Policy on the processing of personal data of the website www.biomasseitalia.it

Biomasse Italia S.p.A. and Biomasse Crotone S.p.A., as joint data controllers of the data (the “Joint Controllers“), pursuant the EU Regulation 2016/679 (“GDPR“) and the national legislation in force on personal data protection inform you that your data will be processed according to the following modalities and for the following purposes:

1. Scope of the processing

The Joint Controllers process identification and non-sensitive personal data provided by you either during the browsing on the website www.biomasseitalia.it (hereinafter “Site“) and / or in case you submit an online contact request to the Joint Controllers and in particular:

• Personal Data: name, surname, address, phone number, e-mail address provided during the online contact;
• Navigation Data such as IP addresses or domain names of computers used by users which connect to the Site, the URI addresses (Uniform Resource Identifier) of requested resources, time of request, the method used to send the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating the operating system and the user’s IT environment. These data are collected through the cookies described in the Cookie Policy of the Site to which you are referred.

The Personal Data and Navigation Data will also be referred herein-below collectively as “Data“.

2. Purposes and legal bases of the processing

Your Data are processed without your prior consent for the following purposes and legal bases:

• The execution of the contract and / or the fulfilment of pre-contractual obligations, in particular:
  • to manage a contact request from your part;
  • to provide adequate technical assistance;
• the fulfilment of legal obligations:
  • compliance to the obligations under applicable laws, regulations, EU regulations, orders and instructions of the competent authorities;
• the pursuit of a legitimate interest of the Joint Controllers, in particular:
  • the management and maintenance of the Site: the interest of the Joint Controllers is based on the general interest of a company to guarantee the business operation, also through the operation of the Site, and possible efficiency improvements of the provided service;
  • to prevent or discover fraudulent activities or abuses harmful to the Site: the interest of the Joint Controllers is based on the general legitimate interest, actual and current, to not suffer damage as a result of illegal conduct of others;
  • to exercise the rights of the Joint Controllers, for example the right to defend in court: the interest of the Joint Controllers corresponds with the right of action constitutionally guaranteed (art. 24 of the Constitution) and, as such, is socially acknowledged as prevalent with respect to interests of the singular data subject.

3. Modalities of Data Processing

The processing of your Data is carried out – with electronic modalities – by means of operations of collecting, recording, updating, organizing, storage, consultation, elaboration, modification, selection, retrieval, comparison, use, interconnection, restriction, erasure and destruction of Data.

Your personal data are protected in order to minimize the risk of destruction, loss (including the accidental loss), unauthorized access / use or use incompatible with the original purpose of collection. This is achieved with the technical and organizational security measures implemented by the Joint Controllers.

4. Data retention

The Joint Controllers process the Data for the time necessary to fulfil the purposes mentioned above and, in any case, subject to the legal terms of prescription, for:

• no more than 2 years for the management of the contact requests;
• no more than 1 year for the navigation Data collected in order to enable your navigation on the Site. These Data are collected by means of cookies: for more details on the duration of each individual cookie and on the retention of the data collected through them, please refer to the Cookie Policy of the Site for both first-party cookies and cookies of third parties.

5. Access to Data

The following subjects can access your Data for the purposes mentioned above:

• employees and / or collaborators of the Joint Controllers and / or of the Group companies to which the Joint Controllers belong, in their quality of processors and / or internal persons in charge or system administrators;
• EPH Group companies or others third parties (for example IT services providers, suppliers, banks, professional offices, etc.) that carry on business in outsourcing on behalf of the Joint Controllers, in their quality as external processors.

6. Data communication

Your Data can be communicated, even without your consent, for the purposes mentioned above, to control bodies, police or judiciary bodies which will process them, on their express request, as independent data controllers for institutional purposes and / or by law during investigations and controls. Your Data can also be communicated to third parties (e.g. partners, professionals, agents, etc.), as independent data controllers, for the performance of instrumental activities for the purposes mentioned above.

7. Data transfer

The Joint Controllers may transfer your data collected through third-party analytical cookies outside the European Union. To this end, pursuant to privacy legislation, the Joint Controllers evaluate the impact of data transfers and adopt, if applicable, the most appropriate guarantees (for example, adequacy decisions or standard contractual clauses).

8. Provision of Data

The provision of Data is mandatory. In default, we cannot guarantee to you the browsing on the Site or the possibility to submit a contact request to the Joint Controllers or the purposes indicated under paragraph 2.

9. Rights of the data subject

The Joint Controllers inform you that, as a data subject, if the limitations provided by law do not apply, you have the right to:

• obtain confirmation over the existence or inexistence of Personal Data relating to you, even if not yet registered, and their communication in a comprehensible way
• obtain indication and, if necessary, copy of: a) source and category of personal Data; b) the logic applied in case of processing carried out with the aid of electronic instruments; c ) the purposes and modalities of processing; d) the identity of the Joint Controllers and the processors; e) subjects or categories of persons to whom the Data may be communicated or who may gain knowledge, in particular if they are non – EU countries or international organizations; f ) when possible, the data retention period or the criteria used to determine this period; g ) the existence of an automated decision-making process and in this case the logics used, the importance and the consequences expected for the interested party; h ) the existence of adequate safeguards in case of Data transfer to a non-EU country or to an international organization;
• obtain, without unjustified delay, updating and correction of the inaccurate data or, when interested, integration of incomplete Data;
• obtain the erasure, transformation into anonymous form or blocking of the Data: a) unlawfully processed; b) no longer necessary in relation to the purposes for which they have been collected or subsequently processed; c) if you withdraw consent on which the processing is based and there is no other legal ground for the processing; d) if you have opposed the processing a and there is no prevailing legitimate reason to continue the processing; e) in case of fulfilment of a legal obligation; f) in case of data referring to minors. The Joint Controllers can refuse the cancellation only in the following cases: a) to exercise of the right to freedom of expression and information; b) in compliance with legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority; c) for reasons of public health interest; d) to achieve purposes in the public interest, scientific, historical research or statistical purposes; e) exercise of a right in court;
• obtain the limitation of processing in case of: a) contestation of the personal data’s accuracy; b) unlawful processing of the Joint Controllers to prevent the cancellation; c) exercise of a right in court; d) verification of the possible prevalence of the legitimate reasons of the Joint Controllers over those of the interested party;
• receive the Personal Data concerning you in a structured, commonly used and machine-readable format and transmit those data to another controller without hindrance from the Joint Controllers to which the personal data have been provided, if the processing is carried out by automated means;
• oppose, in whole or in part: a) for lawful grounds connected to your particular situation, to the processing of the personal Data that concern you; b) to the processing of personal data that concern you for purposes of sending advertising material or direct selling or for carrying out market research or commercial communication, through the use of automated calling systems without the intervention of an operator by email and / or through traditional marketing methods by telephone and / or paper mail;
• submit a data protection complaint to the competent supervisory authority.

In the above cases, where necessary, the Joint Controllers will inform the third parties to whom your personal data are communicated about your possible exercise of rights, except specific cases (e.g. if this proves impossible or involves disproportionate effort).

10.  How to exercise your rights

You can exercise these rights at any time:

• by sending a registered letter with return receipt to the Joint Controllers’ address;
• by sending an email to dataprotection@epnewenergy.it.

11. Joint Controllers, processors and responsible persons

The Joint Controllers are:

• Biomasse Italia S.p.A., with registered office in Strongoli (KR) Via Strada Statale 106 Km 263, cap. 88816, fiscal code 12249510152 and VAT number 02199330792;
• Biomasse Crotone S.p.A., with registered office in Crotone, Strada Statale 106, Zona Industriale, cap. 88900, fiscal code and VAT number 03200440794.

The updated list of data processors is kept at the headquarters of the Joint Controllers.

Biomasse Italia S.p.A.

Biomasse Crotone S.p.A.