6–24 months
• Technical analytics: deleted after aggregation
• Legal defense: until limitation periods expire
• Profiling data: duration of contract, then anonymized
• Marketing data: until consent withdrawal (max review every 24 months)

8. Processing Methods and Security Measures

Data are processed using electronic systems with appropriate technical and organizational safeguards under Article 32 GDPR, including:

• Access control and environment segregation
• Pseudonymization where applicable
• Security logging and monitoring
• Encryption (in transit and at rest)
• Incident response procedures
• Vulnerability management and penetration testing

9. Data Subject Rights

Under Articles 15–22 GDPR, Data Subjects have the right to:

• Access their data
• Rectify inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing (including profiling and direct marketing)
• Withdraw consent at any time
• Lodge a complaint with the Data Protection Authority

Requests can be sent to: [PRIVACY EMAIL] or PEC [HIWAY MEDIA PEC].

Hiway Media responds within 30 days (extendable by 60 days if necessary).

10. Automated Decision-Making and Profiling

StreamWay+ uses recommendation systems based on usage data to suggest content. This constitutes profiling under Article 4(4) GDPR but does not produce legal or similarly significant effects.

Users may object at any time via account settings or by contacting [PRIVACY EMAIL].

11. Joint Controllership (Art. 26 GDPR)

For shared purposes:

• Hiway Media manages consent collection and data subject rights
• Partners process data only for agreed purposes
• Hiway Media acts as the single contact point
• Data breaches are jointly managed and notified in compliance with Articles 33–34 GDPR

The list of joint controllers and full agreements are available upon request.

12. Minors

The Service is accessible to users aged 14 and above. Users under 14 require parental consent.

Paid purchases are restricted to users aged 18+.

Data collected for parental controls are not used for marketing and are deleted when no longer necessary.

13. Updates to this Policy

This Privacy Policy may be updated due to legal or operational changes. Users will be notified by email at least 30 days in advance. Where required, new consent will be requested.

[CITY], [DATE]

Hiway Media S.r.l.