Pursuant to Article 12 et seq. of Regulation (EU) 2016/679 ("GDPR" or "Regulation"), you are informed that this notice relates to the personal data provided by the Data Subject or lawfully obtained by the Controller and processed in relation to the procurement procedures of the companies belonging to the Dolomiti Energia Group, namely:

Dolomiti Energia S.p.a., with registered office in Rovereto, Via Manzoni No. 24, Tax Code and VAT No. 01614640223, tel. 0464 456111, PEC: info.holding@cert.dolomitienergia.it;

Dolomiti Energia Mercato S.p.a., with registered office in Trento, Via Fersina No. 23, Tax Code and VAT No. 01812630224, tel. 0461362330, PEC: info.commerciale@cert.dolomitienergia.it;

Novareti S.p.a. with registered office in Rovereto, Via Manzoni No. 24, Tax Code and VAT No. 01405600220, tel: 0464 456111, certified email (PEC): info@cert.novareti.eu;

Società Elettrica Trentina per la Distribuzione di Energia Elettrica S.p.a., with registered office in Rovereto, Via Manzoni no. 24, Tax Code and VAT number 01932800228, tel: 046445611, certified email (PEC): info@cert.setdistribuzione.it;

Dolomiti Energia Solutions S.r.l., with registered office in Trento, Via Fersina no. 23, Tax Code and VAT number 01840970220 tel: 0461 362222, certified email (PEC): info.des@cert.dolomitienergia.it;

Dolomiti Ambiente S.r.l. with registered office in Rovereto, Via Manzoni no. 24, Tax Code and VAT number 02352570226, tel: 0464 456111, certified email (PEC): info@cert.dolomitiambiente.it;

Dolomiti Energia Trading S.p.a., with registered office in Trento, Via Fersina no. 23, Tax Code and VAT number 03027910235, tel: 0461 362222, certified email (PEC): info.trading@cert.dolomitienergia.it;

Dolomiti Gnl S.r.l., with registered office in Trento, Via Fersina no. 23, Tax Code and VAT number 02341970222, tel: 0461 362222, certified email (PEC): info@cert.dolomitignl.it;

Dolomiti Edison Energy S.r.l., with registered office in Trento, Via Fersina no. 23, Tax Code and VAT number 02051850226 tel: 0461 362222, certified email (PEC): info@cert.dee.tn.it;

Hydro Dolomiti Energia S.r.l.  with registered office in Trento, viale Trieste No. 43, Tax Code and VAT No. 02075180220, tel: 0461 457111, PEC: hde.pec@hde.legalmail.it.

Gasdotti Alpini S.r.L., with registered office in Rovereto (TN), via Manzoni, 24 (TN), Tax Code and VAT No. 02602460228, tel. +39 0464 456111 - PEC: info@cert.gasdottialpini.it

For further information, please refer to the website www.gruppodolomitienergia.it

1. DATA CONTROLLER

The data controller (i.e. the entity that determines the purposes and means of the processing of personal data) is the company of the Dolomiti Energia Group with which the Economic Operator enters into a relationship for the specific purpose (see point 3 below). In particular:

- in relation to the purpose of managing the Supplier Register (point 3 letter a), the data controller is Dolomiti Energia S.p.A.;

- in relation to the purpose of selecting the contracting party (point 3 letter b), Dolomiti Energia S.p.A. (where it manages the award procedure) and, in any event, the Dolomiti Energia Group company involved in the procurement are independent Data Controllers;

- in relation to the contractual purpose (point 3 letter c), the Data Controller is the Dolomiti Energia Group company with which the contract is entered into.

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Please note that the companies of the Dolomiti Energia Group have appointed, pursuant to Article 37 of the Regulation, a single Data Protection Officer ("DPO"), who may be contacted for any matters relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, at the email address: info.privacy@cert.dolomitienergia.it, telephone 0461 362222, or at the address Via Fersina 23, Trento.

3. PURPOSES OF PROCESSING

The processing of personal data may have the following purposes:

a) carrying out the activities relating to the qualification procedure for economic operators interested in being accredited in the Supplier Register used by all the Companies of the Dolomiti Energia Group, the management and updating thereof, and the related regulatory requirements (purpose of managing the Supplier Register);

b) carrying out the operations for selecting the contracting party and related regulatory requirements (purpose of selecting the contracting party);

c) entry into the contract between the Economic Operator and the relevant company of the Dolomiti Energia Group, and subsequent performance of the contractual phase, with execution and fulfilment of the contractual obligations (borne by and in favour of the Controller), and therefore for purposes strictly connected with the management of the contractual relationship, including administrative and accounting formalities and obligations, as well as the protection of rights; fulfilment of regulatory obligations (arising from both national and EU sources) and of provisions issued by authorities legally empowered to do so and by supervisory bodies is also included (contractual purpose).

4. TYPE OF DATA PROCESSED AND METHODS OF COLLECTION

The following categories of data, relating to natural persons attributable to the Economic Operator, may be processed, such as, for example: owner, shareholders, directors, technical directors, members of supervisory and control bodies, as well as cohabiting family members of the above-mentioned persons, employees, commercial representatives and attorneys:

ordinary data: personal identification data, tax ID code and/or VAT number; contact details, email address; address and street number; composition of the household; data belonging to special categories: data relating to criminal convictions and offences.

The data collected and processed are those communicated by the Economic Operator and those acquired from Public Bodies and Authorities pursuant to specific legal provisions (in particular, the INPS and INAIL Bodies and the Tax Administration, the Criminal Records Register and, in general, Bodies and Authorities with which the Controller may verify the requirements of the Economic Operator are indicated).

5. POSSIBLE MANDATORY NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

There is no obligation to provide the data, but failure to provide them shall make it impossible to proceed with the activation of the qualification procedure for the Economic Operator and to conclude any contract. Once the qualification procedure has been activated or the contract has been entered into, the provision of any further necessary data, or the updating of data already provided, is mandatory for everything required by legal and contractual obligations and, therefore, any refusal to provide them in whole or in part may make it impossible for the Data Controller to complete the qualification procedure and/or enter into the contract and may in any case constitute a contractual breach or breach of law by the Economic Operator.

The legal basis for the processing is the fact that it is necessary for the performance of the contract to which the Data Subject is party or for the pre-contractual measures adopted at the request of the same and/or for compliance with a legal obligation to which the controller is subject.

The processing of personal data relating to criminal convictions and, in general, having a judicial or health-related nature is carried out only in the cases and in the manner in which such processing activity is classified as mandatory by law.  

6. METHODS OF PROCESSING AND RETENTION OF PERSONAL DATA

Processing shall be carried out:

- through the use of manual and automated systems;

- by persons or categories of persons authorised to perform the relevant tasks;

- using appropriate measures to ensure the confidentiality of the data and to prevent access thereto by unauthorised third parties.

With regard to the purpose referred to in the preceding paragraph 3 point 1), the data collected shall be retained until the expiry of 5 years from the date of removal of the Economic Operator from the Register or, in the event of non-qualification, from the date of communication that registration has not taken place.

With regard to the purpose referred to in paragraph 3 point 2) above, in the event that the contract is not awarded to the Economic Operator, the data collected shall be retained until the maximum term of five years from the date of award to third parties.

In any event, the data collected shall be retained for the period necessary for the discharge of the obligations contractually assumed by the Parties, for the performance of any and all legal requirements and for protection requirements, including contractual protection requirements, connected therewith or deriving therefrom. There are no automated decision-making processes.

7. COMMUNICATION OF DATA

The data collected and processed may be communicated, exclusively for the purposes specified above, to:

a) all persons/entities to whom the right of access to such data is recognised by virtue of regulatory provisions, such as, for example, public administrations and supervisory and control Authorities;

b) all Companies of the Dolomiti Energia Group as regards the purpose referred to in letter a) of point 1, namely management of the Supplier Register;

c) employees, collaborators and suppliers of the Data Controller, within the scope of their respective duties and/or contractual obligations relating to the performance of the contractual relationship with the Economic Operator; among the suppliers of the Controller, by way of example, the following are indicated: other companies of the Dolomiti Energia Group that carry out activities pursuant to intercompany service agreements, banking and credit institutions, insurance companies, legal consultants, lawyers, tax consultants and accountants, debt collection companies, companies that detect financial risks and carry out fraud prevention activities;

The data are not subject to dissemination.

8. PLACE OF DATA PROCESSING

The activity is carried out within the territory of the European Union and there is no intention to transfer the data outside the European Union or to an international Organisation. Any transfers of personal data to countries located outside the European Economic Area may take place pursuant to an adequacy decision for the country by the European Commission, through adherence to specific agreements or following appropriate contractual safeguards, including binding corporate rules and standard contractual clauses for data protection

9. RIGHTS OF THE DATA SUBJECT

The GDPR grants the Data Subject the exercise of the following rights with reference to the personal data concerning him or her (the summary description is indicative; for the complete statement of the rights, including their limitations, reference is made to the Regulation, and in particular to Articles 15-22):

- access to personal data (the right to obtain, free of charge, information regarding the personal data held by the Controller and the related processing, as well as to obtain a copy in an accessible format);

- rectification of data (correction or integration of data - not expressing evaluations - that are incorrect or inaccurate, including where they have become so because they are not up to date);

- withdrawal of consent (where the processing is carried out on the basis of consent given by the data subject, such consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to withdrawal)

- erasure of data (right to be forgotten) (for example, the data are no longer necessary in relation to the purposes for which they were collected or processed; they have been unlawfully processed; they must be erased in order to comply with a legal obligation; withdrawal or objection to the processing has occurred);

- restriction of processing (in certain cases - contesting the accuracy of the data, for the time necessary for verification; contesting the lawfulness of the processing with objection to erasure; need for use for the data subject's defence rights, while they are no longer useful for the purposes of the processing; if there is an objection to the processing, while the necessary checks are being carried out - the data shall be retained using methods such that they may, where applicable, be restored, but, in the meantime, shall not be accessible by the Controller except precisely in relation to the validity of the restriction request submitted by the data subject);

- objection in whole or in part to the processing (in certain circumstances, and in any case where the personal data are processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing, including profiling to the extent that it is related to such direct marketing);

- data portability (where processing is based on consent or on a contract and is carried out by automated means, upon request, the Data Subject shall receive, in a structured, commonly used and machine-readable format, the personal data concerning him or her and may transmit them to another Data Controller, without hindrance from the Data Controller from whom he or she was provided them and, where technically feasible, may obtain that such transmission be carried out directly by the latter);

- lodging of a complaint with the supervisory authority (Italian Data Protection Authority).