Privacy Policy

The Data Controller is Eni Rewind S.p.A. - Company subject to the direction and coordination of Eni S.p.A., with registered office in San Donato Milanese (MI), Piazza Boldrini 1 (20097), which can be contacted through the CONTACT US form

The Company has appointed a Data Protection Officer, who can be contacted at the email address dpo@eni.com.

a. Purposes provided for by law and necessary for the provision of services – processing required to fulfil a contractual or legal obligation to which the Data Controller is subject or to implement a specific request made by the Data Subject. The Users’ personal data may be processed without their consent in cases where this is necessary to comply with obligations deriving from laws, regulations, codes or procedures approved by authorities or other competent institutions. The Users’ personal data will also be processed for purposes relating and/or connected to the provision by the Company of services for the browsing of the Website, and specifically:

• to provide the services requested by the User when browsing the Website, including the collection, storage and processing of data to deliver the services and their subsequent operational and technical management. Specifically, filling in the CONTACT ME form entails the collection of personal and contact data to enable the Company to respond to the questions and/or reports raised;
• to manage relations with authorities and third-party public bodies for purposes related to particular requests, compliance with legal obligations or particular procedures.

These data – which are required to deliver the service – will also be processed electronically, stored in specific databases, and used strictly and exclusively for browsing the Website. Given that providing the User’s personal data for these purposes is necessary to maintain and deliver all the services connected to browsing the Website, failure to provide such data will make it impossible to offer the specific services in question.

 
b. Legitimate interest of the Data Controller

The Data Controller may process, without the User’s consent, the personal data collected in the following cases:  

• during mergers, disposals or transfers of business units, to carry out operations necessary for due diligence activities and in preparation for the transaction. It is understood that only the data necessary for the purposes mentioned above will be processed, in the most aggregate/anonymous form possible;
• for the aggregate and anonymous analysis of the use of the services accessed, to identify User habits and propensities, to improve the services provided and to meet specific User requirements, or to prepare initiatives for improving the services provided;  
• whenever it is necessary to ascertain, exercise or defend a right of the Data Controller and/or third parties, including in court.

In pursuit of the purposes indicated in the previous point, the Data Controller may communicate the User’s personal data to third parties, such as those belonging to the following organisations or categories of organisations:

• police forces, armed forces and other public authorities, to comply with obligations set out by law, regulations or EU legislation. In such cases, there is no obligation under applicable data protection legislation to obtain the Data Subject’s prior consent to these communications;
• Eni Spa, which will act as Data Processor to support the provision of the services offered by the Website and the management of cookies;
• IT service providers.  

 

The Data Controller guarantees that they will take the utmost care to ensure that the communication of the User’s personal data to the recipients mentioned above only involves the data necessary to achieve the specific purposes for which they are intended.

The User’s personal data is stored in the Data Controller’s database and processed exclusively by authorised personnel. Said personnel will receive specific instructions on the methods and purposes of the processing. The data will not be disclosed to third parties except as provided above and, in any case, within the indicated limits.

Finally, we remind that the User’s personal data will not be disseminated, except in the cases described above and/or the cases required by law.

Whenever it is deemed instrumental to the pursuit of the purposes set forth above, the Data may also be sent abroad to companies located outside the European Economic Area (“EEA"). Some of the jurisdictions outside the EEA may not provide the same level of data protection as that which is guaranteed within the EEA. In such a case, the Data Controller undertakes to process the Data with the utmost confidentiality by adopting the standard contractual clauses provided by the European Commission and any other necessary measures referred to in Art. 46 GDPR where it would not be possible to resort to one of the exceptions referred to in Art. 49 GDPR.

The data will be stored for a period not exceeding the time necessary to fulfil the purposes for which it was collected or subsequently processed in compliance with legal obligations.

Where applicable and within the limits of the GDPR, as a data subject, the User is granted the following rights over the Personal Data collected and processed by the Data Controller for the purposes set out above:

• pursuant to Article 15 GDPR, to obtain confirmation from the Data Controller that Personal Data is or is not being processed and if so, to obtain access to the following information: (i) the purposes of the processing; (ii) the categories of Personal Data concerned; (iii) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, particularly if they are recipients in third countries or international organisations; (iv) whenever possible, the expected retention period of the Personal Data or, if not possible, the criteria used to determine such period (v) the right to lodge a complaint with a supervisory authority; (vi) if the data is not collected from the User, all available information about their origins; (vii) the existence of automated decision-making, including profiling, as well as information about the logic used and the expected consequences of such processing;
• pursuant to Article 16 GDPR, to obtain the rectification of inaccurate Data concerning them or, taking into account the purposes of the processing, to complete missing Personal Data;
• pursuant to Article 17 GDPR, to obtain the deletion of Personal Data if any of the following reasons exist: (i) the Data are no longer necessary in relation to the purposes it was collected or otherwise processed for; (ii) the Data are being processed unlawfully; (iii) the User has withdrawn the consent under which the Data Controller had the right to process the Data and there is no other legal basis for the Data Controller to process the Data; (iv) the User has objected to the processing and there is no overriding legitimate reason; (v) the Personal Data must be deleted to fulfill a legal obligation. However, the Company has the right to disregard the request to exercise the aforementioned cancellation rights if this is necessary for (a) the exercise of a legal obligation or the performance of a task performed in the public interest; or (b) to defend its own right in court;
• pursuant to Article 18 GDPR, to obtain the restriction to the Personal Data processing when one of the following occurs: (i) in the event that the User has disputed the accuracy of the Personal Data concerning them for the time necessary for the Controller to verify the accuracy of such Personal Data; (ii) in the event of unlawful Personal Data processing, if the User objects to its deletion; (iii) where it is necessary for the establishment, exercise or defence of a right in a court of law; (iv) for the time necessary to verify whether the Data Controller's legitimate reasons prevail over the user's request to object to the processing;
• pursuant to Article 20 GDPR, to receive the Personal Data provided to the Company and processed by it on the basis of consent or contract with the User in a structured, commonly used and readable format, as well as the right to transmit such data to another Data Controller without hindrance;
• pursuant to Art. 21 GDPR, for reasons related to the user’s particular situation, to object to the Data processing carried out on the basis of the legitimate interest of the Data Controller.
• to revoke consent for the personal data processing with consent as the legal basis.

These rights may be exercised by writing an email to the DPO at dpo@eni.com. Without prejudice to any other administrative or judicial remedy, the Users also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) where they believe there has been a violation of their rights regarding Personal Data protection