Snam Privacy Disclaimer

Pursuant to articles 13 and 14 of EU Regulation 679/2016

1. Introduction

In accordance with the provisions on the processing of personal data set out in EU Regulation 679/2016 ("GDPR") and Legislative Decree No. 196/2003 as amended (‘Privacy Code’), Snam S.p.a. provides the following information regarding the methods, purposes and scope of the processing of personal data collected in relation to the management of requests for information relating to the ‘Ravenna CCS’ project received at the info_ravenna_ccs@snam.it mailbox or received following a communication from Eni S.p.a. (‘Requests’) in order to respond fully to users' requests.

2. Data Controller

The user's personal data are acquired and processed by Snam S.p.a. with registered office in Piazza Santa Barbara 7 - San Donato Milanese (MI) (hereinafter, ‘Snam’ or the ‘Company’), in its capacity as Data Controller.

3. Type of personal data processed

Data provided voluntarily by the user

For the purposes set out below, the Data Controller may acquire personal data of the user such as identification data (e.g. first name, last name) and contact data (e.g. email address), as well as the content of Information Requests.

4. Purpose and legal basis of processing

a) Interaction with the Data Controller

The user's personal data are processed by the Data Controller for the purpose of responding to Information Requests. This processing is carried out pursuant to Art. 6, paragraph 1, letter b) of the GDPR.

b) Fulfilment of legal obligations

The User's personal data may be processed for purposes connected with the fulfilment of specific obligations provided for by laws, regulations, national and/or supranational sources, as well as by provisions of judicial and administrative authorities and supervisory and control bodies.

The User's personal data may also be processed to respond to requests from public authorities (such processing is carried out pursuant to Art. 6, paragraph 1, letter c) of the GDPR.

c) Legitimate interest

The User's personal data may also be processed whenever it is necessary in order to ascertain, exercise or defend a right of the Data Controller (such processing is in any case carried out pursuant to Art. 6, paragraph 1, letter f) of the GDPR.

Any refusal to provide personal data will result in the impossibility of responding to Requests.

5. Method of processing

The User's personal data are processed by the Data Controller with the aid of electronic tools with organisation and processing logics strictly related to the purposes themselves and, in any event, in such a way as to guarantee the security and confidentiality of the data.

The User’s personal data may be processed, on the basis of the instructions provided by Snam, by suppliers appointed as external data processors. A detailed list of these parties is available on request.

The processing of the user's personal data is carried out exclusively by authorised personnel, guaranteeing security and confidentiality.

6. Disclosure of personal data

The Data Controller may disclose the user’s personal data to the following third parties for the purposes set out in Art. 4 of this Policy:

duly authorised collaborators and employees entrusted with specific processing activities;
parent companies, subsidiary, associated or affiliated companies of Snam if strictly necessary to follow up on Requests;
third parties, appointed as external data processors, who provide services instrumental to the processing of personal data carried out by the Data Controller, such as, by way of example, IT service companies, consultancy firms, legal and accounting service providers;
Eni S.p.a., as part of the ‘Ravenna CCS’ project, to respond fully to Requests. In particular, where the user's personal data are communicated to Eni S.p.a., the latter will process them as the autonomous data controller, according to the purposes and methods set out in its privacy policy (see www.ravennaccs.it);
public administrations, judicial authorities, administrative authorities, consultants and consultancy companies as well as law enforcement agencies, to fulfil specific legal obligations.

User's personal data will not be transmitted outside the European Economic Area.

7. Retention of personal data

The Data Controller, in accordance with Art. 5 of the GDPR, retains the user's personal data for a period of time not exceeding the achievement of the purposes for which they were processed:

interaction with the Data Controller: for the time necessary to process the user's request, as well as to follow it up.

This is without prejudice to the right of the Data Controller to retain the user's personal data for a longer period of time if this is strictly necessary to protect the user's and the Data Controller’s rights, to fulfil legal obligations or to comply with orders from judicial, administrative or supervisory authorities.

8. Rights of the data subject

The user has the right to access their data at any time by contacting the Data Controller, at the addresses indicated in Art. 2 of the policy, or the Data Protection Officer, who can be contacted as indicated in Art. 9 of the policy. In particular, articles 13 - 21 of EU Regulation 2016/679 grant the data subject specific rights:

to obtain from the Data Controller confirmation of the existence of personal data concerning them and that such data be made available to them in an intelligible form;
transmit such data to another data controller without hindrance from the Data Controller(“data portability”);
to withdraw consent at any time without affecting the lawfulness of the processing based on the consent given before revocation, where applicable;
to know the origin of the data as well as the logic, purposes and methods on which the processing is based;
to know the categories of persons to whom they are disclosed, if any;
to obtain the cancellation (“right to be forgotten”), transformation into anonymous form or the blocking of data processed in breach of the law, as well as the updating, rectification or, if interested, the integration of data;
object, on legitimate grounds, to the processing even if only for certain purposes or in certain ways.

Finally, it is the user's right to lodge a complaint with the Italian Data Protection Authority, the independent administrative authority that ensures the implementation in the Italian legal system of national and European legislation on the processing of personal data.

9. Data Protection Officer

The Data Controller has appointed a Data Protection Officer to oversee the correct application of the legislation and to ensure respect for the rights of the data subject, who can be contacted at the following address: dataprotectionofficer@pec.snam.it.

Last updated: 6 May 2024