Looking for your energy supplier? Go to dolomitienergia.it 
Looking for your energy supplier? Go to dolomitienergia.it
Privacy
NOTICE CONCERNING THE PROCESSING OF PERSONAL DATA
GENERAL SERVICES
Pursuant to Article 12 et seq. of Regulation (EU) 2016/679 (“GDPR” or “Regulation”), this Privacy Notice concerns personal data provided by the data subject by completing contract proposals and/or to subscribe to the services offered, including online at www.gruppodolomienergia.it by completing the relevant forms, or otherwise lawfully obtained by the Controller.
1. DATA CONTROLLER
The data controller (“Data Controller” or “Controller”) is Dolomiti Energia S.p.A., with registered office in Rovereto, via Manzoni 24, Tax Code and VAT No. 01614640223, tel. +39 0464 456111 Certified email (PEC): info.holding@cert.dolomitienergia.it
2. CONTACT DETAILS OF THE PERSONAL DATA PROTECTION OFFICER
Please be informed that the Data Controller, pursuant to Art. 37 of the Regulation, has designated the Data Protection Officer (“DPO”) who may be contacted for any need relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, at the email address: info.privacy@cert.dolomitienergia.it, or at the address Via Fersina 23, Trento.
3. PURPOSES OF PROCESSING
The processing of personal data may have the following purposes:
handling of the request or report submitted by the Data Subject and, therefore, for purposes strictly connected with the management of relations, including those of a contractual nature, with the Data Subject, including administrative and accounting formalities and requirements; service communications, surveys, Dolomiti Hydrotour, visits to facilities, access to and use of all online services of the website such as, for example, requests for information, complaints, chat; this also includes compliance with regulatory obligations (arising from both national and EU sources) and with instructions issued by authorities empowered thereto by law and by supervisory and control bodies, including the adoption of measures to prevent and contain Covid-19.
4. TYPE OF DATA PROCESSED
The following categories of data may be processed: personal information; tax ID and/or VAT number; contact details; payment data, solvency, IP address.
5. LEGAL BASIS OF PROCESSING AND MANDATORY NATURE OF PROVISION
With regard to the purposes referred to in paragraph 3, there is no obligation to provide the data, but failure to provide them will make it impossible to proceed with the request.
The legitimacy of the processing of data for the purposes described and its the legal basis therefore derive from the fact that such processing is necessary to carry out the activities arising from the Data Subject’s request and to comply with any legal obligations connected thereto or, at the pre-contractual stage, to carry out the measures and activities connected with the contracting process. The adoption of measures to combat and contain the spread of the Covid-19 virus fulfils the general obligation to protect health, constituting in practice the implementation of anti-contagion protocols.
6. COLLECTION, PROCESSING METHODS AND RETENTION
Data are collected from the Data Subject, i.e. the data that the Data Subject will provide to us and those resulting from the use of the product or service or otherwise lawfully obtained by the Controller.
Processing shall be carried out:
- through the use of manual and automated systems;
- by persons or categories of persons authorised to perform the relevant tasks;
- using appropriate measures to ensure the confidentiality of the data and to prevent access thereto by unauthorised third parties.
With regard to the purpose referred to in point 3 above, without prejudice to any statutory obligation to retain documentation, the data subject’s data shall be retained for the time necessary to complete the activities connected with and consequent upon the specific processing activity.
There are no automated decision-making processes.
7. DISCLOSURE OF DATA
The data collected and processed may be communicated, exclusively for the purposes specified above, to:
a) all persons/entities to whom the right of access to such data is recognised pursuant to regulatory provisions;
b) employees, collaborators, suppliers and partners of the Controller, within the scope of their respective duties and/or contractual obligations relating to the execution of the request; the Controller’s suppliers include, by way of example, other companies within the corporate group (identifiable on the website www.gruppodolomitienergia.it) carrying out activities under intercompany service agreements, banks and credit institutions, trade associations, insurance companies, legal consultants, lawyers, tax consultants and accountants, debt recovery companies, companies that identify financial risks and carry out fraud prevention activities, entities carrying out activities on behalf of Dolomiti Energia S.p.A. under collaboration agreements, etc.;
c) public administrations and supervisory and control Authorities.
8. PLACE OF DATA PROCESSING
The activity is carried out within the territory of the European Union and there is no intention to transfer the data outside the European Union or to an international Organisation. Any transfers of personal data to countries located outside the European Economic Area may take place by virtue of an adequacy decision for the country by the European Commission, by accession to specific agreements or following appropriate contractual safeguards including binding corporate rules and standard contractual clauses for data protection.
9. RIGHTS OF THE DATA SUBJECT
The GDPR grants the Data Subject the exercise of the following rights with reference to the personal data concerning him or her (the summary description is indicative; for the complete statement of the rights, including their limitations, reference is made to the Regulation, and in particular to Articles 15-22):
- access to personal data (the right to obtain, free of charge, information regarding the personal data held by the Controller and the related processing, as well as to obtain a copy in an accessible format);
- rectification of data (correction or integration of data - not expressing evaluations - that are incorrect or inaccurate, including where they have become so because they are not up to date);
- withdrawal of consent (where the processing is carried out on the basis of consent given by the data subject, such consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to withdrawal)
- erasure of data (right to be forgotten) (for example, the data are no longer necessary in relation to the purposes for which they were collected or processed; they must be erased to comply with a legal obligation; consent has been withdrawn or an objection to processing has been made);
- restriction of processing (in certain cases - contesting the accuracy of the data, for the time necessary for verification; contesting the lawfulness of the processing with objection to erasure; need for use for the data subject’s defence rights, while they are no longer useful for the purposes of the processing; if there is an objection to the processing, while the necessary checks are being carried out - the data shall be retained using methods such that they may, where applicable, be restored, but, in the meantime, shall not be accessible by the Controller except precisely in relation to the validity of the restriction request submitted by the data subject);
- objection in whole or in part to the processing (in certain circumstances, and in any case where the personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing, including profiling to the extent that it is related to such direct marketing);
- data portability (where processing is based on consent or on a contract and is carried out by automated means, upon request, the Data Subject shall receive, in a structured, commonly used and machine-readable format, the personal data concerning him or her and may transmit them to another Data Controller, without hindrance from the Data Controller to whom he or she was provided them and, where technically feasible, may obtain that such transmission be carried out directly by the latter);
- lodging of a complaint with the supervisory authority (Italian Data Protection Authority).