Terms and conditions of the service

1. Identification of the service provider

1.1. Service provider

This website and the related digital services accessible via the domain www.royalprotocol.net (hereinafter, the "Platform") are provided and operated by:

THE ROYAL PROTOCOL S.R.L. IMPRESA SOCIALE, registered office at Via E. de Nicola 171, postal code 55041, Italy, Economic and Administrative Index (REA): LU – 27301, VAT number: 02758190462, subscribed and paid-up share capital: € 1,000.00, e-mail address: info@royalprotocol.net, certified e-mail (PEC): theroyalprotocol@pec.it.

(hereinafter, also the "Company" or the "Provider").

1.2. Contacts and communications

For any communication relating to these Terms and Conditions, use of the Platform or exercise of the User's rights, the Company may be contacted using the contact details above or through the contact form on the website in the "Contacts" section.

1.3. Nature of the service

The Platform provides digital services consisting of:

• historical-documentary research activities at the user's request;
• processing and delivery of historical-documentary reports, without certification or attestation value;
• digital archiving (including on blockchain infrastructure) of historical-documentary content;
• delivery of digital summary documents of documentary and historical data without certification or legal value, including in the form of non-fungible tokens (NFTs) for personal, collecting or preservation purposes.

The Service shall be understood as the collection, organisation, preservation and provision of documents and information of a historical-documentary nature, comparable to a digital archive or an advanced documentary library. Any processing or representations carried out by the Company are purely descriptive in nature and do not involve verification, legal verification or attribution of identity, status or rights.

The documents produced do not constitute, nor are they intended to constitute, attestations of personal identity, civil status, legally relevant family affiliation or entitlement to rights or status.

The Company is not a public body, does not perform notarial, certification or state authority functions, and does not confer, recognise or validate noble titles, honours or legal status of any kind.

2. Subject matter and scope of the Terms

2.1. Subject matter of the Terms

These Terms and Conditions (hereinafter, the "Terms") govern access, registration, browsing and use by the user (hereinafter, "User" or "Client") of the Platform and the related Services offered by the Company, as described in Section 1.3.

The Services include, by way of example and without limitation:

• receipt and management of requests for historical research;
• collection, analysis, processing and return of historical data, including through access to public or archival sources;
• management of digital historical documents with informative and documentary content;
• possible anchoring of historical data to decentralised infrastructures (blockchain);
• issuance of NFTs representing historical-documentary data, for exclusively informative content.

2.2. Acceptance of the Terms

Use of the Platform by the User constitutes full and unconditional acceptance of these Terms. The User declares that they have read, understood and fully accepted the Terms before accessing or using the Services. If the User does not accept the Terms, they must not access or use the Platform.

2.3. Updates and changes

The Company reserves the right to amend, update or supplement these Terms at any time, including to comply with legal requirements, technological developments, updates to the Services or organisational needs.

Changes will be notified to Users by publication on the Platform or by direct communication to registered Users (by e-mail or other channel indicated at registration). Changes shall take effect 15 (fifteen) days after the date of communication or publication, unless a different period is required by applicable law.

Continued use of the Platform after amendment of the Terms constitutes tacit acceptance of the amended Terms.

2.4. Language

The version of the Terms drawn up in Italian is the authentic and prevailing version for Users resident or domiciled in Italy or for contracts concluded with TheRoyalProtocol S.r.l. Where a translated version in another language is made available, it is provided solely for courtesy or non-binding understanding purposes.

2.5. Territorial scope

The Platform is accessible internationally; however, the Company operates under the jurisdiction of the Italian Republic and applies Italian law to contractual relationships, unless otherwise required by mandatory provisions of law. Users must ensure that use of the Platform complies with the laws of their country of residence or citizenship, and hold the Company harmless from any liability for uses contrary to local regulations.

3. Definitions

For the purposes of these Terms, the following terms shall have the meanings set out below, in the singular or plural:

"Platform": the website accessible at www.royalprotocol.net, including all its pages, sub-domains, content and digital features, including any integrated systems for managing NFTs, blockchain and related services.

"Services": the set of services provided by the Company through the Platform, as described in Section 1.3 and further detailed in Section 4, including genealogical research activities, creation of digital documents, publication on a decentralised register, delivery of digital content (e.g. NFTs), as well as ancillary or accessory services.

"User" or "Client": any natural or legal person who accesses the Platform, browses it, uses its features or subscribes to one or more Services offered by the Company.

"Content": any data, information, document, image, text, graphic or multimedia content, including civil records, insignia, historical archives, family trees or other materials uploaded, transmitted, displayed or generated by the User or the Company through the Platform.

"Digital Document": the documentary output, in electronic format, delivered by the Company following research activities, which is limited to reporting, organising and making available, for informational purposes, historical data and documentary references resulting from historical sources or documentation provided by the User, without attestation, certification or legal proof value.

"NFT": a non-fungible token issued on a blockchain infrastructure that digitally represents, in synthetic form, the link to a set of historical data with documentary content, without any express or implied legal validation, certification or attribution of status.

"Blockchain": a decentralised and immutable infrastructure, composed of distributed nodes, on which data may be recorded in a non-modifiable manner, and on which some of the Services provided are based (e.g. issuance and storage of NFTs).

"Contract": the legally binding agreement between the User and the Company, which is perfected by acceptance of these Terms, including any annexes, privacy notices or specific economic conditions accepted when subscribing to the service.

"Consumer": within the meaning of Article 3(1)(a) of Italian Legislative Decree no. 206/2005 (Consumer Code), a natural person acting for purposes outside any entrepreneurial, commercial, craft or professional activity they may carry out.

"Party" or "Parties": individually the Company or the User, and jointly both.

"Noble titles": historical designations such as prince, duke, marquis, count, baron, etc., no longer legally recognised by the Italian Republic under the Fourteenth Transitional and Final Provision of the Constitution, whose use in the Platform Services is limited to historical, cultural and documentary purposes.

4. Description of the Services

4.1. Types of Services

The Platform provides Users with a range of digital Services of a documentary, historical and informative nature, which include – by way of example and without limitation – the following activities:

• Historical research on names and families: archival, historical-documentary and bibliographic research aimed at organising data on families or individuals, through analysis of civil, parish, notarial or historical sources, also in collaboration with professionals or third-party associations/entities;
• Documentary processing and genealogical analysis: processing and delivery, at the end of the research activity, of documentary reports containing data, sources and graphic representations (e.g. family tree, coats of arms, lines of descent), with archival references where available;
• Delivery of digital content (NFTs): at the User's express request, issuance of an NFT anchored on a public or authorised blockchain, representative of the archived data, containing in synthetic form the salient data resulting from the research;
• Digital archiving on decentralised infrastructures: immutable recording, in whole or in part, of documentary results on a public blockchain network, by recording cryptographic hashes or other compatible technical methods, in order to ensure integrity, traceability and non-modifiability of genealogical data;
• Creation and maintenance of the digital archive: possible updating over time of historical data in the event of new discoveries or documented changes, and support to the User in preserving and managing their digital profile through advanced tools (e.g. smart contract, family wallet, multigenerational access).

4.2. Historical, cultural and private purpose of the service

All Services offered by the Company are strictly documentary, informative, historical and cultural in nature. Digital content delivered through the Platform does not constitute, nor is it intended to constitute, legal titles, official recognitions, or instruments with public value under Italian or foreign law.

The Services are intended exclusively for:

• private historical study and research;
• enhancement of data relating to families;
• digital preservation of the historical memory of houses and lineages.

Such documents are not intended to be used as legal proof of identity, civil status, family affiliation or rights, whether vis-à-vis third parties or before public authorities.

4.3. Exclusion of public certification functions

The Company is not a heraldic, notarial, civil status or nobiliary law authority. It is not authorised to confer, attribute or certify noble titles, predicates, coats of arms or honours with legal value, nor to perform acts substituting or supplementing those of the competent authorities in individual States. In accordance with the Fourteenth Transitional and Final Provision of the Constitution of the Italian Republic, it is specified that noble titles are not recognised by the Italian State, and that the Company's Services do not imply, presuppose or produce any legal effect connected with the formal recognition of titles of nobility, heraldic coats of arms or chivalric qualities. The Company does not perform certification, attestation or verification activities with legal effects, nor does it issue documents enjoying privileged faith or suitable to produce effects towards third parties.

4.4. Operational limits of the service

The Company does not guarantee recovery of genealogical documentation or the existence of titles attributable to the family subject to the User's request. The outcome of research depends exclusively on the availability, accessibility and quality of existing historical sources. Where it is not possible to complete the genealogical reconstruction, or where it proves inconclusive, a report will nevertheless be issued with the results obtained up to that point, unless otherwise agreed in writing.

4.5. Use of blockchain and limits of modifiability

Data recorded on the blockchain (e.g. document hashes, synthetic content, NFTs) are by nature immutable and permanent. The User acknowledges that once recorded, such data cannot be deleted or modified by the Company or by other subjects. Before proceeding with publication or issuance of NFTs, the Company will provide the User with appropriate information and will collect explicit consent to the use of blockchain technology for the data in question.

5. Access to the Services and User registration

5.1. Access requirements

To access the Services offered through the Platform, the User must:

• be an adult natural person with legal capacity under applicable law;
• use the Service on a personal basis or, if acting on behalf of a legal person or a family, hold the necessary authorisations or powers of attorney;
• fully accept these Terms and any further conditions or notices indicated at the time of use or subscription to the Service.

5.2. Account registration

Access to certain Platform features, including requesting paid Services, requires the User to create a personal account. When registering, the User must:

• provide truthful, complete and up-to-date data;
• keep access credentials confidential and store them securely;
• not assign or allow use of the account to third parties, unless with the Company's written authorisation.

The User is responsible for all activities carried out through their account, except in the case of fraudulent use independent of their will and outside their control. The Company reserves the right to suspend or close accounts in the event of unlawful, fraudulent use or use contrary to the Terms.

5.3. Identity verification

To access certain Services (in particular those involving generation of NFTs or publication on blockchain), the Company may require the User to provide additional identification documentation, including preliminary declarations or declarations made under their own responsibility. The Company reserves the right to refuse registration or continuation of the service where, on the basis of objective and verifiable elements, it considers that the data provided and/or available are insufficient and/or untrue.

5.4. User obligations

The User undertakes to use the Platform and the Services exclusively for lawful purposes and in compliance with applicable law and these Terms. In particular, the User undertakes to:

• not upload, provide or transmit false, defamatory content or content infringing the rights of others or third parties (e.g. copyright, image rights, family honour, privacy);
• not request storage of data and/or documents that are manipulated or historically unfounded;
• not use the Service for fraudulent purposes or to simulate status, honours or noble or chivalric affiliations;
• ensure that every document, image, coat of arms or information provided is free of third-party encumbrances or accompanied by the necessary authorisations or licences, assuming full liability in the event of disputes.

5.5. Liability for third-party data

Where the User provides the Company with personal data relating to third parties (e.g. living relatives included in the genealogy), they declare and warrant that: they have informed such subjects of the processing of data as required by EU Regulation 2016/679 (GDPR) and have obtained, where necessary, their written consent or another appropriate legal basis for processing by the Company, and shall hold the Company harmless from any liability in the event of disputes.

5.6. Suspension and revocation

The Company reserves the right to suspend or revoke the User's access to the Platform or to individual Services, even without prior notice, where:

• material breaches of these Terms are found;
• there are well-founded suspicions of abuse, fraud, misuse or provision of false data;
• this is required by a competent authority or imposed by law.

6. Fees, payments and invoicing

6.1. Paid services

Access to the Platform and viewing of general information content is free of charge, unless otherwise indicated. Certain Services provided by the Company – including, by way of example, customised genealogical research, processing of digital documents, issuance of NFTs, publication on blockchain or archival consulting – are subject to payment of a fee by the User, as indicated in the relevant information sheet or contractual offer.

6.2. Estimates and customised orders

In the case of customised Services, the Company will provide the User with a detailed cost estimate before starting activities. The contract shall be deemed perfected upon the User's express acceptance of the estimate (also by e-mail or by validating an online order), with a concurrent obligation to pay in accordance with the agreed methods.

6.3. Prices and currencies

All prices indicated on the Site or in estimates are expressed in euros and are understood to include VAT where applicable, unless otherwise stated. In the case of cross-border transactions, conversions into foreign currency will be carried out at the rate applied by the provider of the payment method used by the User, who remains solely responsible for any exchange costs or bank charges.

6.4. Payment methods

Payments may be made through the channels enabled on the Platform (e.g. credit/debit card, bank transfer or other instruments eventually accepted). Payment is an essential condition for commencement of performance, unless otherwise agreed.

6.5. Invoicing

Following purchase of paid Services, the Company will issue an electronic invoice to the User based on the data provided at order or registration. The User must provide accurate and up-to-date tax data. The Company shall not be liable for delays, omissions or irregularities resulting from inaccurate or incomplete information transmitted by the User.

6.6. Non-performance and late payment

In the event of late payment for Services already confirmed or commenced, the Company reserves the right to: suspend performance of the Service until payment is regularised; charge statutory default interest where applicable under Article 5 of Legislative Decree no. 231/2002 (if applicable); terminate the contract for breach, retaining sums already paid by way of penalty, where justified.

6.7. Customised services and waiver of withdrawal

Within the meaning of Legislative Decree no. 206/2005 ("Consumer Code"), the User acknowledges and accepts that:

• the Services provided by the Company are customised and tailor-made, being based on specific archival research and data provided by the User and/or requested by a User in relation to specific families or persons;
• if the User requests withdrawal during performance of the Service, they must pay an amount proportional to the activities already carried out up to the time of any exercise of withdrawal.

The User will be expressly informed of this derogation at the time of order confirmation and must give explicit consent to immediate performance of the service and to waiver of the right of withdrawal, as a condition for the Company to start the activity.

7. Obligations, warranties and liability of the parties

7.1. Company's obligations

The Company undertakes to:

• provide the Services professionally, diligently and in accordance with commonly adopted methodological practices for similar services;
• provide, where possible, supporting documentation and archival references for the results obtained;
• process Users' personal data in compliance with applicable data protection law, in particular Regulation (EU) 2016/679 (GDPR);
• keep the Platform active, secure and accessible, save for events of force majeure, technical updates or scheduled maintenance.

7.2. Limitations of warranty

In light of these service conditions, the Company does not provide warranties regarding:

• certainty of finding historical data or documents or information relating to a particular family;
• absolute accuracy or completeness of data derived from third-party sources (e.g. civil, ecclesiastical, bibliographic archives), which may contain discrepancies, gaps or material errors;
• official recognition by public authorities, chivalric orders, private entities or external institutions of digital documents or NFTs issued through the Platform;
• historical assessments of documents by third parties, public or private.

All content provided has exclusively historical-documentary and informative value, and does not constitute civil status records, official acts or legally relevant recognitions.

7.3. Exclusion of liability

Save for wilful misconduct or gross negligence, the Company shall not be liable for:

• direct, indirect, incidental, consequential or punitive damages arising from use, non-use or reliance on the Services as a source of rights, status or legal effects;
• any erroneous interpretations, improper use or undue disclosure of certificates or historical data by the User or third parties;
• disputes between the User and third parties regarding asserted or contested status;
• malfunctions, data loss, security breaches or unavailability deriving from third-party technological infrastructures (e.g. public blockchains, wallets, hosting services) not directly controlled by the Company.

7.4. Limitation of the amount recoverable

In any case, unless prohibited by law, the Company's aggregate liability to the User, for any cause, shall not exceed the amount actually paid by the User to the Company for the specific Service that gave rise to the claim or dispute.

7.5. User obligations and liability

The User undertakes to:

• use the Services in compliance with these Terms and applicable law;
• not falsify, alter or simulate historical data, titles or documents transmitted;
• not request issuance of NFTs for misleading, commercial or reputational purposes contrary to the truth;
• indemnify and hold the Company harmless from any claim, damage, liability, expense or cost (including legal fees) arising from violations, false statements, uploading of unlawful content or content infringing third parties.

7.6. Force majeure

Neither Party shall be liable for delays, non-performance or interruptions in the execution of obligations arising from these Terms if caused by force majeure events, including by way of example natural disasters, governmental acts, strikes, pandemics, power outages, cyber attacks, unavailability of blockchain infrastructures or other events beyond the reasonable control of the Parties.

7.7. No reliance

The User expressly acknowledges that content provided by the Company does not constitute legal advice, certification or legal proof, and undertakes not to rely on it as a basis for claims to rights, status or personal qualifications.

8. Intellectual property rights

8.1. Company's rights

All content present or made available on the Platform – including, by way of example but not limitation, texts, images, logos, trademarks, graphics, user interfaces, layouts, software, codes, databases, certification models and technical-methodological documentation – is the exclusive property of TheRoyalProtocol S.r.l. or legitimately used by it under licences.

Such content is protected under Italian, EU and international rules on copyright, industrial property, registered trademarks, distinctive signs, databases and know-how.

Unless otherwise authorised in writing by the Company, the User is expressly prohibited from:

• copying, reproducing, publishing, transmitting, selling, distributing or modifying in whole or in part the Platform content;
• decoding, decompiling or tampering with the source code or software architectures used by the Platform;
• using the Company's trademarks, logos or other distinctive signs for commercial, promotional or otherwise unauthorised purposes.

8.2. Rights in content generated for the User

Digital Documents, historical reports, graphics and customised content produced by the Company at the User's request remain owned by the Company, which grants the User a personal, non-exclusive, non-transferable licence for an unlimited period, for private, cultural or historical preservation purposes. Any request for public, commercial, editorial use or for publication in third-party works must be previously authorised in writing by the Company.

8.3. Content provided by the User

The User retains ownership of original content uploaded or transmitted to the Company (historical documents, images of coats of arms, family trees, texts, photographs, etc.), and expressly declares that they:

• are the full and legitimate owner of the related rights, or
• have obtained consent to use from the entitled parties, where required by law.

In relation to such content, the User grants the Company a limited, non-exclusive licence, revocable within the limits of applicable law, strictly necessary for provision of the Services.

It is understood that the Company retains the right to independently carry out study, research, analysis, processing and publication on topics, families, documents, sources or historical contexts analogous or connected to those subject to the Services requested by the User, provided this is based on its own processing or legitimately usable sources and in compliance with applicable law.

8.4. NFTs

NFTs generated by the Company on behalf of the User may contain visual, textual or symbolic summaries derived from documentary processing, and are anchored on a public or private blockchain in an immutable manner. The NFT is owned by the User according to the technical rules of the blockchain (e.g. possession of the private key/wallet) and the issuance conditions defined at delivery. The Company retains all moral and economic rights in the graphic, technical and IT elements of its own creation that make up the Digital Document, unless otherwise agreed. The User may not use the NFT for misleading, commercial or simulated purposes, nor claim, on its basis, a legal, noble or personal qualification status, even where historical data may relate to such statuses. The NFT functions exclusively as digital representation and access to documentary content and does not constitute a means of identification, certification or attribution of personal qualities.

8.5. Infringements

In the event of infringement of these rights by the User or third parties, the Company reserves all legal remedies to protect its rights and interests. The User undertakes to compensate for any direct or indirect damage arising from unlawful, unauthorised or infringing use of protected Platform content or content provided.

9. Privacy and processing of personal data

9.1. Data controller

The controller of personal data is:

The Royal Protocol S.r.l. impresa sociale Registered office: Via E. de Nicola 171, postal code 55041, Italy Email: info@royalprotocol.net PEC: theroyalprotocol@pec.it.

(within the meaning of Articles 4(7) and 13 GDPR)

9.2. Purposes of processing

The Company collects and processes the User's personal data for the following purposes:

• provision of documentary Services requested through the Platform;
• management of registration and the user account;
• management of payments, invoicing and related tax compliance;
• contractual communications and technical support;
• archiving, processing and, where requested, anchoring of historical data to blockchain infrastructures;
• compliance with legal obligations or requests from competent authorities;
• subject to express consent, sending newsletters, informational updates or promotional communications.

9.3. Types of data processed

Depending on the Services requested, the Company may process the following categories of data:

• identification and contact data (name, surname, date and place of birth, residence, email, telephone);
• tax and payment data (tax code, VAT number, IBAN, billing address);
• genealogical and historical data relating to persons, also inferred from historical or archival documentation;
• data possibly belonging to special categories under Article 9 GDPR, such as: religious data (e.g. baptism, denominational affiliation inferable from parish registers); health data (e.g. cause of death from certificates); political or ethnic data (if present in historical documents);
• technical usage data of the Platform and cookies (as described in the Cookie Policy).

9.4. Legal basis of processing

Processing is lawful under Article 6 and, where applicable, Article 9 GDPR. In particular:

9.5. Data relating to third parties

When submitting historical data, the User may provide information relating to third parties (e.g. family members or other persons). The User undertakes to: ensure lawfulness of processing in relation to such data; provide, where necessary, information to the data subjects concerned; obtain consent where required; hold the Company harmless from liability connected with unlawful processing of such data.

9.6. Retention of data

Data will be retained:

• for the time necessary to provide the requested Service and for a further 10 years for civil, tax and documentary purposes, unless erasure is requested;
• for historical data, compatibly with consent given and the nature of historical archiving, without time limits, including on non-modifiable blockchain infrastructures, subject to the safeguards described in Article 17 GDPR.

9.7. Transfers outside the EU

Data may be transferred outside the European Economic Area (EEA), in particular:

• through recording of data or hashes on public blockchains, whose nodes may be globally distributed;
• through use of IT or cloud service providers outside the EEA, selected on the basis of appropriate safeguards (e.g. adequacy decisions, SCCs or other technical measures).

9.8. User rights

The User, as data subject, may at any time exercise the rights recognised in Articles 15–22 GDPR, including:

• right of access to data;
• right to rectification;
• right to erasure ("right to be forgotten"), within the limits of Article 17(3) GDPR (e.g. exclusion for immutable historical data on blockchain);
• right to restriction and objection;
• right to data portability;
• right not to be subject to unjustified automated decision-making.

Requests may be submitted by e-mail or PEC to the Company contact details indicated above.

9.9. Right to lodge a complaint

The User has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they believe their rights or data protection rules have been violated.

9.10. Extended information

For further details on methods, purposes and tools of processing, as well as on the use of cookies and tracking technologies, reference is made to the Privacy Policy and Cookie Policy accessible at the foot of the Platform.

10. Applicable law, jurisdiction and final provisions

10.1. Applicable law

These Terms, as well as any contract concluded between the User and the Company for use of the Platform and related Services, are governed in all respects by Italian law, without prejudice to the application of any mandatory rules of the country of residence of the User where the User qualifies as a Consumer.

10.2. Jurisdiction

For any dispute relating to interpretation, performance, validity or effectiveness of these Terms:

• if the User qualifies as a Consumer, the courts of the place of residence or domicile of the User shall have exclusive jurisdiction, as provided for by the Consumer Code (Legislative Decree no. 206/2005);
• in all other cases (e.g. professional Users or entities), the courts of Milan, where the Company has its registered office, shall have exclusive jurisdiction, with express waiver of any other competing forum.

10.3. Partial invalidity

Should one or more clauses of these Terms be declared null, invalid or ineffective by a competent authority, the remaining provisions shall remain fully valid and effective. The Parties undertake to replace the invalid clause with a provision that, in compliance with the law, reproduces as faithfully as possible the content and original intent.

10.4. Waiver and tolerance

Any tolerance by the Company of User conduct in breach of these conditions does not constitute a waiver of rights arising from the breached provisions, nor of the right to require exact performance of all contractual obligations.

10.5. Assignment of the contract

The User may not assign the contract or rights and obligations derived therefrom, in whole or in part, to third parties without the Company's prior written consent. The Company reserves the right to assign the contract, in whole or in part, to controlling, controlled or affiliated companies, or to third parties in the context of extraordinary corporate transactions (e.g. transfer of a business unit, merger, acquisition), subject to information to the User.

10.6. Version and updates

These Terms are effective from 25 February 2026 and may be consulted at any time at www.royalprotocol.net/terms or any other URL eventually indicated. The Company reserves the right to amend the Terms periodically as provided in Section 2.3.

Privacy notice

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

This notice describes how TheRoyalProtocol S.r.l., as data controller, processes personal data through the website www.royalprotocol.net (hereinafter, the "Platform"), in connection with the documentary services offered to users (hereinafter, "Users" or "Data subjects").

1. Data controller

The Royal Protocol S.r.l. impresa sociale Registered office: Via E. de Nicola 171, postal code 55041, Italy Email: info@royalprotocol.net PEC: theroyalprotocol@pec.it.

For any request relating to this notice or the exercise of rights, the data subject may contact the Controller at the contact details above.

2. Types of data processed

The Controller may process the following categories of personal data:

a) Common data

• identification and contact data (name, surname, email, telephone number, postal address);
• payment data (IBAN, credit/debit card details);
• data provided during user profile registration or to access services;

b) Genealogical and historical data

• biographical and relational data relating to the data subject or their ancestors, including deceased persons, obtained from historical archives, public sources or private documents;

c) Special category data (Article 9 GDPR)

Depending on the service requested, data may be processed that reveal:

• religious affiliation (e.g. baptisms from ecclesiastical registers);
• health data (e.g. cause of death in public certificates);
• data potentially revealing racial or ethnic origin, political opinions or membership of protected categories.

3. Purposes and legal basis of processing

4. Methods of processing

Data are processed using manual and electronic tools, according to logics strictly related to the purposes above, in a lawful, fair, transparent and proportionate manner. Appropriate technical and organisational measures are adopted to ensure security, confidentiality, integrity and availability of data. In some circumstances, historical-documentary processing and archiving may also take place on blockchain infrastructures, whose content, once published, is immutable and distributed, as described in point 9 of the Terms of Service.

5. Provision of data

Provision of personal data is:

• mandatory for contractual and legal purposes (registration, invoicing, service provision);
• optional for marketing or promotional communications. Failure to consent for such purposes will not affect use of the Services.

6. Data concerning third parties

Where the data subject provides personal data of third parties (e.g. living relatives included in a genealogy), they declare that they:

• have obtained informed consent where required;
• have fulfilled information obligations towards such subjects;
• will hold the Controller harmless from any liability for unlawful processing of the data provided.

7. Retention of data

Data will be retained:

• for common data: for 10 years from termination of the contractual relationship, unless longer legal obligations apply;
• for family data: until withdrawal of consent, in compliance with the purpose of historical archiving, and in any case within the limits of Article 17 GDPR;
• for data published on blockchain: permanently and immutably, as a technical consequence of the distributed network.

8. Communication and disclosure

Data may be communicated to:

• professionals, genealogists, historians, external collaborators and consultants appointed by the Controller;
• third parties providing IT, hosting, blockchain and cloud computing services;
• judicial or administrative authorities, if required by law.

9. Processing on blockchain infrastructures

If the data subject subscribes to the NFT service or other tools based on blockchain technology:

• they acknowledge that certain genealogical data (or their cryptographic hashes) may be recorded on public or private blockchains;
• such recordings are immutable, irreversible and globally accessible, including by third parties, according to the protocol of the network adopted;
• the Company may offer technical tools for partial masking or pseudonymisation where requested, but cannot guarantee complete erasure of data once published on a blockchain.

The data subject will be informed and must provide explicit, separate consent before publication of data on a blockchain.

10. International transfers

Data may be transferred to countries outside the European Economic Area (EEA), in compliance with Articles 44 et seq. GDPR, in particular:

• as a result of use of blockchain infrastructures;
• through use of cloud services or extra-EEA technology providers.

In such cases, the Company will adopt appropriate safeguards (adequacy decisions, standard contractual clauses, encryption, minimisation).

11. Rights of the data subject

The data subject has the right at any time to:

• obtain confirmation of the existence of their personal data and access them (Art. 15 GDPR);
• request rectification (Art. 16 GDPR);
• request erasure, where possible (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• object to processing (Art. 21 GDPR);
• receive data in a structured, commonly used format (Art. 20 GDPR);
• not be subject to a decision based solely on automated processing (Art. 22 GDPR);
• withdraw consent given, without affecting the lawfulness of processing based on consent before withdrawal;
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Requests may be exercised by written communication to the contact details indicated in point 1.

12. Changes to this notice

This notice may be amended or updated at any time, effective from the date of publication on the site. Any material changes will be communicated to the data subject by e-mail or other appropriate channels.

Cookie Policy

(Pursuant to Regulation (EU) 2016/679 and the Italian Data Protection Authority provision no. 231/2021)

This Cookie Policy provides detailed information on the use of cookies and similar technologies by the site www.royalprotocol.net ("Platform") and on the User's rights in relation to management of such tools.

1. Data controller

The data controller is:

The Royal Protocol S.r.l. impresa sociale Registered office: Via E. de Nicola 171, postal code 55041, Italy Email: info@royalprotocol.net PEC: theroyalprotocol@pec.it.

For further information on processing of personal data, please refer to the Privacy Notice.

2. What cookies are

Cookies are text strings that websites visited send to the User's terminal (usually the browser), where they are stored to be re-transmitted to the same sites on subsequent visits. Cookies allow the site to recognise the User's device and improve the browsing experience.

3. Types of cookies used

The Platform uses the following categories of cookies:

a) Technical (necessary) cookies

These are required to allow the site to function correctly and to use the content and services requested by the User. They do not require consent.

Examples: account authentication; session management; language preferences; site security.

Legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR).

b) Analytical (statistical) cookies

These collect information in aggregate and anonymous form on the number of users and how they visit the site, in order to improve content and performance. They are treated like technical cookies only if anonymised.

Examples: Google Analytics (with IP anonymisation); Matomo (self-hosted, without cross-site tracking).

Legal basis: if anonymised, legitimate interest (Art. 6(1)(f) GDPR); if identifiable, User consent (Art. 6(1)(a) GDPR).

c) Profiling (marketing) cookies

These track browsing to create personalised profiles and display advertising consistent with preferences. They may be first- or third-party (e.g. social networks, ad networks).

Examples: Facebook Pixel; Google Ads; LinkedIn Insight Tag.

Legal basis: explicit User consent (Art. 6(1)(a) GDPR).

4. Up-to-date list of cookies

An up-to-date and detailed list of cookies used, including name, originating domain, duration, purpose and third party (if applicable), is available through the cookie preference management panel accessible from the initial banner or by clicking "Cookie settings" in the site footer.

5. Management and withdrawal of consent

On first access to the Platform, a cookie consent banner compliant with the Italian Data Protection Authority guidelines is displayed. The User may:

• accept all cookies;
• reject all non-technical cookies;
• customise preferences for each category.

Consent may be changed or withdrawn at any time by accessing the management panel linked from the footer.

Cookies can also be managed through browser settings. Links to guides for the main browsers: Google Chrome, Mozilla Firefox, Safari, Microsoft Edge.

Warning: disabling technical cookies may affect correct operation of the Platform.

6. Transfers of data to third parties

Some cookies may involve transfer of data to third countries (outside the EU), for example through tools provided by Google, Meta or other platforms. In such cases, processing takes place in compliance with Articles 44 et seq. GDPR, and subject to consent being obtained.

7. Retention of cookies

Cookies are stored on the User's terminal for variable periods depending on their nature:

• session cookies: deleted when the browser is closed;
• persistent cookies: remain stored until the indicated expiry or manual deletion.

Specific durations are indicated in the cookie management panel.

8. Updates

This Cookie Policy may be amended. The latest version is always available in the dedicated section of the site. Users are invited to consult it periodically for any updates.