Privacy Policy

1 Titolare del trattamento

The data controller SAET S.p.A. , Via A. Moravia, 8 – 35030 Selvazzano Dentro (PD) (“Data Controller”, “we”, “our”), pursuant to Article 13 of the General Data Protection Regulation (EU) 2016/679 (“Regulation“), informs you that your personal data will be processed for the purposes and in the manner described below.

This information on the processing of personal data (“Information Notice“) refers to the processing carried out by the Data Controller on the personal data of users who, like you, browse, interact, register or request the services offered by the website www.saetpd.it (“Website“).

We encourage you to read the Privacy Policy and the additional information on the processing of personal data on the Site carefully before interacting with our services.

2   Purpose and legal basis of processing

In compliance with the Regulation, the processing operations described below will be based on the principles of lawfulness, correctness, transparency, purpose limitation and storage, as well as data minimisation, accuracy, integrity and confidentiality.

2.1    Main Purposes

The Controller processes your personal data for the following main purposes:

(a)   to perform a contract to which you are a party or to carry out pre-contractual activities at your request (for example: to provide the requested service/product, to provide the relevant pre/post-sales customer service, including by e-mail/phone, and to answer your questions, to examine your CV if you send it via the “Work with us” section, and to carry out all related operational, administrative and management activities);

(b) to comply with legal obligations, regulations or national/EU legislation, including, for example, obligations under orders from judicial authorities and other competent authorities;

(c) to pursue our legitimate interests in protecting our rights, to enforce or defend such rights in the competent forums (e.g. judicial, arbitration, administrative), to protect our assets, to prevent fraud, to manage any extraordinary corporate transactions, and to improve the services offered on the Site.

The provision of personal data for purposes (a), (b) and (c) is compulsory in order to conclude the contract with us, to allow us to provide you with the requested service/product or to respond to your requests, as well as to allow us to examine your CV if you send it via the “Work with us” section or to be able to fulfil the legal obligations relating to the conclusion of the contract. In the event of failure to provide personal data, the Data Controller will not be able to establish the contractual relationship with you, execute the same and/or the aforementioned obligations or carry out the activities described above.

2.2   Further purposes

Subject to your free and optional consent, the Controller also processes your personal data for the following additional purposes:

(d)   to send you commercial communications relating to the Controller’s products, services, events and promotions, including market research, statistical processing and qualitative surveys, by automated telephone calls and similar methods, such as e-mail, SMS, MMS, push notifications, WhatsApp messages, as well as traditional methods such as paper mail and telephone calls with an operator (“marketing purposes”);

(e)   to communicate your personal data to other companies in the Controller’s group of companies operating in the energy sector in order to send commercial communications relating to the products, services, events and promotions of these third party companies, including market research, statistical processing and surveys, by automated telephone calls and similar methods, such as e-mail, SMS, MMS, push notifications, WhatsApp messages, as well as traditional methods such as paper mail and telephone calls with an operator (“communication to third parties for marketing purposes”);

(f) to analyse your preferences, habits, purchasing behaviour and consumption choices, in order to be able to send you personalised commercial communications and to a|Iow the Controller to carry out general analyses for strategic and commercial orientation purposes.

The provision of personal data for marketing purposes and communication to third parties for marketing purposes is optional. If you fail to provide them, we will not be able to send you commercial communications and/or marketing communications, nor will we be able to communicate your personal data to the companies of the corporate group or third parties mentioned above, nor will we be able to carry out profiling, but there will be no negative consequences for you.

In any case, you may revoke your consent at any time for the purposes of marketing, profiling and communication to third parties for marketing purposes. Furthermore, with specific reference to marketing purposes, you may withdraw your consent for all or some of the means of communication by the methods indicated below or those indicated within each communication.

If you are already one of our customers or have already used services from the Controller by communicating us your email in the context of the sale of a service or product, we will send you commercial communications by email regarding the Controller’s products and services similar to those that are the subject of the sale of the service or product, based on our legitimate interest in carrying out this promotional activity. It is understood that, even in this case, you may object at any time to the sending of commercial communications by the means indicated below or those indicated within each communication.

3   Category of personal data processed

The Data Controller processes the following personal data by electronic means, including automated processes, and manually in accordance with procedures and logics functional to the above-mentioned purposes:

• data provided voluntarily by you, such as your name, surname, e-mail address, telephone number, data relating to your employment status (this is the case when you provide us with your personal data in order to, for example, register on the Website, request a service or product, register for the newsletter), as well as the data contained in your curriculum vitae if you send it via the “Work with us” section;
• navigation data acquired by the computer systems responsible for \he operation of the Site, the transmission of which is implicit in the use of Internet communication protocols (this is information that is not collected to be associated with identified interested parties but which by its very nature could, through processing and association with data held by third parties allow users to be identified – this category of data includes IP addresses, browser type, operating system, domain name and addresses of sites accessed or exited from, information on the pages visited by users within the Site, access time, length of stay on a single page, internal path analysis and other parameters relating to the user’s operating system and computer environment. This data is collected and used in an aggregate and anonymous manner for the sole purpose of improving the quality of the services offered on the Site, optimising the functionality of the Site and preparing statistical information on the use of the Site);
• data collected through cookies (since the Site makes use of cookies that collect the personal data of users, please read the Cookie Policy (https://saetpd.it/en/cookies/) that describes the cookies used by the Site and the purpose of their use).

The Data Controller does not process personal data belonging to special categories of personal data (e.g. health data). By browsing, interacting, registering or requesting the services offered by the Site, you confirm that you are at least 18 years old.

Should you provide us with personal data of third parties, you shall process such personal data as an autonomous data controller and you shall do whatever is necessary to ensure that such communication and our subsequent use for the purposes specified from time to time are in compliance with the applicable reference legislation (for example: before providing us with personal data of third parties you shall obtain their prior informed consent, if required by the applicable legislation). In any event, you undertake to indemnify the Controller against any dispute, claim or request from any data subject that may arise as a result of the communication of personal data to the Controller made in breach of the applicable legislation.

4 Data retention

With regard to purposes (a), (b) and (c) above, the Data Controller keeps your personal data for the time strictly necessary to pursue the above purposes (e.g. if you have an account, until the account is closed) in compliance with civil and fiscal retention obligations and the limits set by law. More precisely, the data processed to fulfil any contractual obligation with you may be retained for the entire duration of the contract as well as for a further 10 years from the end of the tax year following the year in question, in order to deal with any tax assessment and/or dispute. In the event that it is necessary for us to defend or take action against you or any third party, we may retain such personal data as we reasonably consider necessary to process for such purposes for as long as such claim may be pursued.

If you send your CV via the “Work with us” section, your data will be kept until the end of the selection process and, in the case of a spontaneous application, up to a maximum of 12 months, without prejudice to the extension of this period with your consent.

As regards the processing of your personal data for marketing purposes, your personal data will be kept until you revoke your consent, while for profiling purposes your data will be kept for a period not exceeding 12 months from the date of collection, unless you revoke your consent earlier.

Navigation data will be stored at the Data Controller’s head office for the period of time defined by the relevant legislation, in accordance with the principle of proportionality, limited to the period of time necessary to achieve the purposes for which the data were collected.

At the end of the agreed retention period, personal data will be deleted or made anonymous, unless further processing is necessary to pursue other legitimate purposes of the Data Controller (for example: the resolution of pre-litigation or litigation started before the expiry of the retention period, the need to follow up investigations by judicial authorities or competent authorities started before the expiry of the retention period, the need to comply with legal obligations in the field of taxation and accounting).

5   Data collection and reporting

The personal data held by the Controller are collected directly from you. In order to pursue the above-mentioned purposes, your personal data can be accessed by the Data Controller’s staff, including consultants, duly authorized and trained in the processing of personal data, and by third parties (for example’ suppliers of technical, managerial and organizational services to whom the Data Controller has outsourced certain activities for reasons of efficiency) who have signed a specific agreement with the Data Controller and act as data processors. These parties are only provided with the personal data necessary to perform their functions, and they undertake to use the personal data received only for the processing purposes indicated above, to keep them confidential and secure and to act in compliance with the applicable legislation.

In order to pursue the above purposes, it may be necessary for the Controller to disclose your personal data to the following categories of recipients:

• companies in the Controller’s group of companies, in order to comply with Iegal obligations or to provide the service/product requested (for example, if you request information about services/products offered by other companies in the group, we will disclose your data to those companies to enable them to answer your questions and send you the requested information);
• third party companies that provide accounting, administrative, legal and tax services to the Data Control|er or that operate as banking, financial and insurance intermediaries, including subjects that intervene in various ways in the processes of providing the service/product requested, or in subsequent phases (for example: customer service, couriers and postal services, credit recovery companies);
• third party companies operating in the context of assistance and consultancy relationships or the provision of other services provided to the Data Controller, including in the case of extraordinary corporate operations of merger, sale or transfer of a business unit, in order to allow the operations to be carried out, as well as third party companies involved in such operations;
• third party companies that carry out control, audit and certification of the activities carried out by the Controller;
• Judicial authorities and other competent public authorities/offices.

You may request the updated list of data processors and recipients by contacting the Data Controller using the methods described below.

The Data Controller specifies that personal data will not be transferred to countries outside the European Economic Area except for the transfer to the United Kingdom in the event of explicit requests on its part that make such communication necessary. In any case, if the Data Controller should contact third parties located outside the European Economic Area, the Data Controller will allow access to your personal data for the purposes indicated above only after adopting the precautions required by the Regulation for a lawful transfer (for example: prior signing of the European Commission’s standard contractual clauses for the transfer of personal data abroad) and you may always ask the Data Controller for a copy of the guarantees adopted for the transfer.

6 Rights of the data subject

You may exercise the following rights at any time:

• Right of access to personal data and to the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data may be disclosed, the storage period of the personal data (where possible), and, where the personal data are not collected from you, all available information on their origin, in accordance with Article 15 of the Regulation;
• the right to rectify inaccurate personal data pursuant to Article 16 of the Regulation;
• the right to obtain the deletion of your personal data, if the conditions of Article 17 of the Regulation are met;
• the right to request the restriction of the processing of personal data, where the conditions set out in Article 18 of the Regulation apply;
• the right to receive or request the transfer of personal data relating to you held by the Controller in a structured, commonly used and readable format, for further personal use or to provide them to another data controller, where the conditions set out in Article 20 of the Regulation apply;
• the right to object to the processing of personal data, where the conditions set out in Article 21 of the Regulation apply;
• the right not to be subject to a decision which is based solely on automated processing of your personal data, where it is carried out, and which produces legal effects concerning you or significantly affects you personally, where the conditions laid down in Article 22 of the Regulation are met;

• the right to revoke your consent, including for purposes related to the sending of commercial communications (with effect for the future only).

The Data Controller reminds you that restrictions may apply to the above rights if the exercise of such rights may result in actual and concrete harm, for example, to the legitimate interests of the Data Controller.

The exercise of rights is free of charge, but the Holder reserves the right to charge a fee in the event of manifestly unfounded or excessive requests.

To exercise the above rights or for any request relating to the processing of personal data by the Controller, you may contact the Controller without formalities at the following address: info@saetpd.it

Finally, the Data Controller reminds you that you can always lodge a complaint with the Data Protection Authority in accordance with the procedures set out on the website: www.garanteprivacy.it

7   Third-party sites

Since the Site may allow access to sites owned and operated by third parties, we specify that the Policy does not apply to such third party sites and the Data Controller is not responsible for the personal data processing activities carried out by said third parties who act as autonomous data controllers. In these cases, we suggest that you read the privacy policies of these third party sites carefully.

8   Changes and updates

The Data Controller reserves the right to modify or update, in whole or in part, the content of the Policy (including as a result of changes in applicable legislation). The changes will be published on the Site and, if substantial, communicated to you by e-mail. The Data Controller therefore invites you to regularly visit this section in order to keep up to date on the methods used by the Data Controller to process your personal data. Previous versions of the Information Notice may be requested from the Data Controller by the means indicated above.

Version updated April 2022.