Information notice MyAcea

Information notice pursuant to Article 13 of EU Regulation 2016/679.

The MyAcea portal offers users the possibility, by way of registration in accordance with the procedures set out in the General Conditions of Use, to create an “Online Services” account for the management of one or more supplies provided by the Acea Group Companies reachable via this integrated service, as well as its subsidiaries and controlled and/or affiliated companies as defined in Article 2359 of the Italian Civil Code and, more specifically,

- Acea ATO 2 SpA

- Acea ATO 5 SpA

- Acea Energia SpA

- Acque SpA

- Acquedotto del Fiora SpA

- Gori SpA

- Publiacqua SpA

- Umbra Acque SpA

- Gesesa SpA

Access to some sections of the Online Services Portal (hereinafter, “MyAcea”) and/or potential requests for information or services on the part of Portal/APP users may be conditional on the input of personal data, which will be processed in observance of EU Regulation 2016/679 (hereinafter, the “GDPR”), together with all other implementing rules and any other applicable provisions adopted by the personal data protection Authority (hereinafter, the “Privacy laws”).

This information notice, made pursuant to Article 13 of the GDPR, allows you to take cognisance of our privacy policy, even prior to accessing the various sections of the Portal/APP, in order to understand how personal information is handled whenever our services are used and be able to give free, express and informed consent to the processing of personal data in sections of the MyAcea Portal where you might be requested to provide such data.

Users will therefore need to review the same prior to conferring their personal data at the time of registration with the Portal/APP.

Specific information on the processing of data collected in relation to, for example, other registration procedures, access, other requests for services or participation in promotional, survey or other initiatives may be located in particular sections of the portal.

By requesting registration with the services offered via portal, the data subject acknowledges that he/she has carefully read this Privacy Information Notice made according to law and the General Conditions of Use pertaining to the Online Services and consequently agrees to the purposes thereof and handling procedures described therein. In the event of a decision not to accept the statements contained in this Privacy Information Notice, users are invited to refrain from utilising the content and services subject to registration.

In any case, the MyAcea Portal pages may contain links to the websites of other parties which, however, are not covered by this information notice.

It is therefore recommended that you read the privacy policy of each website visited.

The personal data provided and acquired at the time of registration with the restricted area, as well as the data required to use the services made available, will be processed in observance of the confidentiality undertakings and security measures set forth by the laws in force using computer, electronic and manual tools, with logics closely related to the purposes of processing.

Read more about the processing of navigation data and the cookie policy.

Personal data will be processed for the following purposes:

1. Registration with the restricted area to subscribe for online services, via identification of the subscribing party. The release of personal data by the User is necessary for the purpose of the said registration and in order to use the related services, including the potential management of the products made available; failure to fully, partially or correctly furnish data could imply the impossibility to access and/or use the services in question;

2. Performance of obligations arising from the General Conditions of Use and/or from the supply of services incidental to and/or connected with the contracts in question. In such cases, please note that pursuant to Section 24 of the Privacy Code, your consent is not required if processing is necessary to perform obligations resulting from a contract, whilst, at negotiation stage, it is also not mandatory to obtain consent if processing is required – prior to conclusion of the contract - to fulfil specific requests on your part;

3. The supply of services requested by Customers via registration with the Online Services Portal and the setting up of a personal account and profile including the collection, conservation and elaboration of data for the creation and subsequent operational, technical and administrative management of the relationship (and the account and profile generated by the Customer) associated with the supply of services and effecting of communications pertaining to service performance;

4. The handling of payments (with related processing – according to law – of payment data, including credit card or prepaid card identification details) for the requested services and ancillary charges, if any, based on the provisions set out in the general terms and conditions and/or other specific contractual terms published on the internet or otherwise made available to the customer;

5. Fulfilment of legal, accounting, fiscal, administrative and contractual obligations connected with the supply of the requested services;

6. Handling of relationships with third-party public authorities and bodies for purposes associated with particular requests, the fulfilment of legal or regulatory obligations or special procedures;

7. Arrangement of credit risk protection measures, including activities aimed at identifying the customer and his/her creditworthiness/solvency, even while the contractual relationship is in progress;

8. Planning of initiatives in connection with the contractual relationship such as might enhance the services provided, for example possible surveys to be carried out with a view to obtaining suggestions on the part of customers;

9. For direct marketing, namely the mailing of advertising/information material, direct selling material, trade communications, promotional initiatives, for market research and surveys to determine satisfaction with the service provided, in relation to the products and/or services offered by Acea Group Companies, parents, subsidiaries and/or affiliates, using interactive and “traditional” procedures (for example, paper mail and/or operator calls) or using “automated” systems of contact (for example, SMS and/or MMS-type messages, telephone calls without operator intervention, e-mail, facsimile, interactive applications) in accordance with Section 130, paragraphs 1 and 2, of the Privacy Code, on the part of the Data Controller and the parents, subsidiaries and/or affiliates of the same as defined in Article 2359 of the Italian Civil Code.

The data subject is informed that, pursuant to Section 130, paragraph 4 of the Code, and as established by the personal data protection Authority by virtue of a specific measure (so-called soft spam), the e-mail address provided within the scope of ongoing contractual relationships with the independent Controllers of the same, reachable via this Portal, may be used by the latter to send commercial offers pertaining to products and/or services similar to those previously purchased. The data subject may at any time object to processing according to the procedures set out in the paragraph “rights of data subjects”.

10. For an analysis of the propensity to use the products and services offered by the Acea Group Companies, the definition of individual and group profiles, the proposal of individual offers prepared including through the use of tools and applications able to record consumer preferences and analysis, also in a personalised, automated or electronic form, of information acquired through the utilisation of the products and/or services used.

Implementation of the purposes referred to in points 9 and 10 requires the free and express consent of the data subject. In such cases, the giving of his/her – separate and specific - consent is fully optional and a refusal, if any, will not imply consequences as regards execution of the contractual relationship.

For the purpose of registration and utilisation of Online Services, you will be asked to provide the following categories of personal data:

- Personal details (e.g. name, surname, etc..)

- ID information (e.g. tax code, VAT number, etc..)

- Information relating to supply contracts (e.g. customer code)

- Contact details (e.g. address, e-mail, telephone number, etc..)

In order to safeguard the rights of data Controllers, the IP number related to the registration request will be archived. Moreover, for the supply of services in connection with the account created, the data pertaining to the personal, technical and supply details provided at the time of subscribing the supply contract(s) associated with the profile will also be processed according to the purposes declared here.

The optional, explicit and voluntary transmission of data using web forms (including the registration area) or electronic mail to the addresses indicated on this site implies the subsequent acquisition of the sender’s address, this being a necessary condition for responding to his/her requests, along with any other personal data contained in the message. Specific summary information notices will be shown as applicable or displayed on website pages dedicated to particular services provided on request.

The data subject is free to provide personal data as requested from time to time;  failure to fully, partially or correctly provide data could imply the impossibility to supply the requested services.

Consent needs to be obtained for the handling of personal data in the case of all the above mentioned forms of processing connected with and/or required to fulfil legal obligations, community regulations, to perform obligations arising from a contract to which the data subject is a party or to satisfy, prior to conclusion of the contract, specific requirements of the latter.

Consent for the handling of personal data for the purposes referred to in points 9 and 10 is, on the other hand, optional and may be revoked at any time according to the procedures described in the paragraph of this information notice “Rights of data subjects”.

Handling is carried out using electronic or in any case automated means and is performed by Acea SpA and/or third parties potentially available to the data Controller for the storage, management and transmission of the data in question. More specifically, the data may be processed by way of collection and subsequent elaboration performed via the accurate recording of consumption and processing of profiles consultable by accessing MyAcea or using the available applications for smartphone, tablet or other similar handsets. The data processing will be carried out using organisation and elaboration logics for your personal data, also as regards the logs resulting from access to and utilisation of the services available via web, correlated to the above mentioned purposes and, however, in such a way as to guarantee the security and confidentiality of the data. In the case of online transactions the processed information is protected using appropriate technological solutions  as regards both the safeguarding of connections and storage of financial data (credit cards, IBAN, etc.). Your personal data will be processed until such time as you request withdrawal from Online Services and will be stored for the period set forth by the Privacy Code and applicable legislation.

In pursuing the above mentioned purposes, the data Controller may disclose and have processed the data subject’s personal information, in Italy or abroad, including in countries not forming part of the European Union, using third parties with whom it does business, insofar as such parties provide services requested by Acea SpA: the latter will make available to them only the information necessary to perform the requested services, taking all steps to ensure the safeguarding of your personal data.

In addition to the data Controller’s subsidiaries, parents and associate companies, within the meaning set forth by Article 2359 of the Italian Civil Code, the data subject’s personal information may also be disclosed to selected Partners, for the distribution and supply of services incidental to the contractual relationship, based on the purposes described herein.

The parties belonging to the above mentioned categories operate as individual data Controllers or in the capacity of data Processors and/or Persons in Charge of Processing specifically appointed for such purpose.

The personal data may also be visible to employees, consultants, associates of the data Controller, specifically appointed/designated Processors or Persons in Charge of Processing.

The data must not be disseminated.

Data Controller for the information furnished by you is Acea Spa, with registered office at Piazzale Ostiense 2, 00154 Rome, Tax Code and VAT number 05394801004, in the person of its pro tempore legal representative. The Companies of the Acea Group accessible via this portal and involved in providing the single management service for the supply contracts operating via the registered portal account are also independent data Controllers:

- Acea Ato 2 SpA

- Acea Ato 5 SpA

- Acea Energia SpA

- Acque SpA

- Acquedotto del Fiora SpA

- Gori SpA

- Publiacqua SpA

- Umbra Acque SpA

- Gesesa SpA

Certain Companies that provide Acea SpA with specific elaboration services or perform activities connected with, instrumental to or in support of that carried out by the supplier are also appointed as data Processors. Please note that you may consult the complete and updated list of data Processors by contacting privacy@aceaspa.it

For the purpose of exercising the rights referred to in Section 7 of the Privacy Code, a communication may be sent to the dedicated post office box privacy@aceaspa.it. The data subject may at any time, pursuant to Section 7 of the Privacy Code, obtain confirmation of the existence or otherwise of the data as well as information concerning the content and origin of the same, verify the accuracy thereof or request its integration or updating, or correction.

Pursuant to the said section, the data subject is entitled to request the cancellation, transformation into anonymous form or blocking of data processed unlawfully, and to oppose in any case, for legitimate reasons, the treatment thereof. Regarding treatments for which explicit indication of consent is required, it will always be possible to revoke the same and exercise the right of opposition, by sending a specific request to the post office box indicated above.

This information notice may be subject to modifications, which will be suitably reported to the user, primarily as a result of changes in legislation or in the procedures for management of the services offered, ensuring at all times the timely updating of this internet page, which the user is invite to consult on a regular basis.

The Data Controller informs you that, with a view to ensuring full implementation of the provisions set forth in EU Regulation 679/2016 with regard to the protection of personal data, in Italian harmonisation legislation and in the measures adopted by the personal data Protection Authority, this information notice may very soon be subject to amendments and revisions.

Furthermore, set out below are the contact details for each data Controller:

- Acea SpA., Piazzale Ostiense 2, 00154 Rome; PEC (certified e-mail): acea.spa@pec.aceaspa.it;

- Acea ATO 2 SpA, Piazzale Ostiense 2, 00154 Rome, PEC: acea.ato2@pec.aceaspa.it

- Acea ATO 5 SpA, Viale Roma snc, 03100 Frosinone; PEC: segreteria.aceaato5@pec.aceaspa.it

- Acea Energia SpA, Piazzale Ostiense 2, 00154 Rome, PEC: ae.spa@pec.aceaspa.it

- Acque SpA, Via Garigliano 1, 50053 Empoli (Florence), PEC: info@pec.acque.net

- Acquedotto del Fiora Spa, Via Mameli 10, 58100 Grosseto, PEC: protocollo@pec.fiora.it

- Publiacqua SpA, Via Villamagna 90/c, 50126 Florence, PEC: protocollo@cert.publiacqua.it

- UMBRA ACQUE S.p.A., Via Gustavo Benucci 162, 06135 Ponte San Giovanni (Perugia); PEC: privacy@umbraacque.com

- Gesesa SpA, Zona Industriale Pezzapiana (Pezzapiana Industrial Area), 82100 Benevento (Benevento), PEC: segreteria@gesesa.postecert.it

- Gori SpA, Via Trentola 211, 80056 Ercolano (Naples), PEC: protocollo@cert.goriacqua.com

In the event that, in your capacity as Data Subject, you should choose to exercise the rights referred to in Articles 15 et seq., including those pertaining to the right of access, correction, cancellation, opposition, restriction to processing and portability, you may do so by sending an appropriate request:

- for Acea SpA., Ato2 SpA , ATo5 SpA , Acea Energia SpA , Gesesa SpA, to the DPO reachable at the following address: privacy@aceaspa.it

- for Acque SpA , to the DPO reachable at the following address: DPO@ACQUE.NET

- for Acquedotto del Fiora Spa, to the DPO reachable at the following address: DPO@FIORA.IT

- for Publiacqua SpA, to the DPO reachable at the following address: DPO@PUBLIACQUA.IT

- for Umbra Acque Spa, to the DPO reachable at the following address: privacy@umbraacque.com

- for Gori Spa, to the DPO reachable at the following address: privacy@aceaspa.it