DATA PRIVACY STATEMENT (UNDER ARTICLES 13 AND 14 OF REGULATION (EU) 679/2016) IN CONNECTION WITH (i) APPLICATIONS FOR PARTICIPATION IN/REQUESTS FOR REGISTRATION WITH GME’S MARKETS, (ii) REPORTING OF BREACHES UNDER LEGISLATIVE DECREE 24/2023 (WHISTLEBOWING), AND/OR (iii) BROWSING GME’S WEBSITE

Under articles 13 and 14 of Regulation (EU) 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter "Regulation"), Gestore dei Mercati Energetici S.p.A (hereafter “GME”) informs you about the processing of personal data (hereafter “Data”) in connection with: (a) applications for participation in the Electricity Market, the Energy Efficiency Certificates Market, the Forward Account Registration Platform, the Market for certificates of release to consumption of biofuels (MCIC), requests for registration with the Register of Energy Efficiency Certificates, applications for participation in the P-GAS, the Gas Market (MGAS), the P-GO, the P-LOGISTICS, the PDC-oil, the PAR, the IT bulletin board for the registration of long-term energy contracts from renewable sources (PPA Bulletin Board), the Local Flexibility Market (MLF), requests for registration with the Data Reporting Platform (PDR), and the Inside Information Platform (PIP), as well as communications related to the OMPR Platform for fulfilling obligations under Regulation (EU) 2024/1106 of the European Parliament and the Council of 11 April 2024; and (b) information on breaches under Legislative Decree 24/2023, reported through the appropriate Reporting System set up by GME; as well as about the related rights exercisable by the data subjects under the Regulation. Furthermore, GME intends to inform you about the processing of personal data collected on this website, through technical cookies and fingerprinting tools.

1. Data Controller and Contact Details
The “Data Controller” is GME, having its registered office in Rome, Viale Maresciallo Pilsudski, 122/124, tel. no. +39-06-8012 4826, fax no. +39-06-8012 4514, info@mercatoelettrico.org, and represented by its interim Chief Executive Officer.

2. Data Protection Officer
GME, based on article 37 of the Regulation, appointed a Data Protection Officer. His/her contact details are: 06-80121 and rpd@pec.mercatoelettrico.org.

3. Privacy Officer
GME has also delegated functions relevant to confidentiality. In relation to the processing of the Data, the "Privacy Officer" is the Head of Markets, and each of the other Heads of Departments (independent of the Markets Department), who will answer any requests about the processing of the Data. A full and updated list of the Privacy Officers in charge of the processing is available at GME’s registered office.

4. Personal Data
The Data processed is the data that you provide when submitting the aforementioned registration requests/participation applications, in addition to the data always provided by you or generated in the execution of the consequent activities, and that consists mainly of personal identity data (name, surname, place and date of birth, details of the identity document) and contact details (e-mail accounts, telephone numbers), as well as the data the disclosure of which is provided for by the applicable rules for individual markets and, where appropriate, also data taken from public registers and archives.

As part of the reports made under Legislative Decree 24/2023, the Data processed is the data that you provide and that consist mainly of personal identity data (name and surname, taxpayer’s code, possible position, and service assignment at present and at the time of the facts being reported) and contact details (telephone number and e-mail account).

The computer systems and software procedures used to run the website acquire, during their normal operation, some personal data whose transmission is implied in the use of internet communication protocols. This data category includes the IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters related to the operating system and the user's IT environment.

This data, required for the use of the website, is processed only for obtaining statistical information on the use of the Services (most visited pages, number of visitors per hour or day, geographical areas of origin, etc.), and to check the correct functioning of the services offered.

The navigation data do not remain on the systems for more than sixty days and is stored for 24 months for possible needs of the judicial authority related to the verification of crimes. Any optional, explicit, and voluntary sending of messages to the contact addresses of GME involve the acquisition of the sender’s contact details, necessary for the response, and of all the personal data possibly included in those messages.

Cookie policy

Furthermore, the website uses technical cookies and fingerprinting tools. Cookies are small text strings that contain information stored on a computer or mobile device used by the visitor every time he/she visits an online site through a browser. Cookies allow sites to remember some information that allows the user to navigate in a secure and efficient way. Fingerprinting is a technique that allows to identify the device used by the user by collecting all or some of the information related to the specific configuration of that device.

The data subject may, at any time, manage the cookies on his/her device, including through requests of general disabling or cancellation, by appropriately changing the settings of his/her internet browser. It is understood that any disabling of cookies may slow down or prevent access to some parts of the website or make navigation within it less efficient.

The settings to manage or disable cookies may vary depending on the internet browser used. Therefore, for more information on this point, it is necessary to refer to the device manual or to use the "Help" function of your Internet browser.

The following are links on how to manage or disable cookies for the most popular Internet browsers:

• Microsoft Edge: https://support.microsoft.com/it-it/microsoft-edge/eliminare-i-cookie-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/it/kb/Gestione%20dei%20cookie
• Opera: https://help.opera.com/Windows/10.00/it/cookies.html
• Safari: https://support.apple.com/it-it/HT201265

5. Purposes of the processing
GME will process data solely for institutional purposes, which are specified below:
a) fulfilment of obligations arising from contractual relationships established with GME; correct management of the contractual relationship and of related obligations; administration and handling of correspondence, including via fax or e-mail;
b) fulfilment of regulatory, accounting and tax obligations, as well as compliance with provisions issued by authorities, regulators, oversight bodies or with administrative practices;
c) collection of pre-contractual or contractual information, including economic and financial assessments, and protection, including in court, of GME’s interests and rights.
d) response to any spontaneous messages transmitted to the contact addresses of GME.

The processing referred to in subparagraph a) above is necessary to form and execute contracts and in any case to provide the services and carry out the activities you request. The legal basis of this processing is the fulfilment of a contract to which the data subject is a party.

The processing referred to in subparagraph b) above is necessary to comply with legal obligations. The legal basis of this processing is the fulfilment of legal obligations.
In particular, as regards, the relevant regulatory framework:
- provision of the Data when submitting applications for participation in the Electricity Market is compulsory, since it is required for admission to the respective markets, in accordance with the Integrated Text of the Electricity Market Rules, approved by the Ministerial Decree of 19 December 2003, as subsequently amended and supplemented;
- provision of the Data when submitting applications for participation in the Energy Efficiency Certificates Market is compulsory, since it is required for admission to the same market, in accordance with the Energy Efficiency Certificates Market Rules. These Rules, which GME adopted in consultation with Autorità di Regolazione per Energia Rete e Ambiente (ARERA – Italian Regulatory Authority for Energy, Networks and Environment) under art. 10, para. 3, of the Ministerial Decrees of 20 July 2004, entered into force on the date of their publication on the website on 9 May 2005 and were approved by ARERA on 14 Apr. 2005 (Decision 67/05);
- provision of the Data when submitting applications for participation in the Forward Account Registration Platform is compulsory, since it is required for admission to the same platform, in accordance with the Rules Governing the Forward Account Registration Platform. These Rules were successfully verified by the Director of Markets of ARERA (Decision of 7 Feb. 2007, as subsequently amended and supplemented);
- provision of the Data when submitting requests for registration with the Register of Energy Efficiency Certificates is compulsory, since it is required for registration with the same register, in accordance with the Rules for Registering Bilateral Transactions of Energy Efficiency Certificates, approved by ARERA on 14 Apr. 2008 (Decision EEN 5/08);
- provision of the Data when submitting applications for participation in the Platform for the Trading of Bids/Offers to Natural Gas (P-GAS) is compulsory, since it is required for participation in the same platform, in accordance with the Regulations of the Platform for the Trading of Bids/Offers of Natural Gas (P-GAS), approved by the Ministry of Economic Development on 23 Apr. 2010;
- provision of the Data when submitting applications for participation in the natural Gas Market (M-GAS) is compulsory, since it is required for admission to the market, in accordance with the Natural-Gas Market Rules (approved by the Ministry of Economic Development with his Decree of 6 March 2013, as subsequently amended and supplemented), which superseded the Gas Market Rules (approved by the Ministry of Economic Development, after hearing the opinion of ARERA, on 26 Nov. 2010);
- provision of the Data when submitting applications for participation in the P-GO is compulsory, since it is required for admission to the platform, in accordance with the Rules governing the operation of the regulated market and of the platform for registration of bilaterals of guarantees of origin, successfully verified by the Director of Markets of ARERA on 22 Dec. 2011, as subsequently amended and supplemented;
- provision of the Data regarding applications for participation in the Mineral-Oil Logistics Platform (P-LOGISTICS) is mandatory, as it is necessary to sign up to the platform, as provided for in the Regulation Governing the Trading Platform for Mineral-Oil Logistics Services, approved by the Ministry of Economic Development on 5 July 2017;
- provision of the Data when submitting applications for participation in the Mineral-Oil Storage and Transit Capacity Data Reporting Platform (PDC-oil) is compulsory, since it is required for admission to the platform, in accordance with the Regulation Governing the Mineral-Oil Storage and Transit Capacity Data Reporting Platform (PDC-oil), posted on the website.
- provision of the Data relating to participation applications in the Platform for the Allocation of Regasification Capacity (PAR) is mandatory, as it is necessary for participating in the platform, as required by the Regulation of the Platform for the Allocation of Regasification Capacity, approved by ARERA with Decision no. 111/2018/R/gas;
- provision of the Data relating to requests for registration with the Data Reporting Platform (PDR) is required as it is necessary for registration with the same platform, as laid down in the relevant standard contract model and in the manner specified in the PDR User Manual, posted on the website;
- provision of the Data relating to requests for registration with the Inside Information Platform (PIP) is required as it is necessary for registration with the same platform, as laid down in the relevant standard contract model and in the manner specified in the PIP User Manual, posted on the website;
- provision of the Data relating to requests for admission to the MCIC is mandatory as it is necessary for registration with the platform, in accordance with the Rules of Operation of the Market for certificates of release to consumption of biofuels, approved by the Ministry of Economic Development on 3 April 2020.
- provision of the Data related to requests for admission to the PPA Bulletin Board is compulsory, as it is necessary for registration with the platform, in accordance with the Regulations of the Bulletin Board of long-term energy contracts from renewable sources, available on the website;
- provision of the Data related to requests for admission to the MLF is compulsory, as it is necessary for registration with the platform, in accordance with the MLF Regulations approved by ARERA with Decision 372/2023/R/eel of 3 August 2023; - provision of the data as part of the communications related to the OMPR Platform is compulsory, as it is necessary for fulfilling obligations under Regulation (EU) 2024/1106 of the European Parliament and the Council of 11 April 2024.

With regard to the reports made under Legislative Decree 24/2023, provision of the Data is necessary to adequately process them in compliance with the above-mentioned decree.

The processing referred to in subparagraph c) above is necessary for fulfilling pre-contractual and contractual obligations and for the legitimate interest of GME only in relation to the protection of its rights in court. However, the processing is strictly limited to what is necessary for these purposes, respecting the rights of the data subjects.

The acquisition of the Data for the above purposes is therefore necessary and is an essential requirement for the implementation of relationships, in the absence of which GME cannot admit the participant to the markets and provide the related services.

The processing mentioned in subparagraph d) above is necessary to enable GME to process any requests contained in the messages, in line and compliance with its institutional role.

Technical cookies and fingerprinting tools, used by the website, allow the user device to be identified by collecting information related to the device configuration. GME's technical cookies and fingerprinting tools are strictly necessary for browsing the website and, in this context, no information is used for profiling and tracking users. In particular, GME uses session cookies that are not permanently stored on the user's computer but end when the browser is closed. The use of these cookies is strictly limited to the transmission of session identifiers necessary to enable a secure and efficient website navigation.

6. Parties to whom the Data may be notified and who may process the Data
Within the limits established by the current legislation and the aforementioned purposes, the Data may be notified by GME to the following parties:
i) to its parent companies and/or subsidiaries;
ii) to third parties – such as providers of administrative, financial, accounting, IT services, etc.; professionals and/or consultants - the support of which is used by GME for purposes strictly correlated with and related to those for which the Data was collected;
iii) to Public Authorities, Supervisory and Control Bodies, or other parties indicated by the latter, on the basis of regulatory provisions or provisions issued by such parties;
iv) to the other parties operating in the platforms, markets and systems referred to at the beginning of this Statement, according to the respective regulations.
Parties belonging to the above categories shall process personal data as separate Data Controllers or as Officers specifically designated by GME with the guarantees referred to in article 28 of the Regulation.

Within GME, the Data shall be accessed only by authorised personnel members requiring them in the performance of their activities and tasks. These parties - employees, consultants, temporary workers, and/or any other "natural person" under the direct authority of GME - shall carry out their activities as authorised and according to the instructions provided by GME under article 29 of the Personal Data Protection Code.

The Data will not be published or disseminated in any case, unless in cases set forth by regulatory obligations.

Any transfer of data outside the European Union will be limited to countries for which there is an adequacy decision of the EU Commission or in any case will be subject to adequate guarantees according to the Regulation. You may request information on this matter, including a copy of the data or an indication of the place where it was made available, by contacting the contact points indicated in this statement.

Cookie-related data and fingerprinting tools are managed only within the website and will not be transferred to third parties.

7. Data processing modalities
With reference to the aforementioned purposes, GME, in compliance with the law and the obligations of confidentiality and security, processes the Data by using manual, computerised and/or IT tools, establishing organisational and logical procedures to ensure the security and confidentiality of the same Data.

As you will be reminded, in case you contact or are contacted by telephone by the Trading Room of GME, your conversation will be recorded for the purposes of paragraph 5, subparagraphs a), b), and c) above, including for the purpose of improving the service and protecting the rights of GME. The recording of telephone calls will take place by means of an automated system. The recordings will be archived and will be accessible and listened to only by those expressly authorised. After hearing the data privacy message, if you accept to continue the call, GME will record and process the personal data that you will provide to the operator at that time.

The Data will be processed for the time needed for the acquisition and for the duration of the relationships established. After the termination of such relationships, the Data will be processed for a maximum period of 10 years for the fulfilment of all the legal retention obligations and for the protection, even in court, of the interests of GME, in this case also for the additional time necessary to conclude the disputes. The Data related to the reports made under Legislative Decree 24/2023 will be stored only for the time needed to process them and in any event for no longer than 5 years beginning on the date of communication of the final result of the reporting procedure.

It is important to remind that GME's technical cookies and fingerprinting tools are strictly necessary for browsing the website and, in this context, no information is used for profiling and tracking users.

8. Source of personal data
If personal data is not directly collected from the data subject, GME will acquire it through public registers and archives.

9. Rights of the data subject
Pursuant to articles 12 et seq. of the Regulation and if the conditions provided for by the same articles are met, the data subject may:

• request the Data Controller to confirm that there is/is not a processing of his/her personal data and, if so, to obtain access to the Data and information indicated in article 15 of the Regulation;
• request the Data Controller to access personal data and to rectify or cancel them or limit their processing or to oppose their processing, in addition to the right to data portability;
• if the processing is based on article 6 (1) (a) or article 9 (2) (a), withdraw his/her consent at any time without prejudice to the lawfulness of the processing based on the consent given before withdrawal;
• propose a complaint to the supervisory authority (http://www.garanteprivacy.it/web/guest/home/footer/contatti);
• obtain from the Data Controller the correction of inaccurate personal data concerning him/her without undue delay;
• obtain from the Data Controller the cancellation of personal data concerning him/her without unjustified delay in the cases provided for by article 17 of the Regulation;
• obtain from the Data Controller the limitation of the processing of personal data in the cases provided for by article 18 of the Regulation;
• obtain data portability according to the terms and conditions set forth in article 20 of the Regulation;
• possibly oppose at any time, for reasons linked to his/her particular situation, the processing of personal data as per article 6 (1) (e) and (f), of the Regulation, including the profiling of personal data made on the basis of these provisions.

Requests for the exercise of the rights mentioned above can be sent to the contact points indicated in this statement.