Privacy Notice for the Processing of Customer/Prospect Personal Data

pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (“GDPR”)

Dear Data Subject, pursuant to Articles 13 and 14 of the GDPR, PA ABS S.r.l. hereby informs you that the data relating to your company (hereinafter, the “Customer”) and the personal data of the individuals acting in its name and on its behalf (hereinafter, the “Data”), will be used and stored in accordance with Regulation (EU) 2016/679 (“GDPR”), with the applicable personal data protection legislation, and in compliance with this Privacy Notice.

It is understood that it is your responsibility to inform the individuals acting on your behalf about the processing of their Data as described herein and, where necessary, to obtain their consent.

1. Who We Are

Depending on the purposes pursued, PA ABS S.r.l. may process your Data as Data Controller (hereinafter, the “Controller” or the “Company”).

For any request relating to the processing of your Data, you may contact PA ABS S.r.l. by sending:

• a registered letter with return receipt to the registered office;
• an email to privacy@alveo.it – to the attention of the Data Controller of PA ABS.

2. Data Protection Officer

The Company has appointed a Data Protection Officer (DPO) to facilitate communication with you. The DPO may be contacted:

• via email at dpo@alveo.it – to the attention of the Data Protection Officer of PA ABS.

This contact method is also available on the Company’s website, where any updates will be published.

3. Categories of Data and Processing Methods

In the context of activities related to the establishment and management of the contractual relationship, the Controller may collect and process the following categories of Data:

1. personal and identification data (e.g., name, surname, tax code, VAT number, images, videos);
2. contact details such as address, email, telephone number;
3. internet browsing data (cookies, IP address, device parameters – see cookie policy);
4. company, industry, job role, function;
5. bank and payment details (e.g., IBAN, credit card number);
6. consumption habits and preferences for tailored offers;
7. any other information necessary for contract performance or fraud-prevention activities.

4. Purposes and Legal Basis of the Processing

The Data are processed for the following purposes:

1. compliance with legal and regulatory obligations;
2. performance of contracts and pre-contractual measures;
3. creditworthiness and fraud-prevention checks;
4. establishing or defending legal claims;
5. corporate transactions (mergers, transfers, acquisitions);
6. sending “soft spam” communications;
7. customer satisfaction surveys;
8. marketing and promotional communications;
9. profiling activities for marketing personalization;
10. responding to contact requests submitted via the website.

Processing for purposes a), b), c) and j) does not require consent pursuant to Article 6(1)(b) and (c) GDPR. Processing for purposes d), e), f), g) is based on legitimate interest pursuant to Article 6(1)(f) GDPR. Processing for purposes h) and i) requires consent pursuant to Article 6(1)(a) GDPR.

5. Provision of Data

Providing Data for purposes a), b), c) is mandatory. Providing Data for other purposes is optional, without prejudice to your right to object or withdraw consent at any time.

6. Recipients or Categories of Recipients

• employees or collaborators of the Controller;
• public or private entities involved in processing activities.

The Data will not be disseminated.

7. Retention Period

• Pre-contractual activities: up to 24 months
• Legal, accounting and tax obligations: up to 10 years
• Marketing and profiling: until consent withdrawal or 24 months
• Customer satisfaction surveys: 24 months
• Contact requests: 24 months

8. Transfer of Data to Third Countries

Data may be transferred outside the EU in compliance with GDPR safeguards, including Standard Contractual Clauses and adequacy decisions.

9. Rights of the Data Subject

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to withdraw consent.

10. Right to Lodge a Complaint

You may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali). Information is available at www.garanteprivacy.it .

11. Final Provisions

The Company reserves the right to amend or update this Privacy Notice in accordance with changes in applicable legislation or organizational structure.

Privacy Notice for the Processing of Customer/Prospect Personal Data pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (“GDPR”)

Dear Data Subject, pursuant to Articles 13 and 14 of the GDPR, PA Expertise S.r.l. hereby informs you that the data relating to your company (hereinafter, the “Customer”) and the personal data of the individuals acting in its name and on its behalf (hereinafter, the “Data”) will be used and stored in accordance with Regulation (EU) 2016/679 (“GDPR”), with the applicable personal data protection laws, and in compliance with this Privacy Notice. It is understood that it is your responsibility to inform the individuals acting on your behalf about the processing described herein and, where required, to obtain their consent. 

1. Who We Are.

Depending on the purposes pursued, PA Expertise S.r.l. may process your Data as Data Controller (hereinafter, the “Controller” or the “Company”). For any request concerning the processing of your Data, you may contact PA Expertise S.r.l. by sending: 

• a registered letter with return receipt to the registered office;
• an email to privacy@alveo.it – to the attention  of the Data Controller of PA Expertise.

2. Data Protection Officer.

The Company has appointed a Data Protection Officer (DPO) to facilitate communication with you. The DPO may be contacted:  

• via email at dpo@alveo.it – to the attention of the Data Protection Officer of PA Expertise;

This contact method is also available on the Company’s website, where any updates will be published. 

3. Categories of Data and Processing Methods

In the context of activities related to the establishment and subsequent management of the contractual relationship with you and/or the organisation for which you act as a representative, the Controller may collect and process the following categories of Data: 

1. personal and identification data (e.g., name, surname, tax code, VAT number, images, videos);
2. contact details such as residential address or domicile, email address, telephone number;
3. internet browsing data on the company website (e.g., cookies, IP addresses, operating system and device parameters – see cookie policy);
4. company, industry, job role, function;
5. bank details (e.g., IBAN, credit card number, etc.) and other information required for payment and/or billing purposes (where applicable);
6. data relating to your consumption habits and preferences, for sending targeted offers of the Controller’s and/or commercial partners’ products/services;
7. any other information necessary for establishing and performing the contract or for related and/or functional activities, including Data collected in the context of creditworthiness checks or fraud-prevention measures.
8. Purposes and Legal Basis of the Processing.

Data are collected, used and stored for the following purposes: 

1. to comply with legal and/or regulatory obligations to which the Controller is subject, including tax, accounting, and administrative requirements related to service provision or product sales;
2. for the performance of contracts to which the data subject is a party and for taking pre-contractual steps at your request;
3. for ordinary pre-contractual activities connected to and/or instrumental for establishing the contractual relationship, such as creditworthiness, solvency or reliability checks aimed at preventing fraud risks;
4. for establishing, exercising or defending a legal claim of the Controller, including in court;
5. for carrying out corporate transactions such as transfers, acquisitions, mergers, demergers or other organisational changes;
6. for sending commercial communications regarding products and services similar to those already purchased (“soft spam”), without prejudice to your right to object at any time;
7. for sending surveys and other “customer satisfaction” activities aimed at assessing satisfaction levels or improving service quality;
8. for conducting market research, promotional initiatives and sending commercial communications — by companies of the Alveo Group and/or commercial partners — regarding their own and third-party products/services in the digital services, infrastructure and ICT sectors, via email, newsletter, SMS, MMS, postal mail or telephone calls with an operator;
9. for profiling activities aimed at tailoring promotional offers and personalizing the marketing activities referred to above.
10. for responding to contact requests made by filling out forms on the company website

Processing for purposes a), b), c), j) does not require your consent, as it is necessary to comply with legal obligations or for the performance of a contract or pre-contractual steps, in accordance with Article 6(1)(b) and (c) GDPR. Processing for purposes d), e), f), and g) does not require your consent as it is based on the legitimate interest of the Company, pursuant to Article 6(1)(f) GDPR. Processing for purposes h) and i) requires your consent pursuant to Article 6(1)(a) GDPR.

5. Provision of Data.

Providing Data for purposes a), b), and c) is mandatory under legal and contractual obligations; failure to do so will make it impossible for the Company to establish and/or continue a commercial relationship with you. Providing Data for purposes d), e), f), g) is optional but necessary for pursuing the Company’s legitimate interest, without prejudice to your right to object at any time based on your particular situation. Providing Data for purpose h) is optional; failure to do so will simply prevent the Company from carrying out the related activities, without affecting the establishment or performance of the contract. For purpose f), the Company may use the email address provided by you during a previous sale of products or services, without prejudice to your right to object at any time (initially or upon subsequent communications).

The provision of data for the purpose referred to in point j) is done of your own explicit will and failure to provide such data will make it impossible for the Company to contact back the customer/prospect.

6. Recipients or Categories of Recipients.

Data may be disclosed, made available or communicated to the following subjects, who may be designated by the Controller — depending on the case — as data processors, authorised personnel, joint controllers or may act as autonomous controllers: 

• employees or collaborators of the Controller, in any capacity;
• public or private entities, individuals or legal persons, used by the Company to carry out activities instrumental to the purposes outlined above and/or to whom the Controller must communicate Data due to legal or contractual obligations or for commercial promotion purposes, subject to your consent where required.

In any case, Data will not be disseminated. 

7. Retention Period.

The Controller will process your Data for the time strictly necessary to achieve the purposes described in this Privacy Notice. Specifically: 

• Pre-contractual activities – up to 24 months from Data collection
• Compliance with legal obligations – up to 10 years after service/product provision ends
• Administrative, accounting and tax purposes – up to 10 years after service/product provision ends
• Creditworthiness, solvency and fraud-prevention checks – for the duration of the contractual relationship
• Marketing purposes – until consent is withdrawn or 24 months after contract termination
• Profiling for marketing purposes – until consent is withdrawn or 24 months after contract termination
• Direct marketing – 24 months after contract termination unless the right to object is exercised under Article 21(2)(3) GDPR
• Management of extrajudicial, judicial and regulatory disputes – for the duration of the contractual relationship, with a possible extension in case of ongoing disputes involving customers and/or users of the Alveo Group websites
• Call recordings for service quality verification and Customer Care training – for 6 months from the recording date
• Customer Satisfaction surveys – 24 months after contract termination
• Contact requests – 24 months from the data acquisition

8. Transfer of Data to Third Countries.

The Company undertakes to process and store Data within the European Union. However, for the purposes described in section 4, Data may be transferred to recipients located outside the European Economic Area providing services related to the processing activities (e.g., technological, cloud, CRM providers). Any such transfer will comply with GDPR requirements and may rely on Standard Contractual Clauses, adequacy decisions, or other lawful mechanisms such as the EU–U.S. Data Privacy Framework. 

9. Rights of the Data Subject.

During the period in which your Data is processed, you may exercise at any time the rights provided under Articles 15 to 22 GDPR: 

1. Right of access: to obtain confirmation of whether your Data is being processed and receive related information;
2. Right to rectification: to have inaccurate or incomplete Data corrected;
3. Right to erasure: in certain circumstances, to obtain the deletion of Data no longer necessary for the contractual relationship or for legal obligations or judicial purposes;
4. Right to restriction of processing: in the cases provided under Article 18 GDPR;
5. Right to data portability: to receive your Data in a structured, commonly used, machine-readable format and request its transmission to another controller where technically feasible;
6. Right to object to processing based on legitimate interest: you may object at any time for reasons relating to your particular situation, unless the Controller demonstrates compelling legitimate grounds overriding your interests, rights and freedoms (e.g., the establishment, exercise or defence of legal claims);
7. Right to withdraw consent for marketing purposes: you may withdraw consent at any time for purposes h) and i).
8. Right to Lodge a Complaint with the Supervisory Authority.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe your rights under the GDPR have been violated. Instructions are available at http://www.garanteprivacy.it. 

11. Final Provisions.

The Company reserves the right to amend or update this Privacy Notice in accordance with developments in the applicable personal data protection legislation and/or changes in the Company’s organisational structure.

Privacy Notice for the Processing of Customer/Prospect Personal Data pursuant to Articles 13 and 14 of Regulation (EU) No. 2016/679 (“GDPR”)

Dear Data Subject, pursuant to Articles 13 and 14 of the GDPR, Alveo S.p.A. hereby informs you that the data relating to your company (hereinafter, the “Customer”) and the personal data of the individuals acting in its name and on its behalf (hereinafter, the “Data”) will be used and stored in accordance with Regulation (EU) 2016/679 (the “GDPR”), the applicable personal data protection laws, and this Privacy Notice. It is understood that it is your responsibility to inform the individuals acting on your behalf about the processing of their Data described in this Privacy Notice and, where required, to obtain their consent. 

1. Who We Are.

Depending on the purposes pursued, Alveo S.p.A. may process your Data as Data Controller (hereinafter, the “Controller” or the “Company”). For any request relating to the processing of your Data, you may contact Alveo S.p.A. by sending: 

• a registered letter with return receipt to the registered office; or
• an email to privacy@alveo.it – to the attention  of the Data Controller of Alveo.

2. Data Protection Officer.

The Company has appointed a Data Protection Officer (DPO) to facilitate communication with you. The DPO may be contacted:  

• via email at dpo@alveo.it – to the attention of the Data Protection Officer of Alveo;

This contact method is also available on the Company’s website, where any updates will be published. 

3. Categories of Data and Processing Methods

In the context of the activities relating to the establishment and subsequent management of the contractual relationship with you and/or the organisation for which you act as a representative, the Controller may collect and process the following categories of Data: 

1. personal and identification data (e.g., name, surname, tax code, VAT number, images, videos);
2. contact details such as residential or domicile address, email address, telephone number;
3. internet browsing data on the company website (e.g., cookies, IP addresses, operating system and device parameters – see cookie policy);
4. company, industry, job role, function;
5. bank details (e.g., IBAN, credit card number, etc.) and other information required for payment and/or billing purposes (where applicable);
6. data relating to your consumption habits and preferences, for sending targeted offers of the Controller’s and/or commercial partners’ products and/or services;
7. in general, any other information necessary for the establishment and performance of the contract or for related and/or functional activities, including Data collected in the context of creditworthiness checks and fraud-prevention activities.
8. Purposes and Legal Basis of the Processing.

The Data are collected, used and stored for the following purposes: 

1. to comply with legal and/or regulatory obligations to which the Controller is subject, including tax, accounting and administrative obligations related to the provision of services or the sale of products;
2. for the performance of contracts to which the data subject is a party and for taking pre-contractual steps at your request;
3. for ordinary pre-contractual activities connected to and/or instrumental for establishing the contractual relationship, such as creditworthiness, solvency and/or reliability checks, in order to prevent potential fraud risks;
4. for establishing, exercising or defending a legal claim of the Controller, including in judicial proceedings;
5. for carrying out corporate transactions such as transfers, acquisitions, mergers, demergers or other organisational changes;
6. for sending commercial communications regarding products and services similar to those already purchased (“soft spam”), without prejudice to your right to object at any time;
7. for sending surveys and other “customer satisfaction” activities aimed at assessing satisfaction levels and/or improving service quality;
8. for conducting market research, promotional initiatives and sending commercial communications, by companies of the Alveo Group and/or commercial partners, regarding their own and third-party products and services operating in the digital services, infrastructure and ICT sectors, via email, newsletter, SMS, MMS and/or postal mail or phone calls with an operator;
9. for profiling activities aimed at guiding promotional offers and personalizing the marketing activities referred to above.
10. for responding to contact requests made by filling out forms on the company website

Processing for purposes a), b) c), j) does not require your consent as it is necessary to comply with legal obligations or for the performance of a contract or pre-contractual steps taken at your request, pursuant to Article 6(1)(b) and (c) GDPR. Processing for purposes d), e), f) and g) does not require your consent as it is based on the legitimate interest of the Company, pursuant to Article 6(1)(f) GDPR. Processing for purposes h) and i) requires your consent, pursuant to Article 6(1)(a) GDPR.

5. Provision of Data.

Providing Data for purposes a), b) and c) is mandatory under legal and contractual obligations; failure to do so will make it impossible for the Company to establish and/or continue the commercial relationship with you. Providing Data for purposes d), e), f) and g) is optional, but necessary for pursuing the Company’s legitimate interest, without prejudice to your right to object at any time to the processing based on reasons related to your particular situation. Providing Data for purpose h) is optional; failure to do so will simply prevent the Company from carrying out the related activities, without any consequence for the establishment and/or performance of the contract. With regard to purpose f), the Company may use the email address you provided in the context of a previous sale of products or services, without prejudice to your right to object at any time (initially or upon subsequent communications), in the manner described in the relevant section of this Privacy Notice.

The provision of data for the purpose referred to in point j) is done of your own explicit will and failure to provide such data will make it impossible for the Company to contact back the customer/prospect.

6. Recipients or Categories of Recipients.

The Data may be disclosed, made available or communicated to the following subjects, who may be designated by the Controller — depending on the case — as data processors, authorised personnel, joint controllers, or may act as autonomous controllers: 

• employees or collaborators of the Controller, in any capacity;
• public or private entities, individuals or legal persons, used by the Company to perform activities instrumental to the purposes described above and/or to whom the Controller is required to communicate Data on the basis of legal or contractual obligations and/or for commercial promotion purposes, subject to your consent where required.

In any case, the Data will not be disseminated. 

7. Retention Period.

The Controller will process your Data for the time strictly necessary to achieve the purposes described in this Privacy Notice. In particular, depending on the specific purpose, the retention periods are as follows: 

• Pre-contractual activities – up to 24 months from the collection of the Data
• Compliance with legal obligations – up to 10 years after the end of the provision of services/products
• Administrative, accounting and tax purposes – up to 10 years after the end of the provision of services/products
• Creditworthiness, solvency and fraud-prevention checks – for the duration of the contractual relationship
• Marketing purposes – until consent is withdrawn or 24 months after the termination of the contractual relationship
• Profiling for marketing purposes – until consent is withdrawn or 24 months after the termination of the contractual relationship
• Direct marketing – 24 months after the termination of the contractual relationship, unless the right to object is exercised pursuant to Article 21(2) and (3) GDPR
• Management of extrajudicial, judicial and regulatory disputes – for the duration of the contractual relationship, with possible extension in the event of ongoing disputes with customers and/or users of the Alveo Group websites
• Call recordings for service quality verification and Customer Care staff training – for 6 months from the date of the call recording
• Customer Satisfaction surveys and other related activities – 24 months after the termination of the contractual relationship
• Contact requests – 24 months from the data acquisition

8. Transfer of Data to Third Countries.

The Company undertakes to process and store Data within the European Union. However, for the purposes set out in section 4, Data may be transferred to recipients located in countries outside the European Economic Area, which provide services related to the processing activities carried out by the Controller (e.g., technology, cloud or CRM service providers). Any such transfer, where applicable, will take place in compliance with the conditions laid down by the GDPR and will be governed, depending on the recipients, by the Standard Contractual Clauses adopted by the European Commission or, alternatively, by an adequacy decision of the Commission and/or any other mechanism permitted under the applicable legislation, including adherence to the EU–U.S. Data Privacy Framework. 

9. Rights of the Data Subject.

For as long as the Company processes your Data, you, as a data subject, may exercise at any time the rights provided for in Articles 15 to 22 GDPR: 

1. Right of access: you have the right to obtain confirmation as to whether or not your Data are being processed and, where that is the case, access to information relating to such processing;
2. Right to rectification: you have the right to obtain the rectification of inaccurate Data concerning you and to have incomplete Data completed;
3. Right to erasure (“right to be forgotten”): in certain circumstances, you have the right to obtain the erasure of your Data, where no longer relevant for the continuation of the contractual relationship and/or necessary to comply with a legal obligation to which the Controller is subject and/or for the establishment, exercise or defence of legal claims;
4. Right to restriction of processing: you have the right to obtain the restriction of processing in the cases provided for under Article 18 GDPR;
5. Right to data portability: you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another controller, where technically feasible;
6. Right to object to processing based on legitimate interest: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your Data based on the legitimate interest of the Controller, unless the Controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as the establishment, exercise or defence of legal claims;
7. Withdrawal of consent for marketing purposes: you have the right to withdraw at any time the consent you may have given for processing your Data for purposes h) and i).
8. Right to Lodge a Complaint with the Supervisory Authority.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if you believe that your rights under the GDPR have been infringed, in accordance with the procedures indicated on the Authority’s website: http://www.garanteprivacy.it. 

11. Final Provisions.

The Company reserves the right to amend and/or update this Privacy Notice based on developments in the applicable personal data protection legislation and/or in the event of changes to its corporate structure.