Privacy Policy

Current legislation in force regarding the processing¹ of personal data as defined in accordance with the provisions of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data (General Regulations on Data Protection, hereinafter referred to as “EU Privacy Regulations”) includes provisions to ensure that the processing of personal complies with rights and fundamental freedoms of natural persons, with particular regard to the right to the protection of personal data.

Purpose of the processing and legal basis of the processing
In fulfilment of the obligations provided for by the legislation in force, we hereby inform you that the Data Controller (hereinafter also referred to as the “Controller), performs the processing of your personal data for the purpose of controlling access to the premises of the companies of A2A Group. This processing serves, in particular, to verify the identity of persons accessing corporate areas and to have immediate information on who is on company premises daily, including for reasons of safety. We also wish to inform you that, for reasons of safety and protection of company assets, a video surveillance system with closed-circuit television cameras is in operation on company premises. The images taken are processed by authorized personnel only.
Processing of data may have as its legal basis the pursuit of a legitimate interest by the Data Controller (e.g. protection of corporate assets or defending a right in court) or the eventual fulfilment of an legal obligation (e.g. data communications to the authorities) to which the Data Controller is subject.

Processing methods and data retention period 
Processing will be performed with or without the aid of electronic tools, according to the principles of fairness, lawfulness and transparency, in order to protect at all times the confidentiality and rights of the person concerned in compliance with the provisions of the legislation in force.
Personal data will not be subjected to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or that in a similar way affect you significantly.
Your data will be retained, in accordance with the regulations in force, for no longer than is necessary to fulfil the purposes for which it is processed.
The retention period of the images taken by the video surveillance systems is a maximum of seven days except for any requests by the police or judicial authorities.

Nature of the provision and possible consequences of refusal
All the data collected within the scope of this processing is used for the declared purposes and for the fulfilment of legal requirements, including those on personal safety. The provision of the personal data required is optional, but the refusal to provide such data precludes access to the premises of the companies of A2A Group, given the urgent need to identify anyone who enters company areas.

Persons authorised to process personal data - Disclosure and dissemination of data
The personal data and images collected are processed by authorized personnel who need to have knowledge of such data in order to perform their duties and by external parties who may act as joint controllers or data processors, as required.
Your personal data may be disclosed to third parties who are responsible for the execution of related activities that are instrumental to this processing, to national authorities, public administrations, other companies of the A2A Group and third parties, in fulfilment of legal obligations. 
Your data will not be disseminated.

Data Controller and Processor and Data Protection Officer
The Data Controller is Aprica SpA, with registered office in Via Lamarmora 230 - Brescia. The role of Data Processor has be assigned to certain companies that provide the Controller with specific processing services or perform activities related to, instrumental.

Any queries may be sent in writing to the Data Protection Officer at the following address dpo.privacy@a2a.eu, indicating the Company of the A2A Group (Data controller) intended to receive the request.

Rights of the interested party
According to the EU Privacy Regulations, you have the right to obtain from the Data Controller:
- confirmation as to whether or not your personal data is being processed, and, where that is the case, access to the personal data (right of access).
- rectification of inaccurate personal data, or to have incomplete personal data completed (right of rectification).
- the cancellation of personal data, where one of the grounds provided for by Regulations applies (right of cancellation).
- the restriction of processing where one of the grounds provided for by the Regulations applies (right of restriction).
- to receive your personal data, which you provided to the Controller, in a structured, commonly used and machine-readable format and the right to transmit it to another data controller (right to portability)
- to oppose at any time the processing performed in the pursuit of a legitimate interest of the Controller (right of opposition).

To exercise these rights, you can send an email to securitycontrolroom@a2a.eu or written communication to the Controller.
Without prejudice to any other administrative appeal or judicial review, you have the right to lodge a complaint with a Supervisory Authority if you believe that the processing of your data violates the EU Privacy Regulations.

_{1) Processing: any operation or set of operations, performed with or without the use of automated processes and applied to personal data or sets of personal data, such as the collection, recording, organization, structuring, retention, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or interconnection, limitation, deletion or destruction.}

Current legislation in force regarding the processing of personal data as defined in accordance with the provisions of EU Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data (General Regulations on Data Protection, hereinafter referred to as “EU Privacy Regulations”) includes provisions to ensure that the processing of personal data complies with rights and fundamental freedoms of natural persons, with particular regard to the right to the protection of personal data.

1. Data controller
   Data controller of the personal data is Aprica S.p.A., with headquarters in Brescia in Via Lamarmora 230.
    
2. The Data Protection Officer
   The data controller of personal data has appointed an officer responsible for the protection of personal data (RPD) that can be contacted at the following email address: dpo.privacy@a2a.eu.
    
3. Purpose and legal basis of the processing
    in fulfilling the obligations provided for by current legislation, we inform you that the data controller (hereinafter also referred to as the “Controller”) processes your personal data in order to be able to perform the service you requested (hereinafter the “Service”), fulfil the contractual and legal obligations, carry out all the activities necessary or useful for the constant improvement of the service supplied (including, by way of example and not limited to, the administration of questionnaires aimed at checking the level of satisfaction of the services rendered by the company).
   The processing of data may have as its legal basis the implementation of a contract, the fulfilment of a legal obligation to which the Controller is subject or the pursuit of a legitimate interest of the Controller.
    
4. Recipients of the personal data The personal data are processed by authorized personnel who need to have knowledge of such data in order to perform their duties and by external parties who may act as joint controllers or data processors, as required.
   Your personal data may be communicated to banking institutions (where provided for) for managing receipts, to subjects which are responsible for the implementation of activities connected with and instrumental to the processing (companies supplying environmental services, computer services companies, call centres, credit recovery agencies, professional offices, archiving service companies), to the other companies in the A2A Group, to authorities, research bodies, universities, public administrations and third parties in fulfilment of legal obligations, or to recipients with a legitimate interest.
   Your data will not be disseminated.
    
5. The transfer of data to third countries
   The Controller reserves the right to transfer the personal data of the person concerned to a third country based on decisions of adequacy by the European Commission or on the basis of the guarantees provided for by current legislation.
    
6. Processing methods and data retention period
   Processing will be performed with or without the aid of electronic tools, according to the principles of fairness, lawfulness and transparency, in order to protect at all times the confidentiality and rights of the person concerned in compliance with the provisions of the legislation in force.
   Your data will be retained, in accordance with the regulations in force, for no longer than is necessary to fulfil the purposes for which it is processed.
    
7. Rights of the person concerned
   According to the EU Privacy Regulations, you have the right to obtain from the Data Controller:
   • confirmation as to whether or not your personal data is being processed, and, where that is the case, access to the personal data (right of access).
   • rectification of inaccurate personal data, or to have incomplete personal data completed (right of rectification).
   • the cancellation of personal data, where one of the grounds provided for by Regulations applies (right of cancellation).
   • the restriction of processing where one of the grounds provided for by the Regulations applies (right of restriction).
   • to receive your personal data, which you provided to the Controller, in a structured, commonly used and machine-readable format and the right to transmit it to another data controller (right to portability).
   • to oppose at any time the processing performed in the pursuit of a legitimate interest of the Controller (right of opposition).
     
     To exercise the rights you may contact the call centre at the toll-free number 800 437678, send a message to the e-mail box Info.apricaspa@a2a.eu or a written communication addressed to Aprica Spa Via Lamarmora, 230 - 25124 Brescia.
     Without prejudice to any other administrative appeal or judicial review, you have the right to lodge a complaint with a Supervisory Authority if you believe that the processing of your data  violates the EU Privacy Regulations.
      
8. Origin and nature of the provision and possible consequences of refusingAll personal data collected within the scope of this processing, even through a third party, are strictly functional to the implementation of the requested service and to managing the related fulfilment (such as invoicing, the recovery of any credit, completion of tax, accounting and administrative compliance). 
   The collection of part of the data, such as those that are essential to identify the customer and the place the service is provided is compulsory pursuant to contractual provisions and regulations. Failure to collect implicates the impossibility of performing the service.
9. Automated decision-making processesdata will not be subjected to decisions based solely on automated processing, including profiling, which produce legal effects that relate to the person concerned or that affect you significantly in a similar way.

_{1. Processing: any operation or set of operations, performed with or without the use of automated processes and applied to personal data or sets of personal data, such as the collection, recording, organization, structuring, retention, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or any other form of provision, comparison or interconnection, limitation, deletion or destruction.}