Privacy Notice Alpiq Group

Alpiq Energia Italia S.p.A. is responsible as the controller for your personal data:

Alpiq Energia Italia S.p.A.
Via Marostica 1,
20146 Milano
E-mail: external.relations.itamail@alpiqweb.com
Tel. +39 02 36698 1
(hereinafter "Controller")

To ask questions or make comments on this Notice and our privacy practices or to make a complaint about our compliance with applicable data protection laws, please contact us or our local privacy contact. You can find all contact details by clicking here.

If you browse (i) our website located at the following address: www.alpiq.com or (ii) our mobile applications (hereinafter "Online Applications") operated by the Controller, or if you (hereinafter “User”) use the functional options provided in the Online Applications, such as the optional newsletter and other related information sent by the Controller, post your opinions/comments on the Online Applications, or view our official social network profiles (including Facebook, LinkedIn, Instagram and YouTube, together hereinafter “Social Network Profiles”); or

If you, as a natural person, are a (potential) customer (hereinafter "Customer") using the products and services offered by the Controller, or a (potential) supplier, contractor or subcontractor (hereinafter "Supplier"); or

If you are a natural person acting on behalf of a (potential) Customer or Supplier, or the contact person of a Customer or Supplier, including its employees or associates (hereinafter “Representative”); or

If you contact us by phone or SMS, electronically by e-mail or chat, via contact form, or by post, on any matter, or the Controller contacts you by phone or SMS, electronically by e-mail or by post on any matter, and you are not concurrently a Customer, Supplier or a Representative (hereinafter “Contact Person”);

then this Privacy Notice is addressed to you.

When you visit our website or use our Online Applications:
If you browse our websites or use our Online Applications - we automatically collect some of your personal data. Please read our "Cookie Notice" on www.alpiq.com for more detailed information.

When concluding a contract with us:
You may act as a Representative or a Customer, by concluding a contract with us. For this purpose, we collect your first and last name, e-mail address, your phone number.

When you create an account on our website:
We collect your first and last name, your e-mail address, your phone number as well as your assigned account number and your chosen password.

When you subscribe to our newsletter:
We collect your e-mail address, your first and last name and information on the ordered product.

When you submit a contact request:
We collect your contact details and information on your contact request, which may include your name, e-mail, telephone number and home or business address.

When you submit a media enquiry:
We collect your contact details and information on your media enquiry.

When you submit a data subject rights request:
We collect your e-mail address, your first and last name, and, if you provide us with this, maiden name, birthdate and address, as well as for identification reasons, a picture of your official identification (e.g. ID, passport).

When you consent to marketing activities:
We collect your consent to send you commercial messages by electronic means or consent for marketing via telephone or electronic means, or you enter a survey or similar activity organised or co-organised by the Controller (hereinafter "Marketing Consent").

When you apply for a job:
We collect your contact details, your written application, CV and certificates/ diplomas if you apply for a job at the Controller. We will provide you with detailed information on processing your personal data during recruitment process.

In most cases, we will obtain your personal data directly from you, i.e. directly from the person to whom the personal data relates (data subject).

For Customers, Suppliers, Contact Persons or Representatives, we may also obtain your personal data from other sources, such as your employers, customers, clients, or associates, the entities represented by you, or from publicly available sources, including information provided on public websites, public accounts on social networks or via the publicly accessible databases of our external business partners.

When collecting your personal data from sources other than directly from you, we may process the following categories of personal data: name, job/work status, home or business address, telephone number, e-mail, business (company) name, VAT number or business identification number.

If the provision of your personal data is associated with:

• conclusion of a contract with the Controller - its provision is voluntary, but it is also a condition for the conclusion of a contract, as a contract cannot be concluded with the Controller without the provision of your personal data;

• contacting the Controller - its provision is voluntary, but the Controller cannot be contacted for the designated purpose without the provision of your personal data and thus it is not possible to obtain answers to your inquiry or questions;

• obtaining commercial messages by electronic means or for direct and indirect marketing by telephone or electronic means - its provision is voluntary, but you cannot receive commercial messages by electronic means without the provision of your personal data, and the Controller cannot contact/message you by telephone or electronic means for direct or indirect marketing in your case;

• browsing the Online Applications or our Social Network Profiles - its provision is voluntary, but you cannot use the functions on the Online Applications or Social Network Profiles (e.g. you cannot write comments or view the Controller’s posts under news on our Social Network Profiles, posts cannot be liked, recommended, etc.) without the provision of your personal data.

NOTE: Please read the "Cookie Notice" for more detailed information about personal data collected automatically when browsing the Online Applications.

We process your personal data for the following purposes, on the following legal basis and for the following period:

3.1.1 For the purposes and to the extent necessary for the performance of a contract concluded between the Customer or Supplier and the Controller or for taking steps prior to the conclusion of such a contract, including handling Customer complaints and ensuring Customer service by the Controller, after the conclusion of such a contract in connection with the services provided:

• the legal basis for processing your personal data is its necessity for the performance of the contract to which you are a party or in order to take steps before the conclusion of the contract at your request;

• in such a case, your personal data will be processed for the duration of the performance of the Controller and/or Customer’s obligations under such a contract;

3.1.2 For the purpose of fulfilling the legal obligations imposed on the Controller, in particular arising from tax and accounting regulations, including obligations relating to recording economic events (issuing or posting invoices) and archiving obligations:

• the legal basis for processing your personal data is a legal obligation imposed on the Controller;

• in such a case, your personal data will be processed for as long as the applicable legislation instructs us to keep your personal data, for example, for tax or accounting reasons;

3.1.3 For the purpose of determining and enforcing claims by the Controller or defending against such claims:

• the legal basis for processing your personal data is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of the protection of its rights;

• in such a case, your personal data will be processed until the expiration of the statute of limitations on claims arising from contracts concluded between the Controller and Customers / Suppliers or other similar circumstances;

3.1.4 For the purpose of contact between the Controller and Contact Persons or Representatives on current matters (e.g. data concerning ongoing cooperation, answers to questions, lodging a request, etc.):

• the legal basis for processing your personal data is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of the need to contact the Contact Persons and/or Representatives and/or Customers / Suppliers in connection with the current matter between the Controller and the Customer / Supplier, or responding on questions and requests;

• in such a case, your personal data will be processed for as long as necessary to answer or solve the current matter.

3.1.5 For the purpose of completing verification of the Customer’s payment credibility by the Controller:

• the legal basis for processing your personal data is the Controller’s legitimate interests in reducing of losses due to unpaid invoices, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject with you as the Customer;

• in such a case, your personal data will be processed for no longer than until the termination of the contract between the Controller and the Customer, except country-specific regulations provide otherwise;

3.1.6 For the purpose of completing a customer satisfaction survey by the Controller:

• the legal basis for processing your personal data is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of the ability to obtain information about your satisfaction with the services provided by the Controller, and the ability to ensure the continuous improvement of the standards and quality of these services;

• in such a case, your personal data will be processed for no longer than until the termination of the contract between the Controller and the Customer;

3.1.7 For the purpose of the Controller’s marketing, including offers of the Controller’s products and services, technical and related information, as well as other types of messages such as newsletters and other informational updates;

• the legal basis for processing your personal data for the purposes of direct marketing is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of the realisation of direct marketing by the Controller; the legal basis for processing your personal data for the purposes of indirect marketing is your Marketing Consent, and

• in such a case, your personal data will be processed for the duration of the realisation of the above objective by the Controller, i.e. for the duration of marketing, but under no circumstances longer than upon receiving your submitted objection / withdrawal (opt-out).
  
  NOTE: We will only process your personal data for direct marketing purposes through electronic means of communication, including e-mail messages, or by telephone, if you grant us Marketing Consent, which you can withdraw at any time without having to state the reasons for withdrawal. Withdrawal of Marketing Consent will not affect the legitimacy of processing completed on the basis of Marketing Consent prior to its withdrawal.

3.1.8 For the purpose of managing the Controller’s Social Network Profiles, including interaction with the Controller via Social Network Profiles:

• the legal basis for processing your personal data for the purposes of direct marketing is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of the promotion of the Controller’s products and services including its brands, providing information about events and professional events or events related to the Controller’s activity, and ensuring social media support for the Controller’s business;

• in such a case, your personal information will be processed for as long as the Controller manages its Social Network Profiles, but no longer than until you decide to remove your personal data from our Social Network Profiles (e.g., remove your comments or "likes");

3.1.9 For the Controller’s analytical and statistical purposes:

• the legal basis for processing your personal data for the purposes of direct marketing is the Controller’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, consisting of analysing User activity and preferences to improve the functionality of our Online Applications;

• in such a case, your personal data will be processed for the period that the Controller conducts analyses and statistics in relation to its Online Applications or for the period specified in applicable laws in your country.

The Controller does not make automated decisions, based solely on the automatic processing of personal data, including profiling.

We might use the remarketing function of Google Inc. This enables us to show you interest-based advertising within the Google advertising network. For this purpose, a "cookie" is stored on your computer. For more information about “cookies” please read our Cookie Notice.

Our websites may also contain social plug-ins from third parties. All integrated social plugins work via the double-click procedure. This means that the respective plugins are only activated when you click on the icon of the network provider.

Your connection to a social network, the data transfers taking place between the network and your system and your interactions on this platform are exclusively subject to the data protection regulations of the respective network.

The social plugin remains active until you deactivate it or delete your cookies via the settings in your browser or explained in our Cookie Notice.

In order to provide you with functional and high-quality services, we work with trusted and reliable business partners, who may be recipients of your personal data. Our partners approach the confidentiality of your personal data very seriously. Your personal data may be provided to the following recipients (including other controllers, who process personal data at their own expense and by their own means, or to meet the purpose of processing data by the Controller).

5.1.1 External Provisioning

The recipients of your personal data may be external business entities in the following categories:
a. IT services providers;
b. registers of debtors;
c. providers of related products and services that are a party to a contract with us;
d. entities providing postal delivery services;
e. customer service providers, including telephone or electronic call centres;
f.  entities providing accounting, financial or tax services;
g. entities providing legal and debt recovery services;
h. entities providing advertising, marketing and / or research services;
i. payment service providers;
j. entities authorised to receive such data under applicable law (e.g., the courts, criminal justice or other state authorities).

5.1.2   Internal Provisioning

We may transfer on your personal data within the Alpiq Group in order to fulfil contractual obligations, within the scope of our legitimate interests for administrative purposes or based on your consent within the Group.
For more information, please contact us here.

The Controller may decide to provide your personal data to entities established outside the European Economic Area (EEA), in particular to Switzerland (so-called "third country").

The transfer of your personal data to other third countries with an adequate level of protection of personal data is based on the relevant adequacy decisions by the European Commission and the Swiss Federal Data Protection.

The controller may also transfer your personal data to third countries without laws in place that protect your personal data to the same extent as in Switzerland or the EEA. In this case the controller provides appropriate safeguards such as imposing binding corporate rules or standard contractual clauses recognised by the relevant data protection authority.

You have the following rights in relation to the processing of your personal data:

6.1.1 Right to withdraw consent – whenever the Controller processes your personal data based on your consent, you may withdraw your consent at any time without having to specify the reasons for such withdrawal;

6.1.2 Right to access your personal data – you have the right to receive confirmation on whether or not your personal data is processed by us, and if so, to obtain a copy of your personal data, as well as further information such as the purpose of processing, the recipients or categories of recipients to whom we have your personal data disclosed; the planned period for retaining this data or the criteria for determining this period;

6.1.3 Right to rectify your personal data – you have the right to require that incomplete or inaccurate personal data that we process about you is amended;

6.1.4 Right to the deletion of your personal data – you have the right to request that we delete your personal data, if it is no longer needed for the purposes for which it was collected, you have withdrawn your consent and there is no other legal basis for the processing, you have effectively objected to the processing or your personal data has been processed unlawfully, but we may retain your personal data if this is required in order to comply with legal obligations or to establish or defend legal claims;

6.1.5 Right to restrict the processing of your personal data – you have the right to request that we restrict the processing of your personal data in any of the following cases: (i) you believe such data is inaccurate; (ii) processing is unlawful and you request the restriction of personal data instead of its deletion; (iii) we no longer need your personal data, but you require them for the purpose of making a legal claim; or (iv) you object to the processing of your personal data and we verify the legitimacy of your request;

6.1.6 Right to the portability of your personal data – you have the right to request that we transmit personal data concerning you in a structured, commonly used and machine-readable format to you or to another controller, if this is personal data that you have provided to us and we are processing this personal data on the basis of your consent or in order to perform a contract between you and us; and the processing is carried out by automated means;

6.1.7 Right to object to the processing of your personal data – whenever we processes your personal data for purposes based on our legitimate interests, you have the right to object to such processing on grounds relating to your particular situation; we will follow your request unless we have compelling legitimate grounds for the processing which override your interests or rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim; if we process your personal data for direct marketing purposes, which includes profiling to the extent of direct marketing, your objection to processing will always be accepted.

If you wish to exercise your rights, we kindly ask you to use the contact form here. You can select country or language. If you like to send us a letter or e-mail, please find the address and e-mail address here:

Alpiq Energia Italia S.p.A.
Partner Locale per la Protezione dei Dati
Via Marostica 1
20146 Milano

E-Mail: privacy.aei.itamail@alpiqweb.com

If you have any questions about these rights or the processing of your personal data, please contact our Local Privacy Partner – see Part 6.2.

If you are in the EU, you have the right to lodge a complaint with the local Data Protection Authority if you believe that we have not complied with applicable data protection laws. Your local supervisory authority can be contacted as follows:

Garante per la protezione dei dati personali
Piazza Venezia n. 11, scala B
00187 Roma, Italia
Telefono: +39 06.69677.2917
E-Mail: urpmail@gpdpweb.it

We use technical and organizational security measures to protect your data managed by us against manipulation, loss, destruction and against access by unauthorized persons. We continuously improve our security measures in accordance with technological developments.

Our websites and Online Applications may contain links to other websites belonging to or administered by third parties. We are not responsible for the processing of personal data by these third parties on other websites, including the privacy policies, information clauses and other similar documents contained on these websites.

We reserve the right to make changes or updates to our Privacy Notice in the future. This may in particular be necessary due to changes in applicable data protection legislation or data protection guidelines issued by the supervisory authority, but also in connection with any changes in the administration of the websites or Online Applications by the Controller or in Customer Services or service processes to Suppliers. The latest version of this Privacy Notice is always available on www.alpiq.com.