1. DATA CONTROLLER
The data controller is Energy Team S.p.A., with registered office in Corso Italia, 3 20122 Milano (MI) – Italy, VAT 11680670152, REA CCIAA Milano 1489629 (hereinafter “Data Controller”, “us” “our/s”), compliant to Article 13 of European Regulation no. 2016/679 on the protection of personal data (“Regulation“), informs you that your personal data will be processed for the purposes and in the ways described below.
2. PURPOSES AND LEGAL BASIS OF THE PROCESSING
In compliance with the Regulation, the purposes described below will be based on the principles of lawfulness, correctness, transparency, purpose limitation and storage, as well as minimization, accuracy, integrity and confidentiality of data.
2.1 MAIN PURPOSES
a. to execute a contract of which you are a party or to perform pre-contractual activities at your request (for example: to provide the requested service / product, to provide the relevant pre / post-sales customer service, including by e-mail / telephone, examine your curriculum vitae if it is sent via the “Work with us” section, as well as carry out all the related operational, administrative and management activities);
b. to fulfill legal obligations, regulations or national / community legislation, including, for example, the obligations under the orders of the judicial authority and other competent authorities;
c. to pursue our legitimate interests in protecting our rights, to assert or defend these rights in the competent offices (for example: judicial, arbitration, administrative), to protect our assets, prevent fraud, manage any extraordinary corporate transactions, as well as improve the services offered on the Site.
The provision of personal data for the purposes (a), (b) and (c) is mandatory in order to be able to conclude the contract with us, allow us to provide you with the requested service / product or respond to your requests, as well as to allow us to examine your curriculum vitae in the case of sending it through the “Work with us” section or being able to fulfill the legal obligations relating to the conclusion of the contract. In case of failure to provide personal data, the Data Controller will not be able to establish the contractual relationship with you, execute it and / or the aforementioned obligations or perform the activities described above.
2.2 ADDITIONAL PURPOSES
With your free and optional consent, the Data Controller also processes your personal data for the following additional purposes:
d. to send you commercial communications relating to the Controller’s products, services, events and promotions, including market research, statistical processing and qualitative surveys, via automated telephone calls and similar methods, such as e-mails, sms, mms, push notifications, as well as traditional methods such as paper mail and telephone calls with an operator (“marketing purposes”);
e. to communicate your personal data to other companies of the Data Controller’s corporate group and third-party companies operating in the following product sectors: energy, banking, financial, insurance, advertising, for sending commercial communications relating to products, services, events and promotions of said third-party companies, including market research, statistical processing and surveys, through automated telephone calls and similar methods, such as e-mail, sms, mms, push notifications, as well as traditional methods such as paper mail and telephone calls with an operator (“communication to third parties for marketing purposes “).
The provision of personal data for marketing purposes and communication to third parties for marketing purposes is optional. In case of failure to provide them, we will not be able to send you commercial communications and / or commercial communications, as well as communicate your personal data to the companies of the corporate group or third parties mentioned above, but there will be no negative consequence for you.
Anyways, in case of consent, you can revoke your consent at any time for marketing purposes and communication to third parties for marketing purposes and, with specific reference to marketing purposes, you can withdraw your consent for all means of communication or only some of these through the methods indicated below or those indicated in each communication.
If you already are one of our customers, or in any case have already used services from the Owner by communicating your e-mail in the context of the sale of a service or product, we will send you commercial communications by e-mail relating to the products and services of the Owner similar to those object of the sale of the service or product, based on our legitimate interest in carrying out said promotional activity. It is understood that, even in this case, you may object at any time to the sending of commercial communications using the methods indicated below or those indicated in each communication.
3. KINDS PROCESSED OF PERSONAL DATA
The Data Controller processes the following personal data by electronic means, including automated and manual processes according to procedures and logic functional to the purposes indicated above:
- data voluntarily provided by you such as your name, surname, e-mail, telephone number, data relating to your job position (these are the cases in which you communicate your personal data to, for example, register on the Site, request a service or product, register for the newsletter), as well as the data contained in your curriculum vitae in case of sending it through the “Work with us” section;
- navigation data acquired by the computer systems used to operate the Site whose transmission is implicit in the use of Internet communication protocols (this is information is not collected to be associated with identified interested parties but which by their very nature could, through processing and association with data held by third parties, allow users to be identified – this category of data includes IP addresses, browser type, operating system, domain name and addresses of sites from which the user accessed was or exited, information on the pages visited by users within the Site, access time, stay on the single page, analysis of the internal path and other parameters relating to the operating system and the user’s IT environment. These data are collected and used in an aggregate and anonymous manner for the sole purpose of improving the quality of the services offered on the Site, optimizing the functionality of the Site and prepare statistical information concerning the use of the Site);
The Data Controller does not process personal data belonging to particular categories of personal data (for example: health data) or personal data of individuals under the age of 18.
In case you provide us with third parties’ personal data, you will process personal data as an independent data controller and will have to do everything necessary to ensure that this communication and our subsequent use for the purposes indicated from time to time comply with the applicable reference legislation. (for example: before providing us with the personal data of third parties, you must obtain their prior informed consent, if required by applicable law). In any case, you undertake to indemnify the Data Controller from any dispute, claim or request from any interested party in the treatment that may arise due to the communication of personal data to the Data Controller carried out in violation of the applicable legislation.
4. DATA RETENTION
The Company will retain Personal Data for the period necessary to satisfy the purposes for which it was collected pursuant to paragraph 3 above. In any case, the following retention periods apply to the processing of Personal Data for the purposes indicated below:
As regards the purposes (a), (b) and (c) above, the Data Controller keeps your personal data for the time strictly necessary to pursue the purposes indicated above (for example where the user has an account, up to at the end of the same) in compliance with the civil and fiscal conservation obligations and the limits established by law. More precisely, the data processed to fulfil any contractual obligation with you may be kept for the entire duration of the contract as long as 10 years after the end of the fiscal year following that of competence, to address any assessment and / or dispute of a nature tax. In the event that it is necessary to defend ourselves or to act or even make claims against you or third parties, we may keep the personal data that we reasonably deem necessary to process for these purposes, for as long as this claim can be pursued.
In case of sending the curriculum through the “Work with us” section, the data will be kept until the end of the selection procedure and, in the case of spontaneous application, up to a maximum of 12 months, except for the extension of the term with your consent.
With regard to the processing of your personal data for marketing purposes, the data will be kept for a period not exceeding 24 months from collection, unless you first withdraw your consent and in any case except for the extension of the term with your consent.
With regard to navigation data, they will be stored at the Data Controller’s headquarters for the time defined by the relevant legislation, in compliance with the principle of proportionality, limited to the period of time necessary to achieve the purposes for which the data have been collected.
At the end of the established retention time, the personal data will be deleted or made anonymous, unless further processing is necessary to pursue other legitimate purposes of the Data Controller (for example: the resolution of previously initiated pre-litigation or disputes, the need to follow up investigations by the judicial or competent authorities launched before the expiry of the retention period).
5. DATA COLLECTION AND COMMUNICATION
All personal data held by the Data Controller are collected directly from us. To pursue the aforementioned purposes, your personal data are accessible to the Data Controller’s staff, including consultants, duly authorized and trained in the processing of personal data and to third parties (for example: suppliers of technical, management, organizational services to whom the Owner has outsourced some activities for efficiency reasons) who have signed a specific agreement with the Owner and act as data processors. These subjects are provided only with the personal data necessary for the performance of the related functions and they undertake to use the personal data received only for the processing purposes indicated above, to keep them confidential and safe and to act in compliance with the applicable legislation.
To pursue the aforementioned purposes, it may be necessary for the Data Controller to communicate your personal data to the following categories of recipients:
- Companies of the Holder’s Corporate group, in order to fulfil legal obligations or to provide the requested service / product;
- third-party companies that provide accounting, administrative, legal and tax services to the Data Controller or that operate as banking, financial and insurance intermediaries, including subjects who intervene in various capacities in the supply processes of the requested service / product, or in subsequent phases (for example: customer service, courier and postal services, credit collection companies);
- third-party companies operating in the context of assistance and consultancy relationships or the supply of other services provided to the Data Controller, even in the case of extraordinary corporate merger, sale or transfer of a business unit, in order to allow the execution of the operations, as well as third-party companies involved in said transactions;
- third-party companies that carry out operations of control, revision and certification of the activities carried out by the Owner;
- judicial authorities and other competent public authorities / offices.
You can request the updated list of data processors and recipients by contacting the Data Controller using the methods described below.
The Data Controller specifies that some of the subjects indicated above may be abroad, even in countries outside the European Economic Area that do not guarantee an adequate level of protection of personal data. In this case, the Data Controller allows access to personal data for the purposes indicated above only after adopting the precautions required by the Regulation for a legitimate transfer (for example: the prior signing of the standard contractual clauses of the European Commission for the transfer of personal data abroad).
6. RIGHTS OF THE INTERESTED PARTY
You can exercise the following rights at any time:
- right of access to personal data and the following information: purposes of the processing, categories of personal data in question, recipients or categories of recipients to whom the personal data may be disclosed, the retention period of the personal data (where possible), as well as , if the personal data are not collected from us, all the information available on their origin, in accordance with the provisions of art. 15 of the Regulations;
- right to rectify inaccurate personal data pursuant to art. 16 of the Regulation;
- right to obtain the cancellation of personal data concerning you, where the conditions in art. 17 of the Regulation are met;
- right to request the limitation of processing, where the conditions in art. 18 of the Regulation are met
- the right to receive or request the transfer of personal data referable to you in the possession of the Data Controller in a structured format, commonly used and legible, for further personal use or to provide them to another data controller, according to the conditions in the art. 20 of the Regulation;
- right to object to the processing, according to the conditions set out in art. 21 of the Regulation;
- the right not to be subjected to a decision based solely on an automated processing of your personal data, where carried out, which produces legal effects concerning you or which significantly affects your person, where the conditions in art. 22 of the Regulation are met;
- the right to withdraw your consent, including for the purposes related to the sending of commercial communications (with effect only for the future).
The Data Controller reminds you that limitations may apply to the aforementioned rights if the exercise of the same could result in an effective and concrete prejudice, for example, to the legitimate interests of the Data Controller.
The exercise of rights is free but the Owner reserves the right to ask for a contribution in the event of clearly unfounded or excessive requests.
Finally, the Data Controller reminds you that you can always place a complaint with the Personal Data Protection Authority as illustrated on the site: www.garanteprivacy.it.
To exercise the above mentioned rights or for any request relating to the processing of personal data by the Data Controller, you can contact the Data Controller without formalities at the following address: firstname.lastname@example.org.
7. THIRD-PARTIES’ SITES
Since the Site could allow access to sites owned and operated by third parties, we specify that this policy does not apply to said third party sites and the Data Controller is not responsible for the processing of personal data carried out by these third parties who operate as independent data controllers. In these cases, we suggest you carefully read the privacy policies of these third party sites.
8. CHANGES AND UPDATES
Latest update: November 2020