Privacy

 

Privacy Notice regarding the Processing of Personal Data

 

INTRODUCTION  

In accordance with Articles 12 and 13 of the General Data Protection Regulation (EU) 2016/679 / General Data Protection Regulation (GDPR), and in general in accordance with the principle of transparency set out in the GDPR itself, Alperia Alperia S.p.A. (hereinafter also referred to as the 'Company' or 'Alperia') provides the following information regarding the processing of Personal Data (i.e. any information relating to an identified or identifiable natural person: 'Data Subject') of the newsletter subscriber (hereinafter also referred to simply as 'Subscriber').

 

  1. DATA CONTROLLER

The data controller (i.e. the entity that determines the purposes and means of processing personal data, the 'Data Controller' or 'Controller') is Alperia S.p.A., with its registered office at Via Dodiciville 8, I-39100, Bolzano, Tax Identification Number and VAT number 02858310218, certified email address (PEC) This email address is being protected from spambots. You need JavaScript enabled to view it..  Certified email address This email address is being protected from spambots. You need JavaScript enabled to view it.

 

For enquiries specifically relating to the protection of personal data, including the exercise of the rights referred to in point 9 below, please contact us at the following email address: This email address is being protected from spambots. You need JavaScript enabled to view it.

to whom you are kindly requested to send any enquiries you may have.

 

  1. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

Please be advised that the Data Controller has appointed, in accordance with Article 37 of the GDPR, a Data Protection Officer (DPO), who can be contacted via the following channels:

  • Data Protection Officer (DPO) c/o Alperia S.p.A., Via Dodiciville, No. 8, 39100 Bolzano
  • Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

 

  1. PURPOSE OF THE PROCESSING

Personal data may be processed for the following purposes:

  • to enable the user to browse the Website and use all its features, to monitor the Website’s proper functioning, and to enable the user to make better use of the content and services, including through registration and/or access to the members’ area;
  • user interaction with the Alperia Group companies via the Website (newsletters, data provided voluntarily in response to enquiries made by the Data Subject, booking appointments);
  • to enable the security checks required by law;
  • to establish liability in the event of cybercrimes committed against the Website;
  • to detect, prevent, mitigate and investigate fraudulent or illegal activities in relation to the services provided on the Website;
  • to collect, in aggregated and anonymous form, data relating to the use of the Website via analytics cookies, which are comparable to technical cookies;
  • (where consent is optional) to collect data relating to an individual user’s use of the Website via analytics and statistical cookies;
  • (where consent is optional) through profiling and third-party cookies, to send, directly or indirectly, advertising messages tailored to the user’s preferences and browsing behaviour.

For further information about cookies, please refer to the Cookie Policy.  

 

  1. TYPE OF PROCESSING

Alperia will process the personal data provided by the user and/or lawfully collected; in particular, the following categories of personal data may be processed:

  • browsing data: The IT and telecommunications systems and software procedures used to operate and facilitate the use of the Website, made available by Alperia, collect certain data, such as the date and time of access, pages visited, the name of the Internet Service Provider and the Internet Protocol (IP) address through which the user accesses the Internet, the Internet address from which the user connects to the Website (URL), etc.,  the transmission of which is implicit in the use of web communication protocols or is necessary for the better management and optimisation of the system for sending data and emails;
  • data collected whilst browsing via cookies and/or other tracking technologies on the Website: For further information, please refer to the Cookie Policy.

 

  1. LEGAL BASIS OF THE PROCESSING AND OBLIGATORY NATURE OF CONFERMENT

The Data Controller will process the user’s personal data where one or more of the legal bases set out in the GDPR apply:

  • following the user’s free, specific, informed and unambiguous consent to the processing of their personal data: for third-party cookies, profiling cookies, and non-aggregated analytics and statistics cookies;
  • for the purposes of performing a contract to which the user is a party or of taking pre-contractual measures at the user’s request: to enable the use of the website’s features, to ensure the website functions correctly, to respond to enquiries and requests from data subjects, and to enhance the customer experience;
  • in compliance with a legal obligation to which the Data Controller is subject: for the purposes of the security checks required by law and for the purposes of establishing liability in the event of any cybercrimes committed against the Website;
  • where the Data Controller has a legitimate interest: to ensure the proper functioning and security monitoring of the Website; to detect, prevent, mitigate and investigate fraudulent or illegal activities in relation to the services provided by the Website; to improve and measure customer satisfaction with the user experience; and to carry out quality control of the services offered.

The provision of personal data by the user will be:

  • this is necessary in all cases where processing is carried out on the basis of a legal obligation, or to perform a contract, or to fulfil pre-contractual obligations (for example, in relation to enquiries concerning the purchase of museum tickets, or to contact the customer again if they have completed a contact form); should the user refuse, the Data Controller will be unable to process the user’s requests and provide the services requested;
  • voluntary for the purposes of pursuing other additional objectives

 

  1. COLLECTION, METHODS OF PROCESSING AND DURATION OF PROCESSING

The data is collected from the Data Subject; that is, it comprises the data provided by the user and that resulting from the use of the website.

The personal data collected will be processed, using IT and telecommunications systems and, where necessary, manually, for the purposes set out above. ‘Processing of personal data’ means any operation or set of operations which is carried out on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interlinking, restriction, erasure or destruction.

The IT systems and software programmes used to operate the Website collect certain personal data, the transmission of which is implicit in the use of Internet communication protocols (e.g. IP addresses or domain names of the computers used by users connecting to the Website, the URI addresses – Uniform Resource Identifier – of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, a numerical code indicating the status of the response from the server – successful, error, etc. – and other parameters relating to the user’s operating system and IT environment). Although this information is not collected with the intention of being linked to identified data subjects, by its very nature it could, through processing and cross-referencing with data held by third parties, make it possible to identify users.

This data is used solely for the purpose of deriving statistical information – not linked to any data that could identify the user – regarding the use of the Website and to monitor its correct functioning; it is deleted immediately after processing.

In addition, data will be collected via cookies to manage and improve your browsing experience:

  • technical cookies that are strictly necessary for the website to function or to enable users to make better use of its content and services;
  • analytics and statistical cookies, which enable the collection of data relating to the use of the Website;
  • profiling and third-party cookies used to send, either directly or indirectly, advertising messages tailored to the user’s preferences and browsing behaviour.

For further information, including the retention period for the data collected, please refer to the Cookie Policy.  

The personal data of the Data Subject being processed will be retained for as long as is necessary to fulfil the purposes specified above, in accordance with the principles of proportionality and necessity, including, where applicable, the fulfilment of all related or consequential obligations laid down by the applicable legislation.

 

  1. DISCLOSURE OF DATA

The data collected and processed may be communicated, exclusively for the purposes specified above, to:

  1. all persons who are granted access to such data pursuant to legislative, regulatory and authorisation provisions;
  2. employees, contractors and suppliers of the Data Controller, in the course of their duties and/or contractual obligations relating to the performance of the contractual relationship with the data subjects; the Data Controller’s suppliers include, by way of example, other companies within the Alperia Group that provide inter-company services to the Data Controller, or other parties that carry out activities on behalf of the Data Controller under collaboration agreements, e.g. consultants and IT service providers;
  3. companies commissioned to carry out the activities involved in the specific data processing operation.

The parties listed above will process the data either as independent data controllers, or in their capacity as data processors or authorised data processors, having been specifically designated for this purpose.

The Data Controller provides the Data Processors and any Authorised Persons designated, where applicable, with appropriate instructions aimed at ensuring that suitable security measures are adopted to guarantee the confidentiality, security and integrity of the data.

 

  1. PLACE OF DATA PROCESSING

The processing of personal data takes place within the European Economic Area (EEA) – that is, the EU plus Norway, Liechtenstein and Iceland – as well as by certain sub-processors of Brevo, who are regulated in accordance with the provisions of Chapter V of the GDPR, in particular: (i) Canada, pursuant to an adequacy decision in respect of that country issued by the European Commission; (ii) the USA, on the basis of the EU-US Data Privacy Framework, the Standard Contractual Clauses and additional measures; (iii) India, on the basis of the Standard Contractual Clauses and additional measures.

Apart from what has been stated, there is no intention to transfer data to countries outside the EEA or to an international organisation.

 

  1. RIGHTS OF THE DATA SUBJECT

The GDPR grants the Data Subject the right to exercise their rights in relation to their personal data; reference should therefore be made to the GDPR, and in particular to Articles 15–21 (the following summary is provided for guidance):

In relation to the Personal Data being processed, the Data Subject has the right:

  1. to access their Personal Data;
  2. to request the rectification of their personal data;
  3. to withdraw consent (where processing is based on consent, the Data Subject may withdraw their consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal);
  4. to request erasure (the so-called ‘right to be forgotten’);
  5. to have the processing restricted;
  6. to object to the processing;
  7. to receive their Personal Data in a structured, commonly used and machine-readable format;
  8. not to be subject to a decision based solely on automated processing.

The Data Subject always has the right to lodge a complaint with the Data Protection Authority.  The Data Protection Commissioner can be contacted using the contact details provided on the Authority’s website www.garanteprivacy.it

To exercise their rights and to withdraw the consent given for the purposes set out in point 3 above, as well as to obtain further information regarding Personal Data, the Data Subject may send a message, stating the subject of the specific request in the subject line, to the following dedicated email address:

This email address is being protected from spambots. You need JavaScript enabled to view it.

or to the other contacts of the Data Controller and/or the Data Protection Officer (DPO) listed above.

 Privacy Policy Newsletter

Privacy Policy Energy Paining

The updated version of this Privacy Notice is available on the alperia.eu website

Update October 2026