PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA OF PERSONS REQUESTING CHARITABLE DONATIONS

Pursuant to Art. 12 et seq. of Regulation (EU) 2016/679 ("GDPR" or "Regulation"), notice is hereby given that this notice relates to the personal data provided by the data subject or lawfully collected by the Controller, processed in relation to the charitable donation procedures by Dolomiti Energia S.p.a., with registered office in Rovereto, Via Manzoni No. 24, Tax Code and VAT No. 01614640223, tel. 0464 456111, PEC: info.holding@cert.dolomitienergia.it;

For further information, please refer to the website www.gruppodolomitienergia.it.

1. DATA CONTROLLER

The controller (i.e. the entity that determines the purposes and means of personal data processing) is Dolomiti Energia S.p.a.

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Please be informed that Dolomiti Energia S.p.a has designated, pursuant to Article 37 of the Regulation, a Data Protection Officer ("DPO"), who may be contacted for any need relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, at the email address: info.privacy@cert.dolomitienergia.it, telephone 0461 362222, or at the address Via Fersina 23, Trento.

3. PURPOSES OF PROCESSING

The processing of personal data may have the following purposes:

a) carrying out activities relating to the management and possible finalisation of the request for a charitable donation according to the procedures set out in the application form and in the charitable donation deed, to which this notice refers.

b) Execution of the charitable donation deed.

4. TYPE OF DATA PROCESSED AND METHODS OF COLLECTION

The following categories of data may be subject to processing,personal details, tax ID code and/or VAT number;

- contact details, email address; address and street number;

- data relating to criminal convictions and offences.

relating to natural persons attributable to the Entity requesting the charitable donation, such as, for example: owner, shareholders, directors, members of supervisory and control bodies, as well as cohabiting family members of the aforementioned persons, employees, general managers and attorneys-in-fact.

The data collected and processed are those disclosed by the Entity requesting the charitable donation and those acquired from public Bodies and Authorities pursuant to specific provisions of law (in particular, the INPS and INAIL Bodies and the Tax Administration, the Criminal Records Register and, in general Bodies and Authorities with which the Controller may verify the requirements of the Economic Operator).

5. POSSIBLE MANDATORY NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

There is no obligation to provide the data, but failure to provide them shall make it impossible to proceed with activation of the procedure for requesting, assessing and potentially finalising the charitable donation. It follows that any refusal to provide them in whole or in part may result in the impossibility for the Data Controller to manage the request.

The legal basis for the processing is the fact that it is necessary for the performance of the request to which the Data Subject is party or for the pre-contractual measures adopted at the request thereof and/or for compliance with a legal obligation to which the Data Controller is subject.

The processing of personal data relating to criminal convictions and, in general, having a judicial or health-related nature is carried out only in the cases and in the manner in which such processing activity is classified as mandatory by law.

6.  METHODS OF PROCESSING AND RETENTION OF PERSONAL DATA

Processing shall be carried out:

- through the use of manual and automated systems;

- by persons or categories of persons authorised to perform the relevant tasks;

- using appropriate measures to ensure the confidentiality of the data and to prevent access thereto by unauthorised third parties.

With regard to the purpose referred to in paragraph 3 above, the data collected shall be retained for a period of 5 years, in the event that the charitable donation is not made, running from the date of communication that the request has not been accepted.

In any event, the data collected shall be retained for the period necessary for the discharge of the obligations assumed by the Parties, for the performance of any and all legal requirements and for the protection needs, including contractual protection needs, connected with or arising therefrom. There are no automated decision-making processes.

7.  COMMUNICATION OF DATA

The data collected and processed may be communicated, exclusively for the purposes specified above, to:

a) all persons/entities to whom the right of access to such data is recognised by virtue of regulatory provisions, such as, for example, public administrations and supervisory and control Authorities;

b) all the Companies of the Dolomiti Energia group indicated in the preamble with regard to the purpose referred to in paragraph 3;

c) employees, collaborators and suppliers of the Data Controller, within the scope of their respective duties and/or contractual obligations relating to the performance of the contractual relationship with the Requesting Party; by way of example, the suppliers of the Data Controller include other companies of the Dolomiti Energia group that carry out activities pursuant to intercompany service agreements, banking and credit institutions, insurance undertakings, legal consultants, lawyers, tax consultants and accountants, debt collection companies, companies that detect financial risks and carry out fraud prevention activities.

The data are not subject to dissemination.

8.  PLACE OF DATA PROCESSING

The activity is carried out within the territory of the European Union and there is no intention to transfer the data outside the European Union or to an international Organisation. Any transfers of personal data to countries located outside the European Economic Area may take place pursuant to an adequacy decision for the country by the European Commission, through adherence to specific agreements or following appropriate contractual safeguards, including binding corporate rules and standard contractual clauses for data protection

9.  RIGHTS OF THE DATA SUBJECT

The GDPR grants the Data Subject the exercise of the following rights with reference to the personal data concerning him or her (the summary description is indicative; for the complete statement of the rights, including their limitations, reference is made to the Regulation, and in particular to Articles 15-22):

- access to personal data (the right to obtain, free of charge, information regarding the personal data held by the Controller and the related processing, as well as to obtain a copy in an accessible format);

- rectification of data (correction or integration of data - not expressing evaluations - that are incorrect or inaccurate, including where they have become so because they are not up to date);

- withdrawal of consent (where the processing is carried out on the basis of consent given by the data subject, such consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to withdrawal)

- erasure of data (right to be forgotten) (for example, the data are no longer necessary in relation to the purposes for which they were collected or processed; they have been unlawfully processed; they must be erased in order to comply with a legal obligation; withdrawal or objection to the processing has occurred);

- restriction of processing (in certain cases - contesting the accuracy of the data, for the time necessary for verification; contesting the lawfulness of the processing with objection to erasure; need for use for the data subject's defence rights, while they are no longer useful for the purposes of the processing; if there is an objection to the processing, while the necessary checks are being carried out - the data shall be retained using methods such that they may, where applicable, be restored, but, in the meantime, shall not be accessible by the Controller except precisely in relation to the validity of the restriction request submitted by the data subject);

- objection in whole or in part to the processing (in certain circumstances, and in any case where the personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing, including profiling to the extent that it is related to such direct marketing);

- data portability (where the processing is based on consent or on a contract and is carried out by automated means, upon request, the Data Subject shall receive, in a structured, commonly used and machine-readable format, the personal data concerning him or her and may transmit them to another Data Controller, without hindrance from the Data Controller to which he or she provided them and, if technically feasible, may obtain that such transmission be carried out directly by the latter);

- lodging of a complaint with the supervisory authority (Italian Data Protection Authority).