Cookie Policy

The data controller for personal data processing is:

Atlas Carbon Neutral Solutions S.r.l. — Benefit Corporation Registered office: Via Giuseppe Pecchio 1, 20131 Milan (MI), Italy VAT / Tax ID: IT14003650968 REA: MI - 2755833 Certified email (PEC): atlas.carbon@pec.it Privacy email: privacy@atlascarbonneutral.com

Cookies are small text files that websites send to the user's device (computer, tablet, smartphone), where they are stored and retransmitted to the same sites on subsequent visits.

In addition to HTTP cookies, this site also uses the browser's localStorage, a technology that allows data to be stored locally in the user's browser. Under Article 122 of Italian Legislative Decree 196/2003, the provisions on cookies apply to "any information stored on the user's terminal equipment", including localStorage.

This site does not use profiling or marketing cookies, tracking pixels, or fingerprinting technologies.

The following cookies are necessary for the operation of the site and for recording consent. They do not require user consent under Article 122(1) of Italian Legislative Decree 196/2003, as they are strictly necessary for providing the service requested by the user.

The browsing language is determined solely by the URL prefix (/it/ or /en/) and is not stored in any cookie.

The following cookies and technologies are activated only after the user has given their consent via the cookie banner. They are used for aggregate, pseudonymised statistical analysis of browsing behaviour.

PostHog is our primary analytics tool. Data is stored within the European Union (AWS eu-central-1, Frankfurt, Germany) and is accessible via a first-party reverse proxy (t.atlascarbonneutral.com). PostHog acts as a data processor under Article 28 GDPR.

Google Analytics 4 (ID: G-NG7HJNWR0Z) is used as a supplementary analytics tool. Data is transferred to the United States — see Section 7 for details on the transfer.

PostHog also uses browser localStorage to persist analytics data. These entries are deleted when the user revokes consent via the "Manage cookies" button in the site footer.

The following third-party services are integrated into the site but do not install cookies on the user's device:

• Sentry (sentry.io) — technical error monitoring. Error data (including IP address and user-agent) is sent to Sentry's EU ingest server (de.sentry.io, Frankfurt) to ensure the proper functioning of the site. Sentry is classified as a strictly necessary tool and does not require consent.
• Google Fonts — fonts are served locally from the site's server (self-hosted via next/font). No requests are sent to Google servers.
• Sanity CMS — the content management system makes server-side API calls only. No cookies are installed in the user's browser.

The legal bases for data processing through cookies are as follows:

• Technical cookies (atlas_consent): Art. 6(1)(c) GDPR — legal obligation to record consent; Art. 122(1) of Italian Legislative Decree 196/2003 — exemption for strictly necessary cookies.
• Analytics cookies (PostHog, Google Analytics 4): Art. 6(1)(a) GDPR — free, specific, informed and unambiguous consent of the user. Activated exclusively after acceptance via the cookie banner.
• Sentry (error monitoring): Art. 6(1)(f) GDPR — legitimate interest of the controller in ensuring the security and proper functioning of the site.

Pursuant to Italian Data Protection Authority Guidelines n. 231/2021, legitimate interest is not an admissible legal basis for analytics cookies. For this reason, all analytics cookies are subject to explicit consent.

PostHog: no transfer outside the EU. All data is stored in AWS eu-central-1 (Frankfurt, Germany). PostHog Inc. acts as a data processor with a GDPR-compliant DPA under Article 28 GDPR.

Google Analytics 4: data is transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The legal basis for the transfer is the European Commission's Adequacy Decision of 10 July 2023 regarding the EU-U.S. Data Privacy Framework (DPF). Google LLC is certified in the DPF registry (dataprivacyframework.gov).

Note: the validity of the Data Privacy Framework may be subject to review by the Court of Justice of the European Union. In the event of invalidation, the controller undertakes to promptly update this policy and adopt alternative safeguards or suspend the transfer.

Sentry: error data is sent to the EU ingest server (de.sentry.io, Frankfurt). Sentry Inc. (USA) acts as a data processor with Standard Contractual Clauses (SCCs) pursuant to European Commission Decision 2021/914.

Cookies are retained for the duration indicated in the tables in Sections 3 and 4. Aggregate analytics data is retained in PostHog and Google Analytics for a maximum period of 14 months, in line with the default settings of these services.

The consent log (date and time of consent, version of the policy accepted) is retained for 5 years, in order to fulfil the obligation to demonstrate that consent was obtained under Article 7(1) GDPR.

Upon withdrawal of consent, analytics cookies and related localStorage entries are immediately deleted from the user's device.

Under Articles 15–22 of the GDPR, the user has the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of personal data
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): request the deletion of data ("right to be forgotten")
• Restriction (Art. 18): obtain the restriction of processing
• Data portability (Art. 20): receive data in a structured, commonly used and machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise their rights, the user may write to privacy@atlascarbonneutral.com. The controller will respond within 30 days of receiving the request (Art. 12(3) GDPR), a period which may be extended by a further 60 days in complex cases, with a reasoned communication.

The user also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), Piazza Venezia 11, 00186 Rome — www.garanteprivacy.it.

The user can manage their cookie preferences at any time through:

• The "Manage cookies" button in the site footer: this reopens the consent banner and allows the user to change their previous choice. Withdrawing consent results in the immediate deletion of all analytics cookies and localStorage data from the device.
• Browser settings: all major browsers allow you to view, block or delete cookies (Chrome: Settings > Privacy and Security > Cookies; Firefox: Settings > Privacy & Security; Safari: Preferences > Privacy; Edge: Settings > Cookies and Site Permissions).
• Direct Google Analytics opt-out: by installing the browser add-on available at tools.google.com/dlpage/gaoptout.

Technical cookies (atlas_consent) cannot be disabled via the banner, as they are necessary to record the consent choice. They can only be deleted through browser settings.

The controller reserves the right to update this Cookie Policy to comply with regulatory changes or changes in the technologies used. In the event of substantial changes to the purposes of processing, consent will be requested again via the cookie banner.

The date of the last update is indicated at the top of this page. Users are advised to consult this policy periodically.

For any questions regarding this Cookie Policy or to exercise the rights provided by the GDPR, the user may contact:

Atlas Carbon Neutral Solutions S.r.l. — Benefit Corporation Email: privacy@atlascarbonneutral.com PEC: atlas.carbon@pec.it

Regulatory references: • EU Regulation 2016/679 (GDPR) • Italian Legislative Decree 30 June 2003, n. 196 (Privacy Code), as amended by Legislative Decree 101/2018 • Italian Data Protection Authority Guidelines n. 231 of 10 June 2021 ("Guidelines on cookies and other tracking technologies") • Directive 2002/58/EC (ePrivacy), as amended by Directive 2009/136/EC • European Commission Adequacy Decision of 10 July 2023 (EU-U.S. Data Privacy Framework)