POLICY ON THE PROCESSING OF PERSONAL DATA
PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”)
SINAPSI Srl
Dear Customer, this notice is provided by SINAPSI S.r.l., with registered office at Via delle Querce no. 11/13, Bastia Umbra (PG), Italy, tax code and VAT no. 02727730547 (hereinafter the “Controller”), which, as data controller, informs you pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the “GDPR”) that the data you have already provided and that have been collected, and the data you will provide in the future as a “data subject”, will be processed in accordance with the principles of fairness, lawfulness and transparency and with protection of your privacy and your rights.
1) Data Controller
The data controller is “SINAPSI S.r.l.”, with registered office at Via delle Querce no. 11/13, Bastia Umbra (PG), Italy, tax code and VAT no. 02727730547, represented by its legal representative, Ing. Massimo Valerii.
The up-to-date list of external processors, persons authorised to process data and system administrators is kept at the Controller’s registered office.
2) Categories of personal data processed
The Controller processes the personal data provided or collected upon registration in the Sinapsi applications and/or in the course of its relationship with you or upon the conclusion of contracts for the purchase of the Controller’s products and services.
In particular, the following Personal Data may be processed:
▪Identification Data: data allowing direct identification, such as personal details (e.g. first name, surname, tax code, VAT number, address, etc.), provided to the Controller and processed for the purpose of entering into and managing the contract;
▪Consumption Data: data relating to the supply (POD, contractual power, available power) and to the consumption levels recorded, collected and processed during the term of the contract. The metering data that the Charging Infrastructure Controller (CIR) makes available locally to the devices connected to it are not transmitted to or processed by the Controller;
▪Technical data and characteristics of the energy user: data relating to the characteristics of the property, size of the dwelling, household composition, presence of specific categories of occupants and electrical equipment installed;
▪Economic and Financial Data: data required for payments (e.g. IBAN) or evidencing the execution of payments (payment identification details) and any other data relating to the customer’s solvency and punctuality in payments;
▪Contact Data: contact information such as landline and/or mobile telephone numbers and e-mail address, provided to the Controller upon signing the contract or during its term, or collected upon registration in the Sinapsi applications or acquired by the Controller itself, which allow you to be contacted for the purpose of managing the contractual relationship and/or providing services suited to your needs;
▪Reserved Area Data: access to the reserved areas of the Sinapsi applications is restricted to registered customers; upon registration, so-called “registration data” are requested, which are necessary to register, access your reserved area and use the services offered.
▪Browsing Data: during their normal operation, the IT systems and software procedures used to run the Website and the applications acquire certain personal data that allow users to be identified, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes: technical cookies, validation and authentication information, the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the date and time of access, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server and other parameters relating to the user’s operating system and IT environment, the transmission of which is implicit in the use of web communication protocols or is useful for the better management and optimisation of the system for sending data and e-mails.
▪E-mail Interaction Data: data relating to the opening of newsletters and promotional communications sent by the Controller through the mailing platform it uses (whether the message was opened, date and time, number of openings, clicks on links contained in the message, IP address and approximate location derived from it, type of device and e-mail client), collected by means of tracking pixels, i.e. very small images embedded in the message and downloaded from the platform’s server when the message is opened, and by means of tracked links. Transactional and service communications (e.g. registration confirmations, account notifications, sending of copies of signed forms) do not contain any tracking tools.
The data are provided directly by the data subject or, at the data subject’s request, by installers or other operators who submit the request to activate the services on the data subject’s behalf through the Controller’s platforms. In that case, the data subject receives this notice when accepting the request via the Controller’s application. In addition, as part of the POD eligibility check and the activation of the Chain 2 service, the Controller obtains from electricity distributors the results of those checks and the technical data of the withdrawal point.
3) Subject matter of the processing
For the purposes of this notice, processing of Personal Data means any operation or set of operations, performed manually and/or by IT or electronic means, with the aid of automated processes, applied to Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
4) Purposes of the processing and legal bases
Depending on the specific purpose pursued, the legal bases for the processing are those set out in Article 6(1)(a), (b), (c) and (f) of the GDPR.
A) For the purposes listed below, failure to provide the data would make it impossible to process your requests and to provide you with the services requested, and specifically to:
•establish the contractual relationship with the Company. Legal basis: Art. 6(1)(b) GDPR – performance of pre-contractual measures and of the contract.
•conclude contracts for the sale of the Controller’s products and provide services, including after-sales assistance and support. Legal basis: Art. 6(1)(b) GDPR – performance of the contract.
•fulfil the pre-contractual, contractual and tax obligations arising from your existing relationship with us. Legal basis: Art. 6(1)(b) GDPR – performance of the contract + Art. 6(1)(c) GDPR – tax and legal obligations.
•enable the use of all system features and monitor their proper operation. Legal basis: Art. 6(1)(b) GDPR – necessary for the provision of the service; Art. 6(1)(f) – legitimate interest relating to technical and security aspects.
•enable registration and/or access to the reserved area. Legal basis: Art. 6(1)(b) GDPR – performance of the contract.
•check the eligibility of withdrawal points (POD) for the services requested by the data subject, including by querying systems, platforms or interfaces made available by distributors or other authorised operators in the energy sector. Legal basis: Art. 6(1)(b) GDPR – performance of pre-contractual measures taken at the data subject’s request and performance of the contract.
•enable the association, modification and management of the connection parameters between POD, electronic meters, user devices and other equipment necessary to provide the services requested by the data subject. Legal basis: Art. 6(1)(b) GDPR – performance of the contract and provision of the services requested by the data subject.
•enable the activation, configuration, suspension and deactivation of the consumption monitoring, remote reading, automation and management services requested by the data subject. Legal basis: Art. 6(1)(b) GDPR – performance of the contract and provision of the services requested.
•make the consumption and device operation data available, through the Controller’s application programming interfaces (APIs), to the third parties to whom the data subject has given the device activation code or has otherwise authorised access to the data (e.g. installers or providers of energy management platforms), which process them as independent controllers on the basis of their own privacy notice. Legal basis: Art. 6(1)(b) GDPR – performance of the service requested by the data subject.
•develop, improve, test and optimise the performance of the algorithms, application platforms and digital services offered by the Controller, including through aggregated analysis of the data collected. Legal basis: Art. 6(1)(f) GDPR – the Controller’s legitimate interest in the continuous improvement of its services, features and the security of its IT systems.
•assess creditworthiness, including in terms of punctuality of payments, before or during the contractual relationship. Legal basis: Art. 6(1)(f) GDPR – the Controller’s legitimate interest in managing commercial risk.
•detect, prevent, mitigate and investigate fraudulent or unlawful activities in connection with the services provided. Legal basis: Art. 6(1)(f) GDPR – legitimate interest in security and fraud prevention.
•comply with obligations under law, regulations, EU legislation or orders of an Authority (e.g. anti-money laundering legislation). Legal basis: Art. 6(1)(c) GDPR.
•exercise the Controller’s rights, e.g. the right of defence in legal proceedings. Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
•process a contact request received by e-mail or through the contact form on the website. Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures requested by the data subject.
•Personalisation of services and consumption analysis: data relating to the use of the services, consumption, preferences and the ways of interacting with the platforms and tools made available by the Controller are processed in order to personalise the services provided, configure the features requested by the data subject, provide technical support, optimise system performance, carry out functional analyses and ensure the proper performance of contractual obligations. The processing is also aimed at the continuous improvement of the services, the optimisation of performance and the development of new features. Legal basis: Art. 6(1)(b) GDPR – performance of the contract and Art. 6(1)(f) GDPR – the Controller’s legitimate interest in improving the service.
•enable the technological development and maintenance of the applications. Legal basis: Art. 6(1)(f) GDPR – legitimate interest in the continuity and improvement of the service.
•enable the investigation of possible computer crimes. Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
•carry out statistical analyses on the use of the applications, including to monitor their proper operation and safeguard security. Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
•monitor and assess the use of the applications by users. Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
•measure, in aggregated and anonymous form, the opening rate of newsletters and promotional communications, in order to ensure their proper delivery and combat spam, by means of tracking pixels that are not differentiated by individual recipient and by anonymising the related technical data. Legal basis: Article 122(1) of Legislative Decree 196/2003 (Italian Privacy Code) and Art. 6(1)(f) GDPR – legitimate interest.
B) The provision of your Personal Data is, on the other hand, voluntary for the further purposes listed below, so that refusal to consent to them will have no consequence on the conclusion and management of the contract. Consent for these purposes is always optional and, if given, may be withdrawn at any time in the manner described in the “Rights of the data subject” section of this Notice:
•Marketing, i.e.:
osending informative newsletters by SMS, push notifications and/or e-mail containing informative and promotional communications from SINAPSI S.r.l. concerning its own initiatives and/or those of its subsidiaries and/or affiliates;
osending special offers and promotions by SMS and/or e-mail, as well as newsletters on special offers and promotions concerning our products and services;
oinvitations to events or training courses by SMS and/or e-mail, as well as newsletters with invitations to events and workshops organised by Sinapsi or third parties and training courses on our products.
Legal basis: Art. 6(1)(a) GDPR – consent.
Newsletters and promotional communications sent by e-mail contain tracking pixels and tracked links that record the opening of the message and clicks on links by the individual recipient (date and time, number of openings, links clicked, e-mail client, approximate location), in order to assess the effectiveness of campaigns and adapt their content and frequency. Consent to marketing includes this tracking. The data subject may at any time withdraw consent to tracking only, while continuing to receive communications without any difference, through the preference centre accessible via the link at the bottom of each message. In the absence of such consent, the Controller collects only aggregated data that cannot be traced back to the individual recipient.
•measuring satisfaction with the quality of the products purchased (Customer Satisfaction) by sending questionnaires and/or by telephone contact, aimed at improving communication and the services provided and at directing Sinapsi’s commercial proposals in line with the data subject’s interests and tastes. Legal basis: Art. 6(1)(a) GDPR – consent.
•Consumption profiling for business development, marketing or personalised offers beyond the service requested. Legal basis: Art. 6(1)(a) GDPR – consent.
•Transfer or disclosure of consumption data to third parties so that they may use them for their own independent commercial purposes as independent controllers. This purpose does not concern making the data available to the parties to whom the data subject has given the device activation code, which is governed by section 4) letter A). Legal basis: Art. 6(1)(a) GDPR – consent.
5) Processing methods
Your personal data may be processed through the operations referred to in Article 4(2) of the GDPR, namely: collection, recording, organisation, storage, structuring, consultation, processing, modification, selection, retrieval, alignment, use, interconnection, disclosure, transmission, dissemination or otherwise making available, blocking, communication, erasure and destruction of data.
The data collected will be processed manually, electronically and by IT means and/or by means of electronic or otherwise automated, IT and telematic tools, using logic strictly related to the purposes for which the personal data were collected and, in any case, in compliance with the security provisions of Article 32 of the GDPR (Regulation (EU) 2016/679).
The Controller will process the personal data for as long as necessary to fulfil the above purposes and in any case for no longer than 10 years from the termination of the relationship for Service Purposes and for no longer than 5 years from the collection of the data for Marketing Purposes.
E-mail interaction data collected on an individual basis are retained for no longer than 12 months from collection and are erased if the related consent is withdrawn.
Once the above retention periods have expired, the Data will be destroyed, erased or anonymised, compatibly with the technical erasure and backup procedures.
6) Recipients of the data
The data may be processed by external parties acting as controllers such as, by way of example, banks, supervisory and control authorities and bodies and, in general, public or private parties entitled to request the data.
Your data may be processed for the purposes set out in section 4) of this notice:
•by employees and collaborators of the Controller, in their capacity as persons authorised to process data and/or system administrators;
•by external parties appointed as processors, who are given appropriate operating instructions. These parties essentially fall into the following categories:
omarketing and commercial campaign promotion companies;
ocompanies providing management and maintenance services for the information system, including cloud and e-mail service providers;
oprofessional firms for the management of tax and accounting activities and for legal assistance;
oconsulting firms for personnel administration;
oproviders of platforms for sending newsletters and promotional, transactional and service e-mail communications;
•by third parties acting as independent controllers, in particular:
oelectricity distributors, for the POD eligibility check and for the activation and management of the Chain 2 service (section 4, letter A);
oparties to whom the data subject has given the device activation code or has otherwise authorised access to the data, for the provision of the services requested by the data subject (section 4, letter A);
ocompanies operating in the energy, technology, energy efficiency, research and development and digital services sectors and partners, subject to the data subject’s consent (section 4, letter B).
7) Transfer of personal data to countries outside the European Union
The data are stored on servers located in the European Union. Where a provider appointed as processor is established in a third country or may access the data from a third country, the transfer takes place exclusively on the basis of an adequacy decision of the European Commission (e.g., for the United States, the EU-US Data Privacy Framework) or of the standard contractual clauses approved by the Commission, pursuant to Articles 45 and 46 GDPR. A copy of the safeguards adopted may be requested from the Controller at the contact details given in section 9.
8) Rights of the data subject
With regard to the data processed under this notice, the data subject has the right at any time to:
•Access (Art. 15 Regulation (EU) 2016/679): the right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to obtain access to your personal data;
•Rectification (Art. 16 Regulation (EU) 2016/679): the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
•Erasure (Art. 17 Regulation (EU) 2016/679): the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims;
•Restriction (Art. 18 Regulation (EU) 2016/679): the right to obtain restriction of processing;
•Portability (Art. 20 Regulation (EU) 2016/679): the right to receive from the controller the data in a structured, commonly used and machine-readable format in order to transmit them to another controller without hindrance;
•Objection (Art. 21 Regulation (EU) 2016/679): the right to object to the processing of personal data concerning you;
•Withdrawal of consent (Art. 7(3) Regulation (EU) 2016/679), without affecting the lawfulness of processing based on consent before its withdrawal; withdrawal obviously cannot concern cases in which processing is, for example, necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
•Withdrawal of specific consent to e-mail tracking: every newsletter and promotional communication contains at the bottom a link to the preference centre, which allows you to withdraw your consent to receiving communications or only your consent to the tracking of openings and clicks, while continuing to receive communications. Refusing tracking does not entail any limitation of the services;
•Lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Art. 51 Regulation (EU) 2016/679).
Exercising your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, in particular because of their repetitive character, the Controller may charge you a reasonable fee, taking into account the administrative costs incurred in handling your request, or refuse to act on your request.
Finally, please note that the Controller may request additional information necessary to confirm the identity of the data subject.
9) How to exercise your rights
You may exercise your rights at any time by sending:
•a registered letter with return receipt to SINAPSI s.r.l., Via delle Querce no. 11/13 – 06083 Bastia Umbra (PG), Italy;
•an e-mail to: privacy@sinapsitech.it
10) Minors
The Controller’s Services are not intended for persons under 18 years of age and the Controller does not knowingly collect personal information relating to minors. Should information on minors be inadvertently recorded, the Controller will promptly delete it.