Privacy statement customers and suppliers

Privacy Statement
pursuant to Article 13 of Italian Legislative Decree 196/2003 – Personal Data Protection Code

In accordance with Article 13 of Italian Legislative Decree 196 of 30 June 2003 and of the General Data Protection Regulation (GDPR) no. 679/2016, ENTSORGAFIN SPA , registered office at S.P. per Castelnuovo Scrivia n. 7/9 – 15057 Tortona (AL), Italy, in its capacity as Data Controller and external data processor duly delegated for compliance with all data protection requirements for the companies ENTSORGA ITALIA SPA and TERRITORIO E RISORSE SRL, guarantees, within the scope of statutory provisions, that all personal data will be processed with full respect for the fundamental rights and freedoms and the dignity of the data subject (Article 4 (1.i) of the Personal Data Protection Code), in particular as concerns the confidentiality, the personal identity, the rights and the protection of the personal data. Accordingly, ENTSORGAFIN SPA has provided this privacy statement to inform you of the purposes for which personal data is collected and how it is processed, the scope for its disclosure and publication, and consent requirements.

PURPOSES OF PROCESSING

All personal data provided, including any images sent by you, will be processed and will be considered freely given by you, as ENTSORGAFIN SPA does not possess any illicit means of obtaining such information. Personal data will be collected and processed for the purposes of:

personal data provided for the supply of goods and/or services will be processed solely for the purposes of fulfilling contractual obligations and satisfying your specific requests, or to comply with statutory requirements of an administrative, accounting and tax nature, and to enable the effective management of professional, financial and business dealings. Your personal data will be processed for the full duration of the contractual arrangement, and after its termination solely for compliance with statutory requirements and for administrative and business purposes.

MANDATORY AND OPTIONAL PROVISION OF DATA AND THE CONSEQUENCES OF REFUSAL

The provision of personal data for processing by ENTSORGAFIN SPA is optional. Nevertheless, the provision of the data is necessary for the purposes stated in point (i) above. Any refusal to provide the data, or the provision of partial or inaccurate or no data, will make it impossible to fulfil and perform, in part or in whole, the stated purposes of processing.

Nevertheless, under Article 24 (a and b) of the Personal Data Protection Code, your consent is required for data processing, as explained in the relative section of this privacy statement.

HOW DATA IS PROCESSED

Personal data will be processed both manually, in paper format, and using electronic means. Electronic processing is based on the proprietary systems and databases of the Data Controller and involves appropriate computerised procedures for the storage, management and transmission of data, using methods and logics designed to guarantee the security and confidentiality of the data.

ENTSORGAFIN SPA guarantees that it will only process data that is pertinent, complete and not excessive in relation to the purposes for which they were collected; it is your responsibility as the data subject to notify us promptly of any corrections, additions and/or changes to the data. Specific security measures are in place to prevent data loss, misuse or incorrect use, and any unauthorised access.

RETENTION PERIODS

Personal data will be processed for the time necessary to satisfy the stated purposes for which they were collected and to fulfil contractual obligations and statutory and regulatory requirements, without prejudice to the statutory limitations and time-limits of rights and in compliance with resulting obligations.

WHO MAY ACCESS THE DATA

Personal data will be processed, within the limits of the general authorisations issued by the Data Protection Authority, by data processors expressly and specifically designated for the purpose by the Data Controller. Personal data may also be processed by outsourcers engaged to provide services connected with the purposes of processing and which our organisation may designate as data processors in charge of the data processing operations they perform, to ensure greater protection. All data processors will process personal data in compliance with the instructions provided by the Data Controller, according to the operating profiles assigned to them on the basis of the duties they perform, as necessary and relevant to perform specific tasks within the scope of the services requested, and exclusively for the purposes stated in this privacy statement.

The list of data processors in charge of processing is constantly updated and can be obtained by written request, as explained further on in the section on the rights of the data subject.

DISCLOSURE AND PUBLICATION

Personal data may be disclosed, meaning that the information may be provided to certain entities, other than the Data Controller, by data processors in charge of data processing, both internal and external to the organisation, and by data processors designated and tasked for the purpose in accordance with Articles 29 and 30 of the Personal Data Protection Code to pursue the stated purposes of processing, and within the limits of those purposes, in the following cases:

Personal data, where collected and strictly for the purposes stated above, may be transferred to partner organisations of ENTSORGAFIN SPA in other countries, including countries outside the European Union, in accordance with Articles 42, 43 et seq. of the Personal Data Protection Code, including amendments and additions.

Where such transfers cannot be made without the free and express consent of the data subject, either because they are otherwise not permitted by law or they do not relate to the stated purposes of processing, your consent as the data subject will be required to transfer the data to entities that perform services ancillary to the stated purposes of processing.

Personal data will not be published, meaning that the information will not be disseminated in any way, either by being made public or available for consultation, unless you specifically give your free and informed consent for each type of processing.

RIGHTS OF THE DATA SUBJECT

Data subjects may exercise their rights under Article 7 of the Personal Data Protection Code (Right to Access Personal Data and Other Rights) in relation to the data referring to them at any time. In particular, you have the right to obtain confirmation as to whether or not your personal data are being processed; the right to access the data and obtain information as to the source of the data; the right to verify the accuracy of the data; and the right to have the data supplemented or updated. You may request the rectification or blocking of your personal data if they are incomplete or inaccurate or were collected in violation of laws in force. Similarly, you may also object to the processing of your personal data on legitimate grounds and may request, on those same grounds, their erasure, providing it is in accordance with laws in force and where ENTSORGAFIN SPA is not subject to other data storage or processing obligations.

You can exercise your rights or obtain an updated list of data processors by request under Article 13 (f) of the Personal Data Protection Code, by writing to the Company, by ordinary post or by e-mail at the address info@entsorga.it, or by writing to the data processor directly, available at the Data Controller’s registered office, via the e-mail address provided, to obtain a prompt response.

DATA CONTROLLER

The Data Controller for the processing of personal data is ENTSORGAFIN SPA, registered office at S.P. per Castelnuovo Scrivia n. 7/9 - 15057 Tortona (AL) – ITALY.

ENTSORGAFIN acts as the external data processor in charge of data processing for the companies ENTSORGA ITALIA SPA and TERRITORIO E RISORSE SRL, which have delegated compliance with data protection requirements to the parent company ENTSORGAFIN SPA.

This privacy statement should therefore be considered extended to and valid for the companies ENTSORGA ITALIA SPA and TERRITORIO E RISORSE SRL, in their capacity as data controllers.

PLACE OF PROCESSING

Personal data will be processed on the premises of ENTSORGAFIN SPA offices and branches and in the server “locations” of our IT service providers. The identification data of our IT service providers can be obtained by written request, as explained in the section on the rights of the data subject.

CONSENT

In accordance with Articles 24 (1.a and b), 23 and 130 of the Personal Data Protection Code, including amendments and additions, we inform you that: