Dolomiti Energia considers the protection of personal data to be a central and constant commitment.

The trust that customers, employees, suppliers and partners place in our organisation is fundamental. For this reason, Dolomiti Energia has adopted its own internal organisational model dedicated to personal data protection, which outlines the terms and methods whereby both the Holding Company and the companies subject to direction and coordination process personal data, in compliance with the principles and obligations imposed by the legislation in force, in particular Regulation (EU) 2016/679 - GDPR, the Italian Data Protection Code under Legislative Decree No. 196/2003, the measures issued by the Italian Data Protection Authority, as well as the guidelines defined by the European Data Protection Board.

THE PERSONAL DATA PROTECTION TEAM

Dolomiti Energia has designated, pursuant to Art. 37, paragraph 2, of Regulation (EU) 2016/679 - GDPR, a single Data Protection Officer for the Companies subject to direction and coordination, who may be contacted for any need relating to the protection of personal data at the certified email (PEC) address info.privacy@cert.dolomitienergia.it or at the address in via Fersina 23, 38123, Trento.

Dolomiti Energia has also identified further roles, tasks and responsibilities by creating an interdisciplinary working Team dedicated to the management of matters connected with personal data protection, composed of representatives belonging to different corporate functions, thereby contributing to the constant implementation of the Personal Data Protection Framework, within the scope of their respective corporate responsibilities, as well as to its continuous updating.

All those who process personal data within Dolomiti Energia receive training appropriate to the level of risk of the processing carried out, starting from the fundamental principles that guide data protection: lawfulness, fairness and transparency; purpose limitation; minimisation of the necessary data; accuracy of the data; storage limitation; integrity and confidentiality of the personal data processed.

MEASURES TO PROTECT PERSONAL DATA

Assessment of risks related to the processing carried out and Records of processing activities

Dolomiti Energia identifies and records the processing of personal data carried out in the various company activities within its own records, entering the information required by Art. 30 of the GDPR, monitoring the processing carried out and the related impacts on the rights and freedoms of data subjects, and ensuring constant updating in the event of new company initiatives in order to guarantee compliance with the principles of privacy by design and privacy by default. Dolomiti Energia assesses the risk arising from the processing activity and, in the cases required by Article 35 of the GDPR, uses as reference guidelines the methodologies recommended by the Italian Data Protection Authority and by the European Data Protection Board.

Technical and organisational security measures

The processing activities are carried out by means of the operations referred to in Article 4, No. 2) of the GDPR and are performed using methods suitable to ensure their security and confidentiality in accordance with the provisions laid down in Article 32 of the GDPR. Among the technical and organisational measures adopted to guarantee the security of processing, Dolomiti Energia has implemented IT security policies, backup systems, disaster recovery, security controls, monitoring through a SOC and periodic checks, adopting specific procedures, policies and regulations, which include the management of IT incidents and the management of any data breaches.

Control at the access stage and Communications of personal data

Dolomiti Energia makes the personal data processed accessible to its employees and collaborators, in their capacity as authorised persons and/or System Administrators, within the scope of their respective duties and/or contractual obligations relating to the performance of the contractual relationship with the data subjects, using proportionate and adequate measures to guarantee the confidentiality of the data and to prevent access thereto by unauthorised third parties.

Suppliers are subject to qualification, preliminary verification and continuous monitoring procedures and, where they process personal data on behalf of Dolomiti Energia, the existence on their part of sufficient guarantees to implement the technical and organisational measures required by the GDPR is preliminarily verified, before they are appointed as Data Processors, in compliance with the provisions of Art. 28 of the GDPR, and recorded in the records of processing activities. Sample audits of suppliers are also provided for in order to verify compliance with the agreed measures.

Transfers of personal data to third countries or international organisations

The processing of personal data by Dolomiti Energia takes place mainly within the territory of the European Union.

Any transfers of personal data to Countries located outside the European Economic Area take place solely following a comprehensive analysis of the risk level of the processing and where the regulatory prerequisites laid down by the GDPR are found to be met, therefore only on the basis of an adequacy decision in respect of the Country by the European Commission in compliance with the provisions of Article 45 GDPR, or on the basis of the Controller's adherence to specific agreements including adequate safeguards in compliance with the provisions of Article 46 GDPR, or, furthermore, where one of the derogations specifically provided for by Article 49 GDPR applies.

Data protection policies

Dolomiti Energia adopts procedures for the management of the data protection framework, which are inspired by the right to privacy enshrined in Article 12 of the Universal Declaration of Human Rights and by the principles set out in the General Data Protection Regulation (GDPR). The framework consists of numerous management elements consistent with the relevant guidelines, aimed at enabling the compliance of company initiatives with the applicable legislation, describing the operating procedures necessary to manage, for example, new initiatives requiring the processing of personal data or requests from data subjects. The Personal Data Protection Framework sets out the principles, roles, responsibilities, tools, operating procedures, information flows and controls relating to the management of processing records, requests from data subjects, training, and the assessment and management of external data processors, as well as any data breaches, whilst ensuring that it is constantly adapted to organisational, operational and technological developments in company initiatives involving the processing of personal data.

THE PROTECTION OF DATA SUBJECTS' RIGHTS

Transparency in communication with data subjects

Dolomiti Energia makes available to its data subjects all information relating to the protection of their personal data, in specific dedicated sections on each of the Companies' websites, under the item at the bottom of the page called "Privacy Notices":

Dolomiti Energia - https://www.gruppodolomitienergia.it/informative-privacy.html 
Dolomiti Ambiente - https://dolomitiambiente.it/it/informative-privacy
Dolomiti Energia Mercato - https://www.dolomitienergia.it/informative-privacy.html
Dolomiti Energia Solutions - https://de-solutions.it/informative-privacy
Dolomiti Edison Energy - https://dee.tn.it/content/informative-privacy
Dolomiti GNL - https://www.dolomitignl.it/content/informative-privacy
Novareti - https://www.novareti.eu/content/informative-privacy
Gasdotti Alpini - https://www.gasdottialpini.it/content/informative-privacy
Set Distribuzione - https://www.setdistribuzione.it/-/informative-privacy.html

Rights of data subjects and response procedures

Each data subject may exercise, in relation to the processing of personal data concerning him or her, the rights provided for by the GDPR, including access, rectification, erasure, restriction, objection and withdrawal of consent, by sending a communication addressed to the DPO team. Dolomiti Energia adopts specific policies in order to provide data subjects with all the required information referred to in Articles 13 and 14 of the GDPR, in compliance with the terms and procedures referred to in Article 12 of the GDPR.

Management of Data Subjects' Consents

Dolomiti Energia, for certain areas, collects and tracks the consents of data subjects received from the various contact channels, relating to marketing, profiling, commercial communications and data transfer. The consents given may be withdrawn by data subjects in accordance with the procedures indicated in the Privacy Notices.