INFORMATION ON THE PROCESSING OF PERSONAL DATA

In compliance with the obligations set forth by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the "Regulation"), VERBUND Green Power Italia S.r.l. (the “Company”), as data controller, hereby informs you that it will process your personal data, which may be collected, provided by you and/or communicated by other parties during your browsing and use of our corporate website [- ] (the "Website").

The processing of data that you freely provide or that is otherwise collected during your browsing of the Website will be carried out in accordance with the applicable personal data protection laws.

In particular, the processing will be based on principles of fairness, lawfulness and transparency. The data will be relevant, complete and not excessive in relation to the purposes for which it will be processed and will be collected and recorded solely for the purposes indicated in this privacy policy.

1. Who processes your Personal Data?

The data controller of your personal data ("Personal Data" or "Data") is:
Company name: VERBUND Green Power Italia S.r.l.
VAT number / tax code: 05095070750
Registered office: Corso di Porta Romana 23, 20122, Milan (MI)
Business Register: Milano Monza Brianza Lodi
Certified email address (PEC): vgpitalia@legalmail.it

2. What Data are processed?

Personal Data collected or provided by you during browsing and use of the Website will be processed, such as:

contact information: first name, last name, telephone number, e-mail address;
Website browsing data: date and time of access to the Website, your device data, IP address, your browser name and version, session identifier;
information that has been aggregated in such a way that it no longer reveals your specific identity.

For better clarity, the Website does not use cookies to collect users' Personal Data.

3. For what purposes are your Data processed?

Personal Data are processed by the Company for the following purposes:

(a) to comply with any type of obligation under applicable law;
(b) to enable you to use the features offered by the Website and obtain the information you have requested through our contact form available in the "[- ]" section;
(c) to improve and develop the Website in order to ensure its proper functioning, optimise the user experience, detect and prevent cyberattacks, investigate potential security threats and compile usage statistics.

Personal Data collected may also be processed in the context of any corporate events (transfer of the Company or business units), due diligence activities, in the event of the defence of a right before a court and related preliminary activities.

4. What is the legal basis for the processing and what are the consequences of not providing the Data?

Without prejudice to legal obligations referred to in paragraph 3, letter a), the processing of your Personal Data, which you have provided for the purposes referred to in paragraph 3, letter b), is carried out to follow up on your request and on the basis of a legitimate interest of the Company, whose business is inevitably linked to the quality of the services offered by its Website, the interaction experience with users, and the satisfaction of their expectations. Any refusal to provide Data for the above purposes will result in the impossibility of using the Website and/or submitting your contact request to the Company.

The processing of your Personal Data for the purposes referred to in paragraph 3, letter c), is based on the Company's legitimate interest in ensuring the security, functionality and improvement of the Website. This Data are collected automatically during navigation.

In the event of processing in the context of any corporate events (transfer of the Company or business units), due diligence activities, in case of the defence of a right before a court and related preliminary activities, such processing will be carried out on the basis of the Company's legitimate interests in the pursuit of its business activities and the protection of its rights.

5. What are the processing methods and what is the Data retention period?

Personal Data are processed mainly at the Company’s premises with the aid of electronic and manual means suitable to ensure their security and confidentiality, in accordance with applicable security measures. In particular, they may be processed in the following ways:

collection of Data from the data subject;
recording and processing on paper;
recording and processing on electronic/IT media;
organisation of records in both automated and non-automated form.

Personal Data will be retained, in accordance with applicable law, for no longer than necessary to achieve the purposes for which they are processed.

The criteria for determining the retention period take into account the permitted processing period and the applicable statutory limitation periods and legitimate interests where they constitute the legal basis of the processing.

Subsequently, the Data will be deleted, aggregated, or anonymized.

6. To whom may your Data be disclosed and where are they transferred?

Personal Data will be disclosed to those authorized to process them within the Company’s administrative and legal departments.
The Data may be disclosed by the Company solely and exclusively for the purposes indicated and, where necessary, to the following categories of recipients:

VERBUND Group companies;
service providers such as website hosting, IT and related infrastructure, email delivery and other services;
consulting firms, law firms, accounting firms;
where required, the competent judicial authorities;
where required, public administrations and supervisory and control authorities.

Personal Data will not, however, be disclosed to unspecified recipients. With regard to the Personal Data disclosed to them, the recipients belonging to the above categories may act, as the case may be, as data processors (and in such case will receive appropriate instructions from the Company) or as separate data controllers. In the latter case, Personal Data will only be disclosed with the express consent of the data subjects, except in cases where disclosure is required by law or necessary for the pursuit of purposes for which the data subject's consent is not required by law.

All processing of Personal Data is carried out by the Company exclusively within the European Economic Area. The Company does not transfer Personal Data to third countries. Should this become necessary, transfers will be made only to countries that ensure an adequate level of personal data protection, based on an adequacy decision of the European Commission or, with respect to countries that do not offer an adequate level of protection, following the adoption of appropriate safeguards, such as the execution of Standard Contractual Clauses (“SCCs”) pursuant to European Commission Decision 2021/914/EU.

7. What are your rights as a data subject?

At any time, you have the right to:

obtain from the Company confirmation as to whether or not processing of your Personal Data is taking place and, if so, to obtain access to the information referred to in Article 15 of the Regulation;
obtain the rectification of inaccurate Data concerning you, or, taking into account the purposes of the processing, the completion of incomplete personal data;
obtain the erasure of your Personal Data where one of the grounds referred to in Article 17 of the Regulation applies;
obtain restriction of the processing of your Personal Data where one of the conditions referred to in Article 18 of the Regulation applies;
object to the processing of your Personal Data on grounds relating to your particular situation, where applicable;
receive, in a structured, commonly used and machine-readable format, the Personal Data concerning you that you have provided and to transmit such Data to another data controller without hindrance from the data controller, if technically feasible, in the cases and within the limits referred to in Article 20 of the Regulation, where applicable.

In addition, you have the right to withdraw your consent to the processing of your Personal Data (where given) at any time, without prejudice to the lawfulness of the processing based on consent given prior to its withdrawal.

To exercise your rights, you may send a request by e-mail to: it.greenpower@verbund.com. The Company may not always be able to provide all the information requested and follow up on your requests due to applicable legal obligations and compelling legitimate reasons. The exercise of the rights listed above may, in certain cases, be delayed, limited or excluded with a reasoned communication provided without undue delay, unless the communication could jeopardize the purpose of the limitation, for the time and within the limits in which this constitutes a necessary and proportionate measure, taking into account your fundamental rights and legitimate interests. This may occur, for example, in the case of defensive investigations or in the context of exercising a right before a court and related preliminary activities. In these cases, your rights may also be exercised through the Data Protection Authority under the procedure set forth in Article 160 of the Italian Personal Data Protection Code. In such a case, the Authority will inform you that it has carried out all necessary checks or has conducted a review, as well as of your right to seek judicial remedy. In any case, the Company will do its best to comply with your requests.

Under the Regulation, the Company is not authorised to charge fees for complying with any of the requests set out in this paragraph, unless they are manifestly unfounded or excessive, in particular because of their repetitive character. In cases where you request more than one copy of your Personal Data or in cases of excessive or unfounded requests, the Company may (i) charge a reasonable fee, taking into account the administrative costs incurred to fulfil the request or (ii) refuse to comply with the request. In such cases, the Company will inform you of the costs before processing the request.

The Company may request further information before processing requests where it needs to verify the identity of the natural person who submitted them.

Without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a supervisory authority (for Italy: "Garante per la protezione dei dati personali", the Italian Data Protection Authority) if you believe that the processing of your data is in breach of the Regulation. Further information is available on the website http://www.garanteprivacy.it.

In any case, the Company encourages you to reach out to us directly through the channels indicated above before contacting the Supervisory Authority, so that any dispute regarding the protection of personal data can be amicably resolved as quickly as possible.