Pursuant to Regulation (EU) 2016/679 (“GDPR“), the Proprietary Companies of the real estate on the website www.realestate.eni.com (“Company” or the “Owner“) hereby provide, each autonomously and to the extent of their competence, the information regarding the processing of personal data to enable users (“User” or “Users“) of the aforementioned website (“Website“) to know their personal data protection policy and to understand how Users’ personal information is collected and managed while browsing the Website and using the services of the same.
1. Identity and contact details of the Data Controller
The Data Controller is from time to time the Company Owner of the individual properties subject to disposal and of interest to the User, in particular:
- Eni S.p.A. with registered office in Rome, Piazzale Enrico Mattei, 1
- Eni Rewind S.p.A., with registered office in San Donato Milanese (MI), Piazza Boldrini, 1
- Eni Mediterranea Idrocarburi SpA (EniMed) with registered office in Gela, Strada Statale 117 Bis, Contrada Ponte Olivo
- EniProgetti S.p.A. with registered office in Venice Marghera, Via Pacinotti, 4
- Eni New Energy S.p.A. with registered office in San Donato Milanese (Milan), Piazza Boldrini 1
- EniServizi S.p.A. with registered office in San Donato Milanese (Milan), Piazza Boldrini 1
- Eni France sarl with registered office in Lyon, 12 Avenue Tony Garnier
- Eni Deutschland GmbH with registered office in München, Theresienhöhe 30
- Eni Austria GmbH with registered office in Vienna Millennium Tower Handelskai 94-96
- Eni Austria Marketing GmbH with registered office in Vienna Millennium Tower Handelskai 94-96
- Eni Suisse S.A. with registered office in Lausanne, Av. de Gratta-Paille 1
- Versalis International SA with registered office in Brussels, Rue Guimard 1/A
- ENI US OPERATING CO. INC. with registered office in Houston, 1200 Smith St. Suite 1700. Houston, TX 77002
- Eni UK Ltd with registered office in Londra, Ebury Bridge Road 10
2. Contact data of the data protection officer
The Company has appointed a Data Protection Officer, who can be contacted at the following email address dpo@eni.com.
3. Processing purposes and legal basis
a. Purpose of the law and necessary for the provision of services – processing necessary to fulfill a contractual or legal obligation to which the Data Controller is subject or to execute a specific request of the party concerned
The User’s personal data may be processed without the need for consent, in cases where this is necessary to fulfill obligations deriving from legal provisions, as well as rules, codes or procedures approved by Authorities and other competent institutions.
The User’s personal data will also be processed for the purposes related to and/or connected to the provision of services by the individual Company in the context of browsing the Website, specified by the Legal Disclaimer, accepted by the user, such as specifically:
- for the provision of the services requested by the User while browsing the Website and relating to the knowledge of the main characteristics of the properties subject to the sale procedure (the “Procedure”), including the collection, storage and processing of data for the establishment and subsequent operational and technical management of the Procedure. Specifically, the request for access to the data room for so-called restricted auctions, which involves the creation of a User profile, as well as registration to the Newsletter and Mail Alert service, by filling in the forms on the Website, involves the acquisition of the user’s contact details for the provision of the requested service;
- management of relations with third-party authorities and public bodies for purposes related to particular requests, the fulfillment of legal obligations or particular procedures;
Said data – the provision of which is necessary for the operational execution of the individual services requested – will also be processed by electronic means, recorded in special databases, and used strictly and exclusively for browsing the Website.
Since the communication of the User’s personal data for the aforementioned purposes is necessary for the purpose of maintaining and providing all the services connected to browsing the Website and related to the Procedure, failure to communicate will render follow-up of the user’s request impossible.
b. Consensus
In addition, with the express consent of the user through the appropriate pop-up, which can be revoked at any time through the settings of the navigation browser, the Company will proceed with the geolocation of the device used by the user to allow the functionality offered by Google Maps in identifying the user’s position with respect to the selected property.
c. Tracking of documentation download activities – registered user
Only for registered users who download the documentation relating to a property of a sale procedure, the Company will process the information related to the tracking of said download activity for security reasons connected to the nature of said procedure, as expressed in the Legal Disclaimer accepted by the user.
The legal basis that allows the Company to achieve this purpose responds to its legitimate interest in controlling and verifying the procedure for downloading sensitive documents.
d. Website functionality and aggregate and anonymous statistical analysis
Moreover, the Website, in the course of normal use by Users, acquires some personal data through its IT systems and software procedures for operation, the transmission of which is implicit in the use of Internet communication protocols. This category of data includes IP addresses or domain names of computers and terminals used by users, URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.) and other parameters regarding the operating system and the User’s IT environment.
Said data, necessary for the use of web services, is also processed for the purpose of:
- obtaining statistical information in aggregate and anonymous form on the use of the services (most visited pages, number of visitors per hour or daily time frame, geographical areas of origin, etc.);
- checking the correct functioning of the services offered.
The legal basis that allows the Company to achieve the two purposes indicated above, responds to the legitimate interest thereof: in these cases, although the collection of Users’ personal data is not mandatory under the law or essential for the provision of the service to them, it is however necessary, as such data is strictly connected and instrumental to the pursuit of such legitimate interests, which do not prevail over the fundamental rights and freedoms of Users, and any refusal to provide it could make it impossible to provide the services required.
e. Defence of a right in court
In addition, the User’s personal data will be processed, in the legitimate interest of the Data Controller, whenever necessary in order to ascertain, exercise or defend a right of the Data Controller and/or third parties in judicial proceedings.
In any case, the Data Controller guarantees the utmost care so that the communication of the User’s personal data to the aforementioned recipients concerns exclusively the data necessary for the achievement of the specific purposes for which it is intended.
The User’s personal data is stored in the Data Controller database and will be processed exclusively by authorized personnel. The latter will be given specific instructions on the methods and purposes of the processing. Said data will also not be disclosed to third parties, except as provided above and, in any case, within the limits indicated therein.
Lastly, we remind you that the User’s personal data will not be disclosed, except in the cases described above and/or required by law.
4. Transfer of personal data outside the EU
As part of the contractual relations between the Company, third parties and the Company’s subsidiaries, as well as between the subsidiaries themselves, for some of the purposes indicated in point 3, the User’s personal data may be transferred outside the EU, including through inclusion in shared databases managed by third companies, whether part of the Company’s control perimeter or not. The management of the database and the processing of such data are bound to the purposes for which they were collected and are carried out with the utmost respect for the standards of confidentiality and security set forth in the applicable personal data protection laws.
Whenever the User’s personal data is subject to international transfer outside the EU territory, the Data Controller will take all appropriate and necessary contractual measures to guarantee an adequate level of protection of the User’s personal data in accordance with as indicated in this policy on the processing of personal data, including, among others, the Standard Contractual Clauses approved by the European Commission.
5. Data retention period
The data will be stored for a period of time not exceeding that necessary for the purposes for which it was collected or subsequently processed in accordance with the provisions of legal obligations.
6. Rights of interested parties
As an interested party, the User is granted the following rights to personal data collected and processed by the Data Controller for the purposes indicated in point 3: (i) the right of access, in particular requesting, at any time, confirmation of the existence of the User’s personal data in the Company’s archives and making this information available in a clear and intelligible way, as well as the right to know the origin, logic and purpose of the processing with express and specific indication of the persons in charge of the processing and of the third parties to which the User’s personal data may be communicated; (ii) the right to obtain the updating and rectification of data (except for evaluations), the deletion of superfluous data or transformation in anonymous form, as well as the blocking of processing and definitive cancellation in the event of unlawful processing; and (iii) if the conditions exist, the limitation of processing and the portability of the data. The law also acknowledges the possibility for interested parties to lodge a complaint with the Guarantor for the protection of personal data, if the User identifies a violation of their rights pursuant to the applicable legislation on the protection of personal data.
The User may exercise the rights listed above by sending a specific communication by writing to immobiliare@eniservizi.eni.it or by writing to the Data Protection Officer dpo@eni.com.