1 Titolare del trattamento
The data controller SAET S.p.A. , Via A. Moravia, 8 – 35030 Selvazzano Dentro (PD) (“Data Controller”, “we”, “our”), pursuant to Article 13 of the General Data Protection Regulation (EU) 2016/679 (“Regulation“), informs you that your personal data will be processed for the purposes and in the manner described below.
This information on the processing of personal data (“Information Notice“) refers to the processing carried out by the Data Controller on the personal data of users who, like you, browse, interact, register or request the services offered by the website www.saetpd.it (“Website“).
2 Purpose and legal basis of processing
In compliance with the Regulation, the processing operations described below will be based on the principles of lawfulness, correctness, transparency, purpose limitation and storage, as well as data minimisation, accuracy, integrity and confidentiality.
2.1 Main Purposes
The Controller processes your personal data for the following main purposes:
(a) to perform a contract to which you are a party or to carry out pre-contractual activities at your request (for example: to provide the requested service/product, to provide the relevant pre/post-sales customer service, including by e-mail/phone, and to answer your questions, to examine your CV if you send it via the “Work with us” section, and to carry out all related operational, administrative and management activities);
(b) to comply with legal obligations, regulations or national/EU legislation, including, for example, obligations under orders from judicial authorities and other competent authorities;
(c) to pursue our legitimate interests in protecting our rights, to enforce or defend such rights in the competent forums (e.g. judicial, arbitration, administrative), to protect our assets, to prevent fraud, to manage any extraordinary corporate transactions, and to improve the services offered on the Site.
The provision of personal data for purposes (a), (b) and (c) is compulsory in order to conclude the contract with us, to allow us to provide you with the requested service/product or to respond to your requests, as well as to allow us to examine your CV if you send it via the “Work with us” section or to be able to fulfil the legal obligations relating to the conclusion of the contract. In the event of failure to provide personal data, the Data Controller will not be able to establish the contractual relationship with you, execute the same and/or the aforementioned obligations or carry out the activities described above.
2.2 Further purposes
Subject to your free and optional consent, the Controller also processes your personal data for the following additional purposes:
(d) to send you commercial communications relating to the Controller’s products, services, events and promotions, including market research, statistical processing and qualitative surveys, by automated telephone calls and similar methods, such as e-mail, SMS, MMS, push notifications, WhatsApp messages, as well as traditional methods such as paper mail and telephone calls with an operator (“marketing purposes”);
(e) to communicate your personal data to other companies in the Controller’s group of companies operating in the energy sector in order to send commercial communications relating to the products, services, events and promotions of these third party companies, including market research, statistical processing and surveys, by automated telephone calls and similar methods, such as e-mail, SMS, MMS, push notifications, WhatsApp messages, as well as traditional methods such as paper mail and telephone calls with an operator (“communication to third parties for marketing purposes”);
(f) to analyse your preferences, habits, purchasing behaviour and consumption choices, in order to be able to send you personalised commercial communications and to a|Iow the Controller to carry out general analyses for strategic and commercial orientation purposes.
The provision of personal data for marketing purposes and communication to third parties for marketing purposes is optional. If you fail to provide them, we will not be able to send you commercial communications and/or marketing communications, nor will we be able to communicate your personal data to the companies of the corporate group or third parties mentioned above, nor will we be able to carry out profiling, but there will be no negative consequences for you.
In any case, you may revoke your consent at any time for the purposes of marketing, profiling and communication to third parties for marketing purposes. Furthermore, with specific reference to marketing purposes, you may withdraw your consent for all or some of the means of communication by the methods indicated below or those indicated within each communication.
If you are already one of our customers or have already used services from the Controller by communicating us your email in the context of the sale of a service or product, we will send you commercial communications by email regarding the Controller’s products and services similar to those that are the subject of the sale of the service or product, based on our legitimate interest in carrying out this promotional activity. It is understood that, even in this case, you may object at any time to the sending of commercial communications by the means indicated below or those indicated within each communication.
3 Category of personal data processed
The Data Controller processes the following personal data by electronic means, including automated processes, and manually in accordance with procedures and logics functional to the above-mentioned purposes:
The Data Controller does not process personal data belonging to special categories of personal data (e.g. health data). By browsing, interacting, registering or requesting the services offered by the Site, you confirm that you are at least 18 years old.
Should you provide us with personal data of third parties, you shall process such personal data as an autonomous data controller and you shall do whatever is necessary to ensure that such communication and our subsequent use for the purposes specified from time to time are in compliance with the applicable reference legislation (for example: before providing us with personal data of third parties you shall obtain their prior informed consent, if required by the applicable legislation). In any event, you undertake to indemnify the Controller against any dispute, claim or request from any data subject that may arise as a result of the communication of personal data to the Controller made in breach of the applicable legislation.
4 Data retention
With regard to purposes (a), (b) and (c) above, the Data Controller keeps your personal data for the time strictly necessary to pursue the above purposes (e.g. if you have an account, until the account is closed) in compliance with civil and fiscal retention obligations and the limits set by law. More precisely, the data processed to fulfil any contractual obligation with you may be retained for the entire duration of the contract as well as for a further 10 years from the end of the tax year following the year in question, in order to deal with any tax assessment and/or dispute. In the event that it is necessary for us to defend or take action against you or any third party, we may retain such personal data as we reasonably consider necessary to process for such purposes for as long as such claim may be pursued.
If you send your CV via the “Work with us” section, your data will be kept until the end of the selection process and, in the case of a spontaneous application, up to a maximum of 12 months, without prejudice to the extension of this period with your consent.
As regards the processing of your personal data for marketing purposes, your personal data will be kept until you revoke your consent, while for profiling purposes your data will be kept for a period not exceeding 12 months from the date of collection, unless you revoke your consent earlier.
Navigation data will be stored at the Data Controller’s head office for the period of time defined by the relevant legislation, in accordance with the principle of proportionality, limited to the period of time necessary to achieve the purposes for which the data were collected.
At the end of the agreed retention period, personal data will be deleted or made anonymous, unless further processing is necessary to pursue other legitimate purposes of the Data Controller (for example: the resolution of pre-litigation or litigation started before the expiry of the retention period, the need to follow up investigations by judicial authorities or competent authorities started before the expiry of the retention period, the need to comply with legal obligations in the field of taxation and accounting).
5 Data collection and reporting
The personal data held by the Controller are collected directly from you. In order to pursue the above-mentioned purposes, your personal data can be accessed by the Data Controller’s staff, including consultants, duly authorized and trained in the processing of personal data, and by third parties (for example’ suppliers of technical, managerial and organizational services to whom the Data Controller has outsourced certain activities for reasons of efficiency) who have signed a specific agreement with the Data Controller and act as data processors. These parties are only provided with the personal data necessary to perform their functions, and they undertake to use the personal data received only for the processing purposes indicated above, to keep them confidential and secure and to act in compliance with the applicable legislation.
In order to pursue the above purposes, it may be necessary for the Controller to disclose your personal data to the following categories of recipients:
You may request the updated list of data processors and recipients by contacting the Data Controller using the methods described below.
The Data Controller specifies that personal data will not be transferred to countries outside the European Economic Area except for the transfer to the United Kingdom in the event of explicit requests on its part that make such communication necessary. In any case, if the Data Controller should contact third parties located outside the European Economic Area, the Data Controller will allow access to your personal data for the purposes indicated above only after adopting the precautions required by the Regulation for a lawful transfer (for example: prior signing of the European Commission’s standard contractual clauses for the transfer of personal data abroad) and you may always ask the Data Controller for a copy of the guarantees adopted for the transfer.
6 Rights of the data subject
You may exercise the following rights at any time:
The Data Controller reminds you that restrictions may apply to the above rights if the exercise of such rights may result in actual and concrete harm, for example, to the legitimate interests of the Data Controller.
The exercise of rights is free of charge, but the Holder reserves the right to charge a fee in the event of manifestly unfounded or excessive requests.
To exercise the above rights or for any request relating to the processing of personal data by the Controller, you may contact the Controller without formalities at the following address: firstname.lastname@example.org
Finally, the Data Controller reminds you that you can always lodge a complaint with the Data Protection Authority in accordance with the procedures set out on the website: www.garanteprivacy.it
7 Third-party sites
Since the Site may allow access to sites owned and operated by third parties, we specify that the Policy does not apply to such third party sites and the Data Controller is not responsible for the personal data processing activities carried out by said third parties who act as autonomous data controllers. In these cases, we suggest that you read the privacy policies of these third party sites carefully.
8 Changes and updates
The Data Controller reserves the right to modify or update, in whole or in part, the content of the Policy (including as a result of changes in applicable legislation). The changes will be published on the Site and, if substantial, communicated to you by e-mail. The Data Controller therefore invites you to regularly visit this section in order to keep up to date on the methods used by the Data Controller to process your personal data. Previous versions of the Information Notice may be requested from the Data Controller by the means indicated above.
Version updated April 2022.