In accordance with the provisions of Articles 13-14 of EU Regulation 679/2016 regarding the protection of natural persons with regard to the processing of personal data, as well as the free circulation of such data (hereinafter: "Regulation"), Gestore dei Mercati Energetici S.p.A. (hereinafter: "GME") would like to inform you about the processing of personal data (hereinafter: "Data") which, as "holder" pursuant to the Regulation, carries out for the purposes related to the selection of its suppliers and to the conclusion and execution with the such suppliers of the orders/ agreements/contracts, in compliance with the Regulation, of the Legislative Decree no. 196/03, "Code on the protection of personal data" and the remaining applicable regulations.

1. Data and contact Controller
The “Data Controller” is GME, having its registered office in Rome, Viale Maresciallo Pilsudski, 122/124, tel. no. +39-06-8012 4826 begin_of_the_skype_highlighting, fax no. +39-06-8012 4514, info@mercatoelettrico.org, and represented by its interim Chief Executive Officer.

2. Data Protection Officer
GME, based on art. 37 of the Regulations, appointed a Data Protection Officer. His contact details are: 06-80121 and rpd@pec.mercatoelettrico.org.

3. Privacy Officer
GME has also delegated functions relevant to the confidentiality. In relation to specific processing, the "Privacy Officer" is the Head of the Direction of the Company managing the related supply and the other Heads of other Directions, who will answer any requests about the processing of the Data. A full and updated list of the Privacy officers in charge of the processing is available at GME’s registered office.

4. Data processed
The data we process are essentially those notified by the supplier in the selection procedures and for the conclusion and execution of contracts, such as names, dates of birth, tax identification numbers, in addition to those, even non-personal, which the supplier always notifies or in any case are generated directly or indirectly during the contractual relationship, such as accounting and invoicing data. GME may also collect Data from public archives and registers as well as from third suppliers, for example when verifying requirements of professionalism and respectability declared or in relation to contractual events and the presence of the supplier's reliability conditions.

5. Purposes of the processing
GME processes the Data exclusively in relation to its institutional tasks, for the purposes specified below:
1) purposes related to the establishment and execution of the relationship with GME, such as the carrying out of selection procedures, the preparation of contracts, payment of invoices, etc.
2) obligations arising from regulatory obligations including those relating to public contracts (Legislative Decree No. 50/2016 and subsequent amendments and additions), and accounting, tax and regulatory provisions.
3) purposes related to the good performance of corporate activities - in compliance with applicable regulations, corporate policies and standards for crimes prevention - and the protection, even in court, of the assets, the relevant rights and interests of GME.

The processing described in point 1) is necessary to form and execute the contractual relationship with GME. The processing described in point 2) is required to fulfill legal obligations. The processing described in point 3) is necessary to pursuit the legitimate interest of GME in the correct formation and execution of the relationship, the fulfillment of the obligations arising from it and, more generally, the good performance of the corporate activity and the protection rights, processes and corporate assets in compliance with current regulations. However, these processing are limited to what is necessary for these purposes, while respecting the rights of the interested parties.

Therefore, the collection of data for the above purposes is necessary and represents an essential requirement for the conclusion and execution of the contract. Failing this, it would not be possible to activate and carry out the relationship and, in any case ,proceed with its execution.

6. Parties to whom the data may be notified and who may process the data
Within the limits established by current legislation and the aforementioned purposes, the data may be notified by GME to the following parties:
i)to its parent companies and / or subsidiaries;
ii)to third parties - as providers of administrative, financial, accounting, IT services, etc., professionals and/or consultants - the support of which is used by GME for purposes strictly correlated and related to those for which the Data were collected;
iii)to Public Authorities, to the Supervisory and Control Bodies or to other parties indicated by the latter, on the basis of regulatory provisions or provisions issued by such parties.

Parties belonging to the above categories shall process personal data as separate Data Controllers or as Managers specifically designated by GME with the guarantees referred to in art. 28 of the Regulation.

Within GME, only authorized personnel who need it due to its activity and the tasks performed may access the data. These parties - employees, consultants, temporary workers and/or any other "natural person" under the direct authority of GME - shall carry out their activities as authorized and according to the instructions provided by art. 29 of the GME Code.

The Data will not be published or disseminated in any case, unless provided for by regulatory obligations.

Any transfer of data outside the European Union will be limited to countries for which there is an adequacy decision of the EU Commission or in any case will be subject to adequate guarantees according to the Regulation. You may request information on this matter, including a copy of the data or an indication of the place where they were made available, by contacting the contact points indicated in this statement.

7. Data processing modalities
With reference to the aforementioned purposes, GME, in compliance with the law and the obligations of confidentiality and safety, processes the data by using manual, computerized and/or IT tools, setting organizational and logical procedures to ensure the safety and confidentiality of the same data.

The Data are processed for the time needed for formation and for the duration of the relationships established. After the termination of such relationships, the Data are processed for a maximum period of 10 years for the fulfillment of all the duties and obligations of conservation provided for by the law and for the protection, even in court, of GME’s interests, in this particular case also for the additional time necessary to conclude any disputes.

8. Rights of the interested party
Pursuant to articles 12 et seq. of the Regulation and if the conditions provided for by the same articles are met, the interested party may:

• request the data controller to confirm that there is/is not a processing of his/her personal data and, if so, to obtain access to the data and information indicated in art. 15 of the Regulation;
• request the data controller to access personal data and to rectify or cancel them or limit/oppose their processing, in addition to the right to data portability;
• if the processing is based on Article 6 (1) (a) or Article 9 (2) (a), withdraw consent at any time without prejudice to the lawfulness of the processing based on consent given before the withdrawal;
• propose a complaint to a supervisory authority (http://www.garanteprivacy.it/web/guest/home/footer/contatti);
• obtain from the data controller the correction of inaccurate personal data concerning him/her without undue delay;
• obtain from the data controller the cancellation of personal data concerning him/her without unjustified delay in the cases provided for by art. 17 of the Regulation;
• obtain from the data controller the limitation of the processing of personal data in the cases provided for by art. 18 of the Regulation;
• obtain data portability according to the terms and conditions set forth in art. 20 of the Regulation;
• possibly oppose at any time, for reasons linked to his/her particular situation, the processing of personal data as per subparagraphs e) and f) of the art. 6, paragraph 1, of the Regulation, including the profiling of personal data made on the basis of these provisions.

Requests for the exercise of the rights above can be sent to the contact points indicated in this statement.