Download App

DRIV&Customer Service Information

INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF THE GDPR CALL CENTRE SERVICE – CUSTOMER SUPPORT IN THE DRIV& PROGRAM

This Privacy Policy is provided pursuant to Article 13 of EU Regulation 2016/679 (“GDPR“) by Italiana Petroli S.p.A. (hereinafter, “IP” or “Company“) and ESE S.r.l. (hereinafter, “ESE” or “Company“) as joint data controllers and is specifically aimed at the processing of your personal data as part of the use of the call centre/customer service (available at 0695582882) of the IPiù loyalty program marketed as “DRIV&” and managed by both companies.

We also inform you that the processing of your personal data will be based on the principles of lawfulness, fairness, transparency, purpose and storage limitation, data minimisation and accuracy, integrity and confidentiality, as well as the principle of accountability pursuant to Article 5 of the GDPR. “Processing of personal data” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1. JOINT CONTROLLERS AND DPO

The joint controllers for the processing of your personal data as part of the IPiù loyalty program marketed as “DRIV&” and its call centre/customer service (hereinafter also referred to as the “Program”) are:

  • Italiana Petroli S.p.A. with registered office in Rome (RM), Via Salaria no. 1322, postcode 00138

and

  • ESE S.r.l. with registered office in Rome (RM), Via Salaria no. 1322, postcode 00138;

In the remainder of this Privacy Policy, IP and ESE are also referred to individually as “Joint Controller” and jointly as “Joint Controllers”, having jointly determined the purposes and means of processing related to the Program and its ancillary services through the conclusion of a specific agreement pursuant to Article 26 of the GDPR. As part of this agreement, IP has been designated as the point of contact for all your requests relating to the processing of your personal data and the exercise of your rights deriving from the GDPR; it remains understood that you can exercise your privacy rights

pursuant to Article 15 and following of the GDPR in respect of each of the Joint Controllers.

We also inform you that the Joint Controllers have appointed a Data Protection Officer (hereinafter the “Data Protection Officer” or “DPO”) who can be contacted at the following addresses: 

  • e-mail, at: dpoitalianapetroli@pec.gruppoapi.com. 
  • ordinary mail, to the address of both Joint Controllers, with registered office in Rome (RM), Via Salaria no. 1322, Post Code, 00138, for the attention of the Data Protection Officer.

2. PERSONAL DATA SUBJECT TO PROCESSING AND SOURCE FROM WHICH THEY ORIGINATE

The personal data processed by the Joint Controllers as part of the management of the call centre/customer service may include:

  • personal/identification data, such as: name, surname, tax code and date of birth;
  • contact details, such as: telephone number and e-mail address;
  • data relating to transactions carried out at IP and ESSO branded points of sale;
  • data relating to your DRIV& code;
  • data relating to the content of the request;
  • data relating to the transcription and recording of your request, only if you decide to speak to an operator;
  • any additional personal data that you may provide in connection with the use of the customer service.

 

The personal data indicated above will be hereinafter jointly defined, for the sake of brevity, as “personal data”.

We inform you that, if you decide to provide your personal data (special or judicial data) or personal data of third parties that the Joint Controllers are not required to process as they are not relevant and strictly necessary with respect to the purposes pursued and, specifically, for the management of your request for assistance, the Joint Controllers will refrain from collecting and processing such personal data which, if provided, will be promptly deleted. For this reason, if not strictly necessary for the management of your request, we ask you not to provide this type of information.

With reference to the source from which the aforementioned personal data originates, please note that it is collected from you as part of the use of the call centre/customer service.

3. PURPOSE OF PROCESSING AND LEGAL BASIS

Personal data will be processed by the Joint Controllers for the following purposes:

a) in order to manage and fulfil your request for assistance. To this end, the Joint Controllers will process the personal data referred to in point 2 of this Privacy Policy pursuant to Article 6, paragraph 1, letter b) of the GDPR, insofar as the processing of the data is necessary for the performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the request of the data subject. (Purpose of managing the customer service);

b) In order to assess the quality of the service provided and measure and monitor the level of customer satisfaction, to improve customer service, only for requests for assistance handled by telephone with an operator. To this end, the Joint Controllers will process the personal data referred to in point no. 2 of this Privacy Policy, in particular the data relating to the transcription and recording of your request, pursuant to Article 6, paragraph 1, letter a) of the GDPR, i.e. on the basis of your explicit consent. (Purpose of service evaluation and customer satisfaction).

The provision of personal data for the purposes indicated above is optional; however, if such data is not provided, the Joint Controllers may be unable to provide the requested assistance service. The Joint Controllers inform you that, in the event that you do not wish to consent to the recording of the call and, therefore, manage your request with an operator, you can hang up and fill out the form on the website www.ip.gruppoapi.com in the “Write us” Support section, selecting “Loyalty Program and DRIV& APP” as the subject.

Once provided, personal data may also be processed by the Joint Controllers for the following purposes:

c) in order to comply with legal obligations, national and community regulations or legislation, including the provisions of the supervisory authorities of the sector and/or the provisions of the judicial and/or administrative authorities (including the fulfilment of accounting and tax obligations as well as those related to the purposes of ascertaining and repressing crimes, public order and civil protection). To this end and when necessary, the Joint Controllers will process the personal data referred to in point no. 2 of this Privacy Policy pursuant to Article 6, par. 1, letter c), of the GDPR (Fulfilment of a legal obligation);

d) in order to ascertain, exercise or defend a right in court or out of court, including debt collection. For this purpose, the Joint Controllers will process the personal data referred to in point no. 2 of this Privacy Policy pursuant to Article 6, paragraph 1, letter f), of the GDPR – insofar as there is a legitimate interest of the Joint Controllers to exercise or defend their right in court or out of court (Legal defence purposess).

4. PROCESSING METHODS

Personal data will be processed using IT, manual and/or telematic tools and media, with logic strictly related to the purposes of the processing and in any case ensuring the confidentiality and security of the data and in compliance with the applicable Regulations and Provisions of the Data Protection Authority.

More information is available from the DPO at the addresses indicated in paragraph 10 of this Privacy Policy.

5. PERSONAL DATA RETENTION PERIOD

The Joint Controllers will keep your Personal Data only for the time necessary for the purposes for which they are collected, in compliance with the principles of minimisation and limitation of the purpose referred to in Article 5, paragraph 1, letters c) and e) of the GDPR.

  • In particular, your Personal Data, processed for the purposes referred to in paragraph 3, letter a) of this Privacy Policy will be kept for a period of time not exceeding one year from the closure of the request for assistance. Once these terms have elapsed, with the exception of cases in which there is a dispute, they will be destroyed or made anonymous and used for statistical purposes only;
  • Personal Data processed for the purposes referred to in paragraph 3, letter b) of this Privacy Policy, and in particular telephone recordings and transcripts, will be stored for a period of three months from the date of acquisition of the call, without prejudice to the possibility of withdrawing consent. Once these terms have elapsed, with the exception of cases in which there is a dispute, they will be destroyed.
  • Personal Data processed for the purposes referred to in paragraph 3, letter c) of this Policy will be kept for the time required by the specific obligation or applicable law.
  • The Joint Controllers also reserve the right, for the purposes referred to in paragraph 3, letter d) to keep the Personal Data also for as long as necessary to ascertain and exercise their right and/or satisfy any legal defence purposes in court as well as in the out-of-court context and in the stages preceding the litigation.

 

For more information, you can contact the Joint Controllers and/or the DPO at the contacts referred to in paragraph 10 of this Privacy Policy.

6. CATEGORIES OF RECIPIENTS OF YOUR PERSONAL DATA

Your Personal Data may be shared with the parties indicated below (also referred to as “Recipients”):

  • persons authorised by the Joint Controllers to process personal data pursuant to Articles 29 of the GDPR and 2-quaterdecies of the Privacy Code (e.g. the internal staff of the Joint Controllers, etc.);
  • entities or authorities to which your Personal Data must be disclosed by virtue of legal provisions provided for by European Union law or by that of the Member State to which the Joint Controllers are subject;
  • third parties such as the police and public authorities to protect the rights of the Joint Controllers, or following a request validly made by them;
  • subjects who, in the provision of services, typically act as data processors pursuant to Article 28 of the GDPR (by way of example, suppliers/contractors of goods or services related to the provision of the benefits obtainable through the loyalty points accumulated by the Customer, or to the technical management of the Program).

 

The complete list of Recipients is available from the Joint Controllers or the DPO at the addresses indicated in paragraph 10 of this Privacy Policy, to which the updated list of Data Processors may also be requested

7. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

The Joint Controllers do not transfer your personal data to third countries (outside the European Economic Area, “EEA”) or international organisations; such data are stored at the headquarters of the Joint Controllers and on servers located within the territory of the European Union. If this becomes necessary, the transfer by the Joint Controllers of your Personal Data to subjects located in Third Countries will take place, in any case, in compliance with the provisions of the applicable legislation on the protection of personal data and on the basis of one of the appropriate guarantees provided for by Article 44 et seq. of the GDPR, such as, for example, the adoption of Standard Clauses approved by the European Commission, the selection of subjects adhering to international programs for the free circulation of data or operating in countries considered safe by the European Commission, in compliance with the recommendations 01/2020 adopted on 10 November 2020 by the European Data Protection Board.

Further information can be obtained, upon request, from the Joint Controllers or the DPO at the contacts indicated in paragraph 10 of this Privacy Policy.

8. RIGHTS OF THE DATA SUBJECT

  • Right of access (Article 15 of the GDPR) – you have the right to obtain confirmation as to whether or not personal data is being processed and the right to receive any information relating to such processing;
  • Right of rectification (Article 16 of the GDPR) – you have the right to obtain the rectification of personal data, if they are incomplete or inaccurate;
  • Right to erasure (Article 17 of the GDPR) – in certain circumstances, you have the right to obtain the erasure of personal data present in the archives of the Joint Controllers;
  • Right to restriction of processing (Article 18 of the GDPR) – upon the occurrence of certain conditions, you have the right to obtain the restriction of the processing of personal data;
  • Right to portability (Article 20 of the GDPR) – you have the right to obtain the transfer of personal data to a different data controller as well as the right to obtain the data concerning you in a structured format, commonly used and readable by an automatic device;
  • Right to object (Article 21 of the GDPR) – you have the right to object to the processing of personal data in which you give evidence of the reasons justifying the objection; the Joint Controllers reserve the right to evaluate this request, which may not be accepted if there are compelling legitimate reasons to proceed with the processing that prevail over your interests, rights and freedoms.
  • Right to lodge a complaint with the Supervisory Authority (Article 77 of the GDPR) – in the manner indicated in the following paragraph, if you believe that the processing that concerns you violates the legislation on the protection of personal data, you can lodge a complaint with the Supervisory Authority of the Member State in which you usually reside, work or the place where the alleged violation occurred;
  • Right to appeal to the appropriate courts (Article 79 of the GDPR).

 

To exercise the aforementioned rights with regard to the Joint Controllers, you may proceed in writing by contacting the following e-mail address: privacy@italianapetroli.it. The exercise of these rights is subject to certain exceptions aimed at safeguarding the public interest (e.g. the prevention or identification of crimes) and the interests of the Joint Controllers (e.g. the maintenance of professional secrecy). In the event that you exercise any of the aforementioned rights, it will be the responsibility of the Joint Controllers to verify that you are entitled to exercise it and tto respond to your request, as a rule, within one month.

9. COMPLAINTS

If you believe that the processing of your Personal Data is in violation of the provisions of the GDPR and the legislation on the protection of personal data, you have the right to lodge a complaint with the Data Protection Authority, using the references available on the website www.garanteprivacy.it or to take legal action.

10. CONTACTS OF THE JOINT CONTROLLERS AND THE RELEVANT DATA PROTECTION OFFICER (“DPO”)

You may at any time contact the Joint Controllers at the following e-mail address, identified as the single point of contact for the exercise of your rights: privacy@italianapetroli.it, or at the following e-mail addresses:

 

In this regard, the Joint Controllers inform you that you may in any case exercise your rights towards and/or against each Joint Controllers, by contacting the certified e-mail addresses indicated above or by sending your request/report through the dedicated form, in the “Write us” section of the following website: Privacy – Write us – Contacts and assistance Gruppo api, with the subject Loyalty Program and DRIV& APP.

Download App