- Recipients’ Categories
- Rights of the Data Subject
- Data Controller and Data Processors
- Information notice on personal data
- The Categories of Personal Data concerned
INFORMATION NOTICE ON THE PROCESSING AND PROTECTION OF CUSTOMERS’ PERSONAL DATA
UniCredit Factoring processes your personal data for the following purposes:
A. Need to execute a contract of which you are a part or to perform pre-contractual activities upon your request. This need represents the legal basis that legitimizes the resulting processings. The provision of data is necessary for these purposes, as appropriate, a contractual obligation or requirement needed for the contract close; in the absence of these, Unicredit Factoring would be unable to establish the relationship or to implement it..
B. Need to fulfill legal obligations (eg obligations under the anti-money laundering legislation , instructions given by the Authority or by the Judicial, etc.). This need represents the legal basis that legitimizes the resulting processings. Providing the data necessary for these purposes is a legal obligation; in the absence of these, UniCredit Factoring would be unable to establish relationships and could have the obligation to make reports.
C. Promotion and sale of products and services of UniCredit Factoring , other Group UniCredit companies or other companies, including the execution of market research (so-called direct marketing). The legal basis that legitimizes the resulting processing is your consent, that you are free to give or not and that you can, however, withdraw at any time. The provision of data necessary for these purposes is not mandatory and the refusal to supply them does not involve any negative consequences, except for the impossibility to receive commercial communications.
D. Promotion and sale of products and services "dedicated" of UniCredit Factoring , of the Group UniCredit companies or third companies, specifically identified through the elaboration and analysis, including through the use of techniques or automated systems (eg. big data), information relating to preferences, habits, consumption choices, aimed with the purpose of subdividing the data subjects into homogeneous groups by behaviors or specific characteristics (customer profiling) also implemented through the enrichment of data with information obtained from third parties (enrichment). The legal basis that legitimizes the resulting processing is your consent, that you are free to give or not and that you can, however, withdraw at any time. The provision of data necessary for these purposes is not mandatory and the refusal to provide them does not involve any negative consequences, except for the impossibility of receive dedicated commercial communications.
Your data may be communicated to the natural and legal persons in their capacity as Data Processors as specified in the list available at the UniCredit Factoring's premises open to the public, or on the website www.unicreditfactoring.it, as well as the quality of persons authorized to process personal data, with regard to the data necessary for the performance of the duties assigned to him, the natural persons belonging to the following categories: UniCredit Factoring employees or seconded by it; temporary employees, interns, consultants and employees of external companies appointed as Data Processors.
Your data can be communicated:
i. to those subjects to whom this communication must be carried out in compliance with an obligation established by law, by a regulation or by EU legislation. Further information about it can be found in the customers’ information notice published in the website www.unicreditfactoring.it, section “Privacy”;
ii. to the financial intermediaries belonging to the UniCredit Group, on the basis of the provisions of anti-money laundering legislation (see Article 39, paragraph 3, of Legislative Decree No. 90/2017), which provides for the possibility of proceeding with the disclosure of data personal relating to reports considered to be suspicious among financial intermediaries belonging to the same UniCredit Group;
iii. to companies belonging to the UniCredit Group, or subsidiaries or associates pursuant to art. 2359 CC (also located abroad), when such communication is permitted on the basis of a Privacy Supervisor Authority or of a law provision.
The detailed list of recipients to whom the data can be communicated can be consulted in the website www.unicreditfactoring.it, "Privacy" section.
The General Data Protection Regulation ("EU Regulation 679/2016") entries to the natural persons, individual companies and freelanders ("Data Subjects") specific rights, among which the one to know what personal data are held by UniCredit Factoring and how they are used (Right of access), to obtain the update, the correction or, if interested, the integration , as well as the cancellation , transformation into anonymous form or limitation. The data subjects and legal entities, institutions and associations can at any time withdraw, where released, consent to the processing of their data:
- for the purpose of sending commercial and advertising material, to direct sales or market research (i.e. direct marketing );
- for profiling purposes and enrichment for marketing purposes. UniCredit Factoring specifies that the withdrawal will only take effect for the future.
Data Retention Period and right to erasure (i.e. right to be forgotten)
UniCredit Factoring processes and stores your personal data for all the duration of the contract relationship, to execute the related and connected obligations, to comply with the applicable legal and contractual obligations, as well as for its own defensive purposes or those of third parties and until the expiration of the applicable statutory limitation period, starting from the date of termination of the all contractual relationship. At the end of the applicable retention period, personal data related to the data subjects will be erased or stored in a form which does not permits the data subjects’ identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes:
i. for resolution of pre-litigation and/or litigation started before the expiration of the retention period;
ii. to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the retention period;
iii. to follow up with requests from the Italian and/or foreign public authorities received/notified to UniCredit Factoring before the expiration of the retention period.
Right to Data Portability
Each data subject can request to receive or to transfer his/her personal data to him/her related held by UniCredit Factoring in a structured format, commonly used and machine- readable format for futher personal use or to provide it to another data controller (Right to portability). In particular, the “portable personal data” include the personal data (e.g. name, surname, title, date of birth, sex, place of birth, residence, etc.), as well as a set of data defined by UniCredit Factoring.
Procedures to exercise the rights
To exercise the rights provided for in paragraph 7 the data subject may contact: UniCredit Factoring S.p.A., Legal, Via Livio Cambi, 5 – 20151 Milano o via fax al n. +39 02/89457022 e-mail address: firstname.lastname@example.org. The deadline for the reply is one (1) month, that may be extended by two (2) further months in cases of particular complexity; in these cases, UniCredit Factoring provides at least one interim communication within one (1) month. The rights’ excercise is, in principle, free of charge; UniCredit Factoring reserves the right to request a fee in the event of manifestly unfounded or excessive requests (even repetitive). UniCredit Factoring has the right to request information necessary for identification purposes of the applicant.
Complaint or Reporting to the supervisory authority for the protection of personal data
UniCredit Factoring informs you that you have the right to lodge a complaint with or make a report to the Authority for the Protection of Personal Data, or else to appeal to the Judicial Authority. The contacts of the Guarantor Authority for the Protection of Personal Data can be consulted on the website http://www.garanteprivacy.it.Download the form:
The Data Controller is UniCredit Factoring S.p.A., with registered office in Milan, Via Livio Cambi n.5, 20151.You can contact the Data Protection Officer at: UniCredit SpA, Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milan, E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu
In order to implement international financial transactions (e.g. a bank transfer to abroad) and some specific national operations (e.g. transfers in foreign currency and/or with a non-resident counterparty) requested by customers, it is necessary to use an international messaging service managed by SWIFT. Further information on the processing of your personal data within the aforementioned service is available in the information notice published in the website www.unicreditfactoring.it "Privacy" section.
Data transfer to third countries
UniCredit Factoring informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called Third Countries) when the European Commission decided that the Third Country ensures an adequate level of protection of personal data or, otherwise, in case of other appropriate safeguards, namely when the suppliers of UniCredit Factoring located in the Third Country ensure contractually a level of personal data protection appropriate to that of the European Union (e.g. through the signing of the standard contractual clauses provided by the European Commission) including enforceable and effective data subject’s rights. Further information can be requested by writing to Group.DPO@unicredit.eu
UniCredit Factoring processes personal data collected directly from you, or from third parties, including, but not limited to, personal data (e.g. name, surname, address, date and place of birth), information on the financial situation (e.g. balance sheets), image data (e.g photo on the identity card) and other data referable to the above indicated categories.