Privacy Policy

1. Who processes personal data?

The Data Controller is A2A S.p.A., whose registered office is at Via Lamarmora, 230 – 25124 Brescia, Italy, and whose management and administrative offices are located at Piazza Trento, 7 – 20135 Milan, Italy.

2. Who is the Data Protection Officer?

The Data Controller has appointed a Data Protection Officer (DPO), who may be contacted by email at dpo.privacy@a2a.it.
 

3. Why is personal data processedi?

The data subjects whose personal data are processed are users who access and use the Data Controller’s website. Hereinafter, these individuals are referred to as “data subjects”.

4. Why is personal data processed?

 ^{(1)Tracking pixels are very small, transparent images that are automatically downloaded from the sender’s server when the recipient opens an email. This process enables the Data Controller to obtain information on whether emails have been opened.}

5. Who are personal data disclosed to?

Your personal data may be made available to:

• companies providing data storage, IT, marketing, social media management and email communication services;
• other companies within the A2A Group, where requests submitted by users through the Website clearly relate to other companies belonging to the Group;
• competent authorities and public bodies, where required.

Depending on the circumstances, these parties will act as Data Controllers or Data Processors.
Your personal data will not be disseminated, i.e. made available to an unrestricted number of persons.

6. Are personal data transferred to third countries?

Your personal data will be processed within the European Economic Area (“EEA”). Should it exceptionally become necessary to transfer your personal data outside the EEA, such transfer will take place on the basis of an adequacy decision adopted by the European Commission, where applicable, or subject to the appropriate safeguards required under the Privacy Regulation.

7. How long are personal data retained?

Your personal data will be retained for as long as necessary to fulfil the purposes for which they are processed or to comply with legal obligations, and in particular:

• In the INVESTORS section, personal data relating to requests for information and subscriptions to the Press Alert service will be retained for one month after the user unsubscribes from the service.
• For the newsletter service, personal data will be retained for as long as you wish to use the service. If you unsubscribe, you will no longer receive our newsletters, and your personal data will be deleted from our systems within the following two months.
• For information request forms (e.g. requests concerning joint conciliation procedures, privacy matters, etc.), the data collected will be retained for as long as necessary to respond to the request, unless further contact with the user takes place or the data must be retained to comply with any administrative obligations. For example, a complaint or report must be retained beyond the period required to handle it, for up to a maximum of ten years from its resolution.

The retention periods applicable to the cookies used on the Website are set out in the relevant section of this Privacy Notice. In the event of legal proceedings, the retention periods specified above may be extended to up to ten years from the conclusion of such proceedings.
 

8. What rights can you exercise?

You have the right to request the following from the Data Controller, where provided for by law:

• confirmation as to whether or not your personal data are being processed and, where this is the case, access to those data (right of access);
• the rectification of inaccurate personal data or the completion of incomplete personal data (right to rectification);
• the erasure of your personal data where one of the grounds provided for under the Privacy Regulation applies (right to erasure);
• the restriction of processing where one of the circumstances provided for under the Privacy Regulation applies (right to restriction of processing);
• to receive the personal data you have provided to the Data Controller in a structured, commonly used and machine-readable format and to transmit those data to another Data Controller (right to data portability).

Right to object. Please also note that you may object at any time to the processing of your personal data where it is carried out on the basis of the Data Controller’s legitimate interests. In such cases, the Data Controller will cease processing your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

To exercise your rights, you may send an email to compliance.privacy@a2a.it or submit a written communication addressed to the Data Controller. If we are unable to respond to your request directly through the channel you used to contact us (for example, if your email address has been deactivated or is no longer accessible), we reserve the right to use any other contact channels associated with you that may already be available in our systems.

Please note that further information regarding processing based on legitimate interests (specifically, the assessment carried out to balance the Data Controller’s interests against the rights and freedoms of the data subject) or the transfer of personal data outside the EEA may be obtained by emailing compliance.privacy@a2a.it.
In all cases, data subjects retain the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) and/or to bring legal proceedings to protect their rights, pursuant to Articles 77 and 79 of the Privacy Regulation. For further information, please visit: https://www.garanteprivacy.it/home/diritti/come-agire-per-tutelare-i-tuoi-dati-personali.

9.  What are the consequences of failing to provide personal data?

Failure to provide the data required to deliver services based on the performance of a contract or on pre-contractual measures taken at the data subject’s request will prevent us from providing the relevant service.
With regard to tracking pixels, tracking can only take place if image downloads are enabled. If users read emails in plain-text format only, the tracking pixel, like any other image, will not be downloaded and will therefore be unable to perform its tracking function. Communications will still be delivered even if the data subject does not download the tracking pixel.
 

10. Cookies and other tracking technologies

The Website uses cookies and tracking technologies to collect information about users’ browsing activity, such as their IP addresses.
Cookies are generally text files placed and stored by the Website operator (or by third-party website operators, in the case of so-called “third parties”) on a device available to the user, such as a computer, tablet or smartphone.
The following tools are used on the Website:

• Cookies and technical tools that are strictly necessary to ensure the proper and efficient functioning of the Website or to provide the service requested by the data subject. This category includes certain tools (e.g. Google Maps, Sketchfab and Spotify) which, while operating, carry out limited processing of personal data (essentially restricted to the IP address) solely to provide the services requested by the user. These services include displaying maps on the Website, displaying and interacting with interactive charts, viewing 3D models of our facilities and listening to podcasts directly on the Website. User consent is not required for the use of these tools.
• Third-party analytical cookies and tools used exclusively to compile aggregated and anonymised statistics. User consent is not required for the use of these tools.
• Tools designed to enhance the browsing experience, which allow users to interact with content from external platforms and networks (e.g. YouTube player widgets). These tools may only operate with the user’s prior consent. Users may give their consent through the cookie banner and may subsequently change their preferences at any time by accessing the “Change cookie preferences” section, linked in the footer of the Website.
• Measurement tools (e.g. Hotjar) that track user behaviour and measure how the Website is used. These tools enable the Data Controller to assess, through aggregated visual heatmaps or recordings of browsing sessions generated by such tools, which areas of the Website receive the most and least visits overall. This information is used to assess and implement measures aimed at continually improving the browsing experience. Some of these tools may collect users’ IP addresses for tracking purposes. These tools may only operate with the user’s prior consent, which may be given on the first visit to the Website and withdrawn or changed at any time by accessing the “Change cookie preferences” section, linked in the footer of the Website.

For further information about the individual cookies and tracking technologies used on the Website, please consult the Cookie Policy.

Further information is available on the Italian Data Protection Authority’s website.