Privacy Policy pursuant to Regulation (EU) 2016/679 on the protection of personal data

1. Subject

This policy (“Privacy Policy”) is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) to inform you about the processing of your personal data (the “Personal Data”), as detailed below.

2. Co-Controllers of processing and Data Protection Officer (“DPO”)

Personal Data is processed by Agente Unico S.r.l. (hereinafter also “Agente Unico”), Tax Code/VAT number 12725400969, with registered office in 20121 – Milan, Foro Bonaparte n. 50 – contactable at this email address: amministrazione@agente-unico.it, together with Supermoney s.p.a. (hereinafter also “Supermoney”), Tax Code/VAT number 08883390968, with registered office in 20121 – Milan, Foro Bonaparte n. 50 – contactable at this email address: privacy@mailsupermoney.eu – together – (hereinafter referred to, separately, as the “Controller” and, collectively, the “Co-Controllers”).

Pursuant to Articles 37-39 of the GDPR, Supermoney and Agente Unico have each designated their own Data Protection Officer (“DPO”), whose contact information is provided to facilitate relations between the Data Subjects and the Controller. This figure, according to the GDPR, has been identified based on professional qualifications and carries out their tasks independently.

The DPO of Agente Unico can be reached at the following email address: dpo@agente-unico.it.

The DPO of Supermoney can be reached at the following email address: dpo@mailsupermoney.eu.

3. Types of Personal Data

The Personal Data subject to this policy, collected and processed under co-ownership, consists of the information communicated by the Data Subjects themselves in the context of promotional activities carried out by the Co-Controllers.

In particular, in order to obtain the requested service, Data Subjects may provide their Personal Data through any forms present on the Site, as well as during inbound and/or outbound phone calls with the Co-Controllers.

The Personal Data processed in the context of the consulting services offered by the Co-Controllers include: personal and contact details (first name, last name, date of birth, marital status, residence address, mobile number, email address); data related to the property for which consulting services regarding the products offered by the Co-Controllers are requested (e.g., municipality of the property, number of people living in the property, POD/PDR); information regarding your energy consumption; information about your profession and educational qualifications (profession practiced, company employed by, net monthly income, etc.) and your financial situation (existence of ongoing loans, any delinquencies); information related to the electronic devices used, location, and consumption and browsing preferences.

Additionally, the IT systems and software procedures used to operate the Portal automatically acquire certain information, such as your IP address or other parameters related to your operating system. This information could, by its nature, allow for your identification through processing and associations with other data.

4. Purposes and legal basis of processing

Personal Data is processed:

• to ensure the provision of the consulting service you requested through the Portal – in accordance with the relevant “Terms and Conditions of Use” – and/or by directly contacting Agente Unico via phone and/or through a callback form, as well as to respond accurately and promptly to your requests for information and assistance pursuant to Article 6(1) (b) of the GDPR;
• to comply with legal obligations to which the Controller is subject, such as in accounting and tax matters, in accordance with Article 6(1) (c) of the GDPR;
• to satisfy the legitimate interest in ensuring the security and proper functioning of the Portal, or for administrative-accounting purposes in accordance with Article 6(1) (f) of the GDPR;
• to assert or defend a right in court or in a pre-litigation phase, pursuant to Article 6(1) (f) of the GDPR.

Only with your specific, free, and informed consent, pursuant to Article 6(1) (a) of the GDPR, the Controller may:

• enrich your Personal Data within their commercial database over time, using monitoring tools on electronic communication networks including cookies, tags, and other instruments, in order to understand your preferences, needs, and consumption and professional habits, and more generally to carry out profiling activities, including through comparisons and integration with data collected from third parties;
• contact you via automated tools (e.g., automated calls and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated means (e.g., phone with operator, physical mail) to update you on the Controller's product and service offers;
• contact you via automated tools (e.g., automated calls and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated means (e.g., phone with operator, physical mail) to update you on offers for products and services from third-party controllers;
• communicate your Personal Data to third parties with which the Controller has qualified business relationships and belonging to different categories, including particularly, financial companies, financial agents, energy, electricity, gas suppliers, customer care and sales services both in and out of retail premises (contact centers, door-to-door, mall points, flagship), parties operating in the information and marketing sector, companies active in direct marketing and list brokering (collectively, the “Main Recipients”). These subjects will process the Personal Data for their own commercial contact purposes through automated means (e.g., automated calls and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated means (e.g., phone with operator, physical mail).

Agente Unico may send you emails to promote goods and/or services similar to those for which you requested consulting services from Agente Unico, without your consent, but you have the right to object to such communications at any time.

5. Nature of providing Personal Data and consequences of any refusal to respond

Providing your Personal Data is necessary in order to allow the Co-Controllers to deliver the requested services and to comply with legal obligations to which they are subject. Failure to provide such information will prevent you from benefiting from the services offered by the Co-Controllers.

6. Recipients of Personal Data

Your Personal Data will be processed only by internal personnel of the Co-Controllers' organization, assigned to processing and specifically trained – in full compliance with Article 29 of the GDPR and Article 2-quaterdecies of the Privacy Code – in relation to the performance of their work duties. Furthermore, within the scope of the aforementioned purposes, the data may be communicated to third-party companies contracted as data processors under Article 28 of the GDPR, as well as to independent third-party data controllers to whom it is mandatory to communicate your personal data under legal provisions or orders from authorities. The list of data processors can be requested from the Co-Controllers at the contact details provided above.
In any case, logical and physical security and confidentiality of the processed information will be ensured.

7. Processing methods

The processing of Personal Data will be carried out – in accordance with the principles of fairness, legality, and transparency – using IT, manual, and/or telematic means, with logic strictly related to the purposes for which the data was collected and, in any case, ensuring the security and confidentiality of the processed data.

8. Data retention period

Your Personal Data will be retained for a period of time not exceeding what is necessary for the purposes for which they were collected and processed. The criteria for defining the retention period are as follows:

• for the time necessary to fulfill the contract and for the purposes indicated in this Privacy Policy;
• to comply with the obligations established by applicable laws, including tax obligations, as well as for the time necessary for the exercise or defense of a right in court;
• for as long as necessary for the pursuit of the purposes for which the data was collected, in any case for a period not exceeding 12 months for profiling purposes.

9. Rights of the Data Subject

Pursuant to Articles 15-22 of the GDPR, you have the right to:

• access your Personal Data;
• rectify your Personal Data;
• erase your Personal Data;
• limit the processing of your Personal Data;
• data portability;
• object to the processing of your Personal Data.

You can exercise these rights by sending a request to the contact details of the Co-Controllers provided above.
You also have the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali) in the event that you consider that the processing of your Personal Data infringes applicable law.

10. Rights of the Data Subject

You may exercise the rights under Articles 15 to 22 of the GDPR at any time and, in particular, obtain:

• confirmation as to whether or not Personal Data concerning you is being processed and access to the data and the following information: purposes of processing, categories of Personal Data, recipients and/or categories of recipients, retention period;
• the rectification of inaccurate Personal Data concerning you and/or the completion of incomplete Personal Data, including by providing a supplementary statement;
• the erasure of Personal Data in cases provided for by the GDPR;
• the restriction of processing in the cases provided for by applicable privacy legislation;
• data portability concerning you, specifically the right to request the direct transmission of your data to another data controller.

Additionally, you have the right to withdraw any consent you may have given at any time, without affecting the lawfulness of processing based on consent before its withdrawal, as well as the right to object, at any time, to the processing of Personal Data, pursuant to Article 21 of the GDPR. In the event of an objection to the processing of Personal Data carried out for direct marketing purposes and for the profiling activities related to such direct marketing, you will obtain immediate cessation of processing. We inform you that you may exercise the right to object to processing for marketing purposes even in relation to one or more specific contact channels (for example, you may decide to continue being contacted by the operator but not to receive SMS or emails anymore). In any case, if the contact channel regarding which the right is exercised is not specified, the objection to the processing of Personal Data will be understood to extend to all communication methods used.

If you believe that the processing of Personal Data is occurring in violation of the provisions of the Regulation, you have the right to lodge a complaint with the Italian Data Protection Authority as provided by Article 77 of the GDPR, or to take appropriate judicial action. Requests to exercise your rights should be addressed to the contact details provided in paragraph 2 of the Privacy Policy. Any modification, deletion, or restriction of processing carried out at your request or following the withdrawal of your consent – unless this is impossible or involves a disproportionate effort – will be communicated by each controller to the other, as well as to each of the recipients to whom the Personal Data has been communicated.

Last updated: October 2024