Privacy Policy pursuant to Regulation (EU) 2016/679 on the protection of personal data

1. Purpose

This privacy policy (“Privacy Policy”) is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) to inform you about the processing of your personal data (the “Personal Data”), detailed as follows.

2. Data Controller and Data Protection Officer

The processing of your Personal Data aimed at providing personalized consulting services in the energy and gas sectors, available on the website portal https://www.agente-unico.it (the “Portal”) and via telephone is carried out by Agente Unico S.r.l. (hereinafter also the “Company” or “Agente Unico”), with registered office in Milan (MI), Foro Buonaparte n. 50 (CAP 20121), Tax Code and VAT Number 12725400969, registered with the Milan Chamber of Commerce under No. MI2680354.

Only with your specific consent, your Personal Data may also be processed autonomously by third parties you have authorized. For any information regarding the processing of Personal Data, as well as for the exercise of your rights, you can contact the Data Controller at any time at the email address: privacy@agente-unico.it, or contact the designated data protection officer under Article 37 of the GDPR (the “Data Protection Officer” or “DPO”) at the following email address: dpo@agente-unico.it.

3. Types of Personal Data

The Personal Data covered by this Privacy Policy may have various nature and sources. You may have previously authorized third parties to provide your Personal Data to the Data Controller for commercial contact purposes. You may also have provided information by filling out a specific form available on the Portal and/or during telephone contacts made by the Data Controller following your specific consent or your request to benefit from the consulting service offered by Agente Unico. The Personal Data processed in the context of the consulting activity provided by the Data Controller include: personal and contact data (name, surname, date of birth, marital status, residence address, mobile number, email address); data relating to the property for which the consulting service for the products offered by the Data Controller is requested (for example, municipality of the property, number of people living in the property, POD/PDR); information regarding your energy consumption; information about your profession and your educational qualifications (profession exercised, company name, net monthly income, etc.) and your financial situation (existence of ongoing loans, any payment defaults); information related to the electronic devices used, location, and consumption and navigation preferences.

Additionally, the IT systems and software procedures responsible for the functioning of the Portal automatically acquire some information, such as your IP address or other parameters related to your operating system. This information, by its nature, may, through processing and association with other data, allow for your identification.

4. Purposes and Legal Basis of Processing

Personal Data is processed:

• to ensure the provision of the consulting service you requested via the Portal - in accordance with the related “Terms and Conditions of use” – and/or by directly contacting Agente Unico by phone and/or through a contact form, as well as to respond promptly and accurately to your requests for information and assistance pursuant to Article 6(1)(b) of the GDPR;
• to comply with legal obligations to which the Data Controller is subject, for example in accounting and tax matters, in accordance with Article 6(1)(c) of the GDPR;
• to satisfy the legitimate interest in ensuring the security and proper functioning of the Portal, or for administrative-accounting purposes in accordance with Article 6(1)(f) of the GDPR;
• to assert or defend a right in court or in a pre-litigation phase, pursuant to Article 6(1)(f) of the GDPR.

Only with your specific, free, and informed consent, pursuant to Article 6(1)(a) of the GDPR, the Data Controller may:

• enrich over time your Personal Data within its commercial database, using monitoring tools on electronic communication networks including cookies, tags, and other tools, to understand your preferences, needs, and consumption and professional habits, and more generally, to carry out profiling activities, also through comparison and integration with data collected from third parties;
• contact you through automated tools (e.g., automated and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated tools (e.g., operator phone calls, paper mail) to update you on offers of products and services from the Data Controller;
• contact you through automated tools (e.g., automated and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated tools (e.g., operator phone calls, paper mail) to update you on offers of products and services from third parties;
• communicate the Personal Data to third parties that have qualified business relationships with the Data Controller and belonging to different categories, particularly, to financial companies, financial agents, suppliers of energy, light, gas, customer care services, and sales outside and inside commercial premises (contact center, door-to-door, mall point, flagship), entities operating in the information and marketing sector, companies active in direct marketing and list brokering (all together, the “Main Recipients”). These parties will process the Personal Data for their own commercial contact purposes using automated means (e.g., automated and/or operator calls, SMS, push notifications, emails, instant messaging apps, social network messages) and non-automated means (e.g., operator phone calls, paper mail).

Agente Unico may send you emails to promote goods and/or services similar to those for which you have requested consulting services from Agente Unico, without your consent, while maintaining your right to object to such communications at any time.

5. Nature of the Provision of Personal Data and Consequences of Any Refusal

The provision of your Personal Data is optional. However, some Personal Data is necessary for us to provide the consulting service you requested via the Portal and/or by directly contacting Agente Unico by phone and/or through a contact form, as well as to respond promptly and accurately to your requests for information and assistance pursuant to Article 6(1)(b) of the GDPR and to comply with legal obligations to which we are subject. The failure to provide such information will prevent you from benefiting from the services offered by Agente Unico. The Company may request your consent to carry out further processing of your Personal Data. The failure to provide one or more required consents will not prevent you from benefiting from the service offered by Agente Unico.

6. Methods of Processing

The processing of Personal Data will occur – according to the principles of fairness, lawfulness, and transparency – through computer and/or manual and/or telematic tools, with logic strictly related to the purposes of the processing and, in any case, ensuring the confidentiality and security of the data themselves and compliance with specific obligations established by law. The availability, management, access, storage, and usability of data referring to you are guaranteed by the adoption of technical and organizational measures to ensure adequate security levels pursuant to Articles 25 and 32 of the GDPR, as well as, concerning the specific purposes of processing identified by the personal data protection legislation, to ensure compliance with the principles of necessity and minimization.

7. Data Retention Period

Personal Data will be retained only for the time strictly necessary for the purposes for which it was collected, in compliance with the principle of minimization set forth in Article 5(1)(c) of the GDPR, as well as the legal obligations to which each data controller is subject. If you decide to withdraw your consent, Personal Data processed solely based on the revoked consent will be promptly deleted or anonymized.

8. Scope of Personal Data Circulation

Personal Data will not be disseminated (meaning providing knowledge of personal information to unspecified subjects, in any form, including through making it available or consultable), except in cases where communication or dissemination is required by law, by police forces, by the judiciary, by information and security bodies, or by other public entities for purposes of defense or security of the State or for the prevention, investigation, or repression of crimes.

If, following the consulting activity carried out by Agente Unico, the interested party expresses the willingness to proceed with the purchase of one or more of the services/products presented, the Personal Data will be communicated (to concretely follow up on pre-contractual and/or contractual measures requested by the interested party) to the partners providing the aforementioned services/products as involved from time to time. These partners are active in the commercial sector of:

1. gas and electricity services and/or their intermediaries

The processing of your personal data is carried out within the territory of the European Union. With your specific consent, the Data Controller may communicate Personal Data to Main Recipients, including those located outside the European Union. The Main Recipients, as identified above, will process the information relating to you for their own commercial purposes. Some subjects may act on behalf of the Data Controller as data processors.

Such transfer will occur to countries that provide an adequate level of protection according to the European Commission (e.g., Switzerland, Canada, Japan) or, in any case, following the adoption of adequate safeguards, such as the signing of Standard Clauses approved by the European Commission or the selection of subjects adhering to international programs for the free flow of data.

9. Rights of the Data Subject

You can exercise your rights under Articles 15 to 22 of the GDPR at any time, particularly to obtain:

• confirmation as to whether or not personal data concerning you is being processed and to obtain access to the data and the following information: purposes of processing, categories of personal data, recipients and/or categories of recipients, retention period;
• rectification of inaccurate personal data concerning you and/or completion of incomplete personal data, including by providing a supplementary statement;
• erasure of personal data, in cases provided for by the GDPR;
• restriction of processing in the cases provided for by the applicable privacy legislation;
• data portability concerning you, particularly requesting the direct transmission of your data to another data controller.

Moreover, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal, as well as the right to object at any time to the processing of Personal Data, pursuant to Article 21 of the GDPR. If you object to the processing of Personal Data processed for direct marketing purposes and for profiling activities related to such direct marketing, you will obtain the immediate cessation of processing. We inform you that you can exercise the right to object to processing for marketing purposes even in relation to one or more specific contact channels (for example, you may choose to continue being contacted by the operator but no longer receive SMS or emails). In any case, if the contact channel concerning which the right is exercised is not specified, the objection to the processing of Personal Data will be understood as extending to all communication methods used.

If you believe that the processing of Personal Data occurs in violation of the provisions of the Regulation, you have the right to lodge a complaint with the Data Protection Authority as provided by Article 77 of the GDPR, or to seek appropriate judicial remedies. Requests for the exercise of your rights should be directed to the contacts listed in paragraph 2 of the Privacy Policy. Any modification or deletion or limitation of the processing carried out at your request or following the withdrawal of your consent – unless this proves impossible or involves a disproportionate effort – will be communicated by each data controller to the other, as well as to each of the recipients to whom Personal Data has been communicated.

Last updated: October 2024