INFORMATION ON THE PROCESSING OF PERSONAL DATA OF WEBSITE USERS
Pursuant to articles 13 and 14 of the Regulation (EU) 679/2016 (the “GDPR”)
1. Data Controller: MET Energia Italia S.p.A.
The data controller is the company MET Energia Italia S.p.A., with registered office in Milan, Viale F. Restelli, 3/7, 20124 (MI), tax code and VAT number 009985750968 (hereinafter “MET”, the “Company” or the “Data Controller”).
For any clarification on how personal data is processed by the Company, you may contact the Company at any time at the following addresses:
- email firstname.lastname@example.org
- Viale F. Restelli, 3/7, 20124 Milano (MI).
2. Data Collected
The Data Controller may collect the personal data of the users of the Website (“Users”) in the following ways:
(i) By completing the forms on the Website: (a) to send a request for a quotation to MET for the supply of energy and/or gas; (b) to execute a contract for the supply of energy and/or gas directly on the Website; (c) to send your job application to join MET; and (d) to send your job application to join MET Group (therefore also in other MET Group companies other than MET).
With reference to the application sent to MET – letter c) above – information regarding the processing of the User’s personal data for recruitment activities is available at the following link: https://it.met.com/uploads/editors/met-energia-italia-informativa-candidati-for-website.pdf
The User’s personal data collected through the forms referred to in letter (a) and (b) above are limited to those necessary to respond to the User’s request for a quotation, and/or to directly execute an energy and/or gas supply contract on the Website.
Through the forms MET collects the following personal data:
A personal data: name, surname and tax code;
B contact details: email address, telephone number, domicile (address, location, postcode);
C other data commonly indicated in the invoice that may be uploaded by the User, or in any case the data required for the activation of the supply (e.g. POD/ Pdr number, Vat number, etc.); and
D bank and billing data if the User executes the contract directly through the Website.
The User’s personal data hereinafter are indicated as “Data” or “Personal Data”.
3. Purpose and legal basis of data processing
The Data – as in the number (i) in section 2 above – will be processed only for: (a) providing the User with a quotation for a supply of energy and/or gas, or (b) executing energy and/or gas supply contract.
The legal basis for the processing is, respectively, the execution of pre-contractual measures at the request of the data subject and the execution of the contract executed by the User directly on the Website.
The provision of Data for the above purposes is mandatory and necessary. Any refusal to provide the Data will make it impossible for the Data Controller to comply with the request for the execution of the pre-contractual measures at User requests and/or to execute a contract with the User.
4. Communication of Personal Data
The Personal Data may be processed by the employees, partners and/or collaborators of the Data Controller specifically trained and authorized for processing (such as, by way of example, human resources, administrative, operations, commercial etc.).
The Data shall also be notified to other companies of the group of which Met is a member and, specifically, to the holding company (in Switzerland) in order to allow the User’s evaluation activities (creditworthiness, supply amount requested) and to provide a quotation or proceed directly with the execution of the supply contract.
Moreover, access to the Data may be granted to third parties providing services to the Company (e.g. energy and gas distributors, energy and gas service providers, providers of IT services for database management, providers of cloud storage and/or file transfer services, IT consultants, accounting consultants, legal consultants, labor consultants, offices providing payroll services).
Where these subjects do not act as autonomous data controllers, they have been specifically appointed as data processors and their information are available on request to the Data Controller.
The complete list of third-parties data processors is available at the Data Controller’s registered office and can be consulted on request sent to the Data Controller using contact details indicated in Section 7 below.
5. Place of Data processing
The Data processing shall be made at the Company’s offices and the Data shall be stored in servers and/or archives located within the European Union and in third countries for which a decision of adequacy has been taken by the European Commission and which, therefore, provide adequate guarantees of personal data protection.
The Data may also be transferred to third countries, to companies in the group to which the Data Controller is a member, or if the service providers of the Data Controller are located outside the European Union.
In case of transfers of Data outside the European Union to countries in respect of which no adequacy decision has been taken by the European Commission, the Data Controller will adopt the appropriate safeguards of Article 46 of the GDPR, and, specifically, the Standard Contractual Clauses adopted by the European Commission.
6. Methods of processing, security measures, and Data retention
Personal Data will be processed both in paper and with electronic, computerized, and automated tools, through systems that ensure their protection, security, and confidentiality.
The Data Controller has also adopted specific and adequate legal, technical, logical, and organizational measures to prevent the loss of Personal Data, unlawful or unauthorized use and/or access to them.
Personal Data will be processed for the time strictly required to achieve the purposes for which it has been collected, specifically:
a) With reference to the purpose of sending a quotation for the supply of energy and/or gas, until the execution of the supply contract – following which the provisions of letter b) below shall apply – and in any case for 12 months from the acquisition of the Data; and
b) With reference to the purpose of executing an energy and/or gas supply contract, for the entire duration of the contract and, upon termination for any reason thereof, within the period state forth by the relevant statute of limitation.
7. Rights of the Data subject
The Users, as data subjects (i.e. subjects to whom the Data refer), have the rights granted by the GDPR. In particular, pursuant to articles 12-23 of the GDPR, the data subjects are entitled to request and obtain, at any time, access to their personal data, information about data processing, personal data rectification and/or update, erasure and restriction of the processing. They are also entitled to object to processing, not to be subject to automated decisions and to request data portability (i.e. to receive personal data in a structured, commonly used, machine-readable format). Finally, the data subjects are entitled to revoke their consent at any time (in any case this shall not affect the lawfulness of the data processing carried out based on the consent given before its revocation) and to file any complaint to the supervisory (in Italy, the “Garante per la Protezione dei Dati Personali”).
The aforementioned rights may be exercised at any time upon request to be sent to the Data Controller at the following addresses:
- email email@example.com
- Viale F. Restelli, 3/7, 20124 Milano (MI).
For any other information or clarification about the abovementioned rights, the User may contact the Data Controller at the same addresses.
Information update on 30/10/2020