1. Scope of application and entity responsible for the processing of personal data
The entity responsible for processing this data in its capacity of data controllers:
EDP Energia Italia S.R.L (hereinafter referred to as “EDP Energia Italia”), registered at Registro delle Imprese di MILANO MONZA BRIANZA LODI with VAT code 10411010969, registered headquarters at Milano (MI) Via Roberto Lepetit 8 CAP 20124 and 10.000 EUR of share capital, which can be contacted at the following email address firstname.lastname@example.org.
This Website is not addressed to Users under age. The User guarantees that he is of legal age and that the data communicated is true, accurate, complete and current, being responsible for any nonconformity. If the data communicated belongs to a third party, the user guarantees that he informed the third party about the conditions provided in this document and that he was authorized to provide his data to EDP ENERGIA ITALIA for the indicated purposes.
EDP Website: edpenergia.it
2. Collected personal data
EDP ENERGIA ITALIA collects the following categories of personal data (the "Personal Data"):
- Data provided in case of requests as filled out by the Users or request of information or assistance on the part of the User;
- Identification data of the User accessing its personal account;
- Information relating to the agreement between the User and EDP ENERGIA ITALIA. The processing of personal data included in the personal account are regulated by the information notice provided by EDP ENERGIA ITALIA at the moment of execution of the contractual relationship with the User).
3. Data processing purposes and legal basis
EDP ENERGIA ITALIA processes Personal Data for the following purposes:
- the provisions of the Services offered through the Website, including the provision of responses to the User's requests of information or assistance;
- the compliance with the applicable national/EU laws and/or respond to request from public and government authorities;
(the purpose as per letters a) and b) are jointly referred to as "Contractual Purposes")
- to exercise or defend legal claims in court proceedings or in an administrative or out-of-court procedures; and
- to complete a potential merger, sale of assets or transfer of all or a material part of its business, by disclosing and transferring the Personal Data to the third party or parties involved in the transaction as part of the transaction;
(the purpose as per letters c) and d) above are jointly referred to as "Legitimate Interest Purposes").
- the delivery of marketing communications concerning products and services of EDP ENERGIA ITALIA. The communications, may be sent by both automated (e.g., SMS, MMS, fax, calling systems, email and web applications) and traditional (e.g., calls by human operators) means of contact;
(the purposes as per letter e) above is referred to as "Marketing Purpose").
The processing of Personal Data is necessary with regard to the Contractual Purposes as it is essential for the execution of contracts between users and EDP ENERGIA ITALIA or for pre-contractual procedures upon request with regard to the case as per Section 3 letter a) and in order to comply with provisions as provided by the applicable laws as per Section 3 letter b). Should the User not provide its Personal Data with regard to the Contractual Purposes, EDP ENERGIA ITALIA will not be able to provide the user with the relevant Services.
For the Contractual Purposes, Personal Data may be transferred to the following categories of recipients located within the EU: (a) suitable service provider outsourced by EDP ENERGIA ITALIA, entrusted with processing activities that provide services or assistance and advice to EDP ENERGIA ITALIA, with special - but not exclusive - reference to technology, accounting, administrative, legal, insurance, IT matters; (b) other companies within the EDP Group, and (c) persons and authorities whose right to access Personal Data is recognized by law, regulations or provisions issued by legally empowered authorities.
For the Legitimate Interest Purposes, Personal Data may be transferred to the following categories of recipients located within the EU: (a) third parties service providers entrusted with processing activities, (b) other companies within the EDP Group, (c) potential purchaser of EDP ENERGIA ITALIA and the entities resulting from mergers or any other transformation involving EDP ENERGIA ITALIA, (d) competent authorities.
For the Marketing Purposes, personal data may be transferred to the following categories of recipients located both within the EU: (a) third parties service providers entrusted with processing activities that provide services or assistance with regard to the delivery of marketing communications, (b) other companies within the EDP Group.
5. International data transfers
Data processing for the aforementioned purposes shall occur in its entirety within the European Economic Area. The transfer of personal data is based on information systems equipped with appropriate information security measures, such as content and communication encryption and the use of secure servers. If transfers from EU to countries not considered adequate by the European Commission apply, the Company will put in place appropriate and suitable safeguards to protect the Personal Data. Accordingly, the Personal Data are transferred in compliance with the requirements and the obligations provided by applicable data protection laws, such as standard contractual clauses adopted by the European Commission as per Articles 45 and 46 of the Privacy Regulation.
6. Retention period
In any case Personal Data for Contractual Purposes and for Legitimate Interest Purposes is retained during the provision of the Services plus a period of 10 years after the termination of the Services, unless EDP ENERGIA ITALIA is obliged to maintain the relevant Personal Data for a longer period in order to respond or to file a legal action, upon request of the competent authorities or by virtue of the law. EDP ENERGIA ITALIA may also keep the data beyond these periods for statistical purposes, and for this purpose shall anonymize them.
7. User rights
The User, at any given time, can exercise the following rights:
- to obtain from EDP ENERGIA ITALIA confirmation of the existence of personal data and to be informed of its content and source, verify its accuracy and request its integration, update or amendment;
- request the erasure or restriction of the processing of personal data processed in breach of the applicable laws;
- object in whole or in part, on legitimate grounds, to the processing of the data;
- to withdraw the consent to the processing of the data (if and to the extent such a consent is necessary);
- request EDP ENERGIA ITALIA to limit the processing of the User's personal data where:
- the User contests the accuracy of the personal data until EDP ENERGIA ITALIA has taken sufficient steps to correct or verify its accuracy;
- the processing is unlawful but you do not want us to erase the User's personal data;
- EDP ENERGIA ITALIA no longer needs the User's personal data for the purposes of the processing, but the User requires them for the establishment, exercise or defence of legal claims; or
- The User has objected to processing justified on legitimate interests, pending verification as to whether EDP ENERGIA ITALIA has compelling legitimate grounds to continue processing;
- object to the processing of the User's personal data in case of processing based on legitimate interest, unless EDP ENERGIA ITALIA demonstrates the existence of compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims;
- request the erasure of the User's personal data without undue delay;
- receive an electronic copy of the User's personal data, if the User would like to port its personal data to itself or a different provider, when EDP ENERGIA ITALIA is relying upon the User's consent or the fact that the processing is necessary for the provision of the services and the personal data is processed by automatic means; and
- lodge a complaint with the relevant data protection supervisory authority.
According to article 2-terdecies of the Italian Legislative Decree no 196/2003, in case of the User's death, the abovementioned rights may be exercised by another person entitled (the "Successor") who has its own interest or acts as User's mandatory or family reasons that need to be protected exist. The User may expressly avoid the exercise of some of the abovementioned rights by the Successor submitting a request to the e-mail address indicated below. The User may, in any time, withdraw or modify such declaration with the same modalities.