Policy statement pursuant to Article 13 of Legislative Decree No. 196 of 30.6.2003.
"Protection of individuals and other subjects with regard to personal data processing"
The Personal Data Protection Code, adopted by Legislative Decree No. 196 of 30 June 2003 with subsequent amendments and additions, (hereinafter referred to as "the Code"), requires subjects referring to themselves as personal data "controllers" pursuant to Article 4 of said Law, to provide all Data Subjects with precise information about the processing of their personal data. With regard to its scope, Article 5 establishes that the provisions of the Code do not apply to the processing of personal data concerning legal entities, companies, organisations or associations.
Borsa Italiana S.p.A (the Italian Stock Exchange), hereinafter ("Borsa Italiana S.p.A" or the "Company"), as the data controller, therefore intends to provide the detailed information required relating to personal data processing as governed by the Code (hereinafter the "Data").
Borsa Italiana belongs to the London Stock Exchange Group (hereinafter "LSE Group", "LSEG" or the "Group"), composed of the London Stock Exchange Group plc and its direct and indirect subsidiaries, and is subject to the management and coordination of London Stock Exchange Group Holdings Italy S.p.A., together with the other Italian companies: BIt Market Services S.p.A., the Cassa di Compensazione e Garanzia S.p.A., Monte Titoli S.p.A., MTS S.p.A., GATElab S.r.l. and EuroTlx SIM S.p.A..
Data collected by Borsa Italiana from the Data Subjects or third parties or otherwise acquired in the context of activities performed by companies of the LSE Group (in particular name, surname, address, occupation, position held, employer/ associated company, phone number and email address, information regarding financial reliability and integrity) may be processed in accordance with the aforementioned law and the confidentiality obligations to which Borsa Italiana is subject.
1. PURPOSE OF THE PROCESSING
The Data may be processed by Borsa Italiana and other Italian companies of the LSE Group, by electronic and/or in paper means, for the following purposes:
a) to gather preliminary information or subsequent Data upon conclusion of a contract, including an economic and financial evaluation of the risks involved or of legal agreements of a non-financial nature; the fulfilment of obligations arising from contractual relationships with LSE Group Companies; the proper management of the contractual relationship and related obligations; for administrative and accounting purposes, as defined in Article 34 (1)-ter of the Code; the handling of correspondence, including by fax or e-mail, and activities closely related to and necessary for the fulfilment of existing mutual obligations;
b) the fulfilment of obligations under applicable laws, regulations and Community legislation, or regulations issued by Supervisory Authorities and bodies, or administrative practices;
c) purposes related to the activities of LSEG companies, such as, by way of example but not limited to:
- the preparation of studies;
- reporting, statistical or scientific activities.
d) for any activities linked to enrolment and participation in events organised by LSEG companies, including surveys on the level of satisfaction with the quality of services rendered;
e) to inform the Data Subject, including by e-mail, through newsletters about events (seminars/ conventions/conferences) and other services organised by Borsa Italiana;
f) to enable it to receive, including via e-mail, newsletters, marketing communications relating to the promotion and/or sale of third party products and/or services (including in the area of finance, publishing, telephony, cars).
The provision of Data for the purposes referred to in points (a) and (b) is necessary and its processing for such purposes does not require consent. The provision of the Data referred to in point (d) is optional, but may be necessary in order to benefit from all or part of the event in relation to which the Data was collected.
The provision of the Data for the purposes indicated in points (e) and (f) is optional, as is the giving of consent to the use of the Data for these purposes. Any failure to give this consent has no consequences, except that it will not be possible for Borsa Italiana or other LSEG companies to keep the Data Subject informed of events, demonstrations, presentations of new products or services, or for the Data Subject to receive publications or other information that may be of interest. Consent given to the sending of commercial and promotional communications pursuant to Article 130, (1) and (2) of the Code ("direct marketing") implies consent to the receipt of such communications not only by automated means, but also via traditional methods (paper mail and phone calls made by an operator). Data Subjects may, however, give their consent to the receipt of such communications by traditional methods of contact only.
If the Data (name, surname, company, position/title, phone number and e-mail address) is voluntarily provided by the Data Subject at and during events (seminars/conventions/conferences) organised by Borsa Italiana, Borsa Italiana may use it to inform the Data Subject, including by e-mail, of future events (seminars/conferences/conferences) and other similar events organised by Borsa Italiana, and to send publications or other information similar to that distributed for the event in which the Data was collected, unless otherwise instructed by the duly informed Data Subject at the time the Data was provided. Data Subjects may withhold permission for this type of processing, including when Borsa Italiana issues the communications. At the time the Data is provided, i.e. during the events, the Data Subjects may also expressly and freely give consent to the transfer/communication of their Data to third parties (other than Borsa Italiana and LSE Group companies) in order to receive marketing communications relating to the promotion and/or sale of third party products and/or services (including in the area of finance, publishing, telephony and cars). If this express consent is not given the Data will not be provided to such third parties.
If the Data is collected from third parties who have also obtained consent for the use of the Data Subject's Data by Borsa Italiana for the purposes indicated in point (e) above (the sending of newsletters about Borsa Italiana promotional events and services), Borsa Italiana enables the Data Subject to reject this type of processing when first contacted.
Pursuant to Article 130 (3-bis) of the Code, the processing of personal data for the purposes of sending advertising material, the direct sale of products and services, market research and commercial communication by telephone and paper post using addresses listed in the printed or online directory available to the public, is permitted without any requirement for the Data Subject's consent, unless the Data Subject has indicated their objection with the appropriate opt-out register.
The Data is only accessible by persons within the LSEG companies who require such access by virtue of their activities or duties, such as, by way of example but not limited to: employees in charge of external and customer relations, employees in charge of market supervision, accounting staff, secretarial staff, managers and officers of LSEG companies. Such persons, who shall be kept to the strictest minimum, will process data in the capacity of "Data Processors", appointed for this purpose who are adequately trained to prevent loss, destruction, or unauthorised access or processing of the data.
The Data Controller is Borsa Italiana, with headquarters at Piazza degli Affari, 6, Milan, in the person of its Managing Director.
The Data Controller is available to answer all questions relating to the processing of personal data.
2. DISCLOSURE OF DATA TO THIRD PARTIES
Borsa Italiana may disclose the data for the purposes for which it is collected, both within the LSE Group, or to:
a) Supervisory Authorities and Bodies, or other persons indicated by them, pursuant to orders issued by them, or established by law, including Community legislation, regulations or administrative practices;
b) third parties appointed as data processors, whose support Borsa Italiana relies on for purposes strictly related and connected with those referred to in point 1 (a), (b) and (c), namely:
- banks and finance companies, professionals, external companies employed for the provision of services, including persons engaged in debt collection;
- companies that print, pack, and deliver communications to Data Subjects;
- companies that provide technology and IT services;
- companies or entities that manage Italian or foreign markets with which one or more LSEG companies may enter into alliances and/or working relationships, and third parties whose support such entities or companies rely on;
- entities which perform IT, statistical or scientific activities.
c) third parties (designated data processors) which Borsa Italiana relies on for the organisation and management of the events (seminars/conventions/conferences) indicated in point 1 (d), including those carrying out surveys to ascertain the level of customers' satisfaction with the quality of the services provided;
d) if the consent to processing specified in point 1 (e) is given, companies (designated processors):
- that promote and/or sell products and/or services (agents);
- that perform studies and market research;
- that carry out public relations activities;
e) if consent is given to the processing specified in point 1 (f): third parties, autonomous data controllers belonging to other economic professions, such as for example finance, publishing, telephony, and the car industry.
A list of data processors designated by Borsa Italiana may be requested at any time.
3. TRANSFER OF DATA ABROAD
The Data of Data Subjects may be transferred abroad, including outside the European Union, to the entities specified in point 2, for the purposes indicated in point 1 above, with or without the aid of electronic or other automated methods.
4. METHOD OF PROCESSING
Borsa Italiana shall process the Data of Data Subjects in a lawful and proper manner, thereby ensuring confidentiality and safety. The processing - which includes the gathering of data and any other operation included in the definition of "processing" in accordance with Article 4 of the Code (including, by way of example but not limited to, the recording, processing, communication, storage and destruction of data) - shall be performed by manual, computerised and/or electronic, automated or similar means, employing organisational methods and processes strictly related to the purposes indicated.
In particular, the processing of data for the purposes of Article 7 (4,) (b) of the Code may take place not only through automated contact methods, on the basis of Article 130, (1) and (2) of the Code, but also by traditional methods such as paper mail and phone calls made by an operator).
Borsa Italiana does not record telephone conversations, except those intended for, or originating from, the Markets Supervision Office, which may be recorded, upon prior notice to the user, but solely for requirements relating to the transparency of transactions requested and/or executed. Recordings are archived with restricted access and are in no circumstances available to persons not expressly authorised.
The fact that Borsa Italiana is part of LSEG also means that the Data Subject's Data, in compliance with the above conditions, may be stored on computer systems at LSE plc, its subsidiaries or related companies. Data is stored for the time necessary to fulfil the purposes for which it was collected, in accordance with law and any orders issued by the Garante (Data Protection Authority). Pursuant to Article 24, letter i-ter) of the Code, consent is not required if the processing relates to the communication and exchange of data between companies within the same group (parent companies, subsidiaries or related companies pursuant to Article 2359 of the Italian Civil Code, or companies under common control) and between consortia, business networks, groupings and associations of undertakings including temporary associations, if such communication or exchange is carried out for the following administrative and accounting purposes: purposes related to the conduct of internal organisational activities; purposes required for the fulfilment of contractual and pre-contractual obligations, the management of an employment relationship in all of its phases, the keeping of accounts and the application of tax, trade union, social security, health, hygiene and workplace safety legislation (Article 34 (1)-ter of the Code).
5. EXERCISE OF RIGHTS
The Law provides that all Data Subjects must be informed of their rights under the Law. A list of these rights is set out at Article 7 of the Law; it provides, inter alia, that the Data Subjects may request access to their data, obtain a copy of the processed data and, if necessary, that it be updated, amended, supplemented, deleted or blocked, and withhold consent for the processing of the data concerning them, in whole or in part, for legitimate reasons.
Furthermore, with specific reference to the processing of personal data for the purposes of Article 7, (4) (b) of the Code, the Data Subjects are entitled to object to such processing, in whole or in part. In particular, the right to object to the processing of personal data for the purposes of "direct marketing" by automated means, also extends to processing by traditional methods. Data Subjects may, however, express a wish to receive communications relating to the above uses solely by traditional methods, when such methods are adopted by the company.
Data Subjects may assert the aforementioned rights by contacting, in the manner required by law, Borsa Italiana at piazza degli Affari 6, 20123 Milan, for the attention of the Data Controller.
This information was updated in May 2015.
Borsa Italiana S.p.A.