Informative document as per art. 13 Legislative Decree 196 of June 30 2003
"Protection of persons and others with respect to the processing of personal data"
The Code on the protection of personal data, adopted with the Legislative Decree no. 196 of June 30th, 2003, as subsequently amended, (hereinafter indicated also as the "Code" or the “Law”), obliges the persons defined as "Data controllers" for the processing of personal data, pursuant to art. 4 of the same Law, to provide all Data Subjects with precise information on the processing, if any, of their personal data. As far as Law enforcement is concerned, pursuant to Section 5, the Code shall not apply to the processing of personal data relating to legal persons, companies, bodies or associations.
Borsa Italiana S.p.A. (“Borsa Italiana”), in his capacity as Data controller for the processing of personal data, intends to give details regarding the information requested on the processing of the relevant data as regulated by the Code (hereinafter the “Data”).
Borsa Italiana belongs to London Stock Exchange Group (hereinafter, “LSE Group” or “LSEG” or “the Group”) consisted of London Stock Exchange Group plc and its direct and indirect controlled companies and is acting under the direction and coordination of London Stock Exchange Group Holdings Italia S.p.A. along with the other Italian Companies : BIt Market Services S.p.A., Cassa di Compensazione e Garanzia S.p.A., Monte Titoli S.p.A., MTS S.p.A. GATElab S.r.l. and EuroTlx SIM S.p.A..
The Data gathered directly by the Data subject or by a third party or otherwise acquired by the companies of the LSE Group within their business could be processed in compliance with the above Law and with the confidentiality duties.
1. PURPOSES FOR WHICH DATA IS USED
Borsa Italiana gathers and processes personal data of Data subjects for the following purposes:
a) to gather preliminary or subsequent information to the conclusion of an agreement, including the economic and financial rating of connected risks or of other juridical relationships; to fulfil obligations deriving from contractual relationship with the companies of the LSEG; to fulfil the correct conduct of contractual relationships and relevant obligations; to manage finance and accounting administration data, pursuant to Section 34, par. 1-ter, of the Code; to manage correspondence, also via fax and via e-mail, as well as to fulfil activities strictly connected to the compliance of reciprocal obligations;
b) to comply with obligations set forth by laws, by regulations, by EU laws or to comply with requirements of the Stock Exchange supervisory bodies or as laid down by administrative practice;
c) to perform functional purposes connected to the activities carried out by the companies of LSEG, such as – by way of an example - the performance of:
- customer surveys, carried out by means of personal or telephone interviews, questionnaires, etc., regarding the quality of the services rendered;
- market analysis
- informative, statistical or scientific activities;
- “direct marketing” (sending advertising material, direct sales and promotion of products and services of LSEG, carrying out market research, marketing communications, also using Data Subject’s name for publicity) carried out through automated means of contact such as e-mail, fax messages, mms or sms;
- public relations activities.
It is not obligatory to provide personal data for the purposes referred to in letter c) and failure to provide them does not involve any consequence whatsoever. The consent given for sending of commercial and promotional communications pursuant section 130, paragraphs 1 and 2 of the Code ("direct marketing") implies consent to receive the same communications not only by automated means, but also through the traditional ones (paper mail and phone calls through an operator).
The Data Subject is also given the opportunity to express his consent to the receipt of such communications only through traditional means of contact
However, failure to provide them would make it impossible for Borsa Italiana and the other companies of LSE Group to keep Data Subjects up-to-date on events, conventions, promotion of new products and services or to provide the same with publications and with other informative material.
Pursuant to Section 130, paragraph 3-bis of the Code, processing for the purpose of sending advertising materials or direct sales of products or services or for the performance of market or commercial communication surveys, carried out through phone or mail by using addresses as contained in telephone or e-mail directories available to the public, shall be allowed without data subject consent, in respect of any entities that have not exercised their right to object, by having the respective telephone numbers and other personal data entered in a public opt-out register.
Data is made available only to the personnel who needs it for the activities and tasks carried out, by way of example without limitation, within LSE Group, such as: external relations and commercial officers, accountants, secretaries, managers and officers of the LSE Group.
These persons, whose number will be limited to the minimum required, process the data in their capacity as “Persons in charge of the Processing”; they are specially appointed for such purpose and are duly instructed in order to avoid loss, destruction, unauthorized access or forbidden processing of such data.
Borsa Italiana, with registered office in Milan, Piazza degli Affari 6, is the Data Controller.
The Data Controller of Borsa Italiana is available for answering to all queries connected to the processing of personal data.
2. COMMUNICATION OF DATA TO THIRD PARTIES.
In addition to communicating personal data of Data Subjects inside the LSE Group, Borsa Italiana may communicate personal data to:
a) supervisory bodies, or to other designated parties, in accordance with their own requirements or set forth by local or EU laws, by regulations and by administrative procedures;
b) third parties that support Borsa Italiana for the purposes mentioned in point 1, letter a) namely:
- banks and financial companies, professionals, external service companies, including persons in charge of debit collection;
- companies that print, pack and deliver communications to Data Subjects;
- companies that provide technological services and/or data processing systems.
Names and address of these companies will be made available at the request of Data Subjects.
In addition, Borsa Italiana may communicate or transfer personal data to
c) third parties carrying out activities connected with the purposes referred to in point 1. letter c) , such as, by way of an example:
- third parties that carry out customer surveys regarding the quality of the services rendered;
- third parties that carry out information systems, statistical and scientific activities;
- third parties that promote and/or sell products and services (agents);
- third parties that carry out market research and surveys;
- third parties that carry out public relations activities;
- third parties that provide technological services and/or data processing systems;
- companies or entities that manage Italian or foreign markets with whom companies of LSE Group may enter into alliances and/or co-operate with, and also third parties that support such entities or companies;
- third Parties belonging to other economic categories, such as, for example, finance, publishing, telephony, auto industry, etc. in the case of direct marketing activities.
Being understood what referred to in point 1. letter c), paragraph 3, consent for the purposes stated in letter c) is optional and failure to provide it does not involve any consequence whatsoever. However, failure to provide it would make it impossible for Borsa Italiana and for the other companies of LSE Group to keep Data Subjects up-to-date on events, conventions, promotion of new products and services or to provide the same with publications and with other informative material.
3. TRANSFER OF PERSONAL DATA ABROAD
Personal data of Data Subjects may be transferred abroad, even outside the European Community, to the same parties mentioned under paragraph 2 and for the same purposes specified under paragraph 1 above, either by or without electronic or alternatively automated means.
Granting consent for transferring personal data abroad is optional for the purposes specified under paragraph 1 (c) above and failure to provide it does not involve any consequence whatsoever. However, failure to provide it would make it impossible for Borsa Italiana and for the other companies of LSE Group to keep Data Subjects up-to-date on events, conventions, promotion of new products and services or to provide the same with publications and with other informative material.
4. METHOD OF PROCESSING DATA
Borsa Italiana processes personal data of Data Subjects in a lawful and professional manner, so as to ensure the confidentiality and security of the information. The processing of personal data - which shall mean any operation provided for in the definitions under Section 4, letter a) of the Code – is carried out by manual, electronic computerized or automated means with organisational methods and logic strictly related to the purposes mentioned above.
In particular, the processing of personal data for the purposes of section 7, paragraph 4, letter b) of the Code can not only take place through automated means of contact, pursuant section. 130, paragraphs 1 and 2 of the Code, but also through traditional methods, such as paper mail or phone calls with operator’s assistance.
The Borsa Italiana's telephone system does not provide a facility for recording all outgoing and incoming working calls. Only in Markets Supervision there are some selected lines that could record all the outgoing and incoming working calls, with the purpose to provide evidence of business transactions (such as Member Firms’ requests or confirmations of cancellation of orders and trades). The recording will be retained securely in order to prevent the access, the alteration or the use from not authorised persons
Furthermore, in view of the fact that Borsa Italiana belongs to the LSE Group, personal data of Data Subject may be held on information devices at the LSE plc and at its controlled or associated companies, in compliance with the above conditions. Data is kept for no longer than is necessary for the purpose for which they were collected or subsequently processed, in compliance with general principles and with provisions issued by the “Garante”. Pursuant to Section 24, letter i-ter no consent is required for processing data, if the processing concerns communication or exchanging of data among companies belonging to the same Group (parent, subsidiary and/or related companies, pursuant to Section 2359 of the Civil Code, or former and jointly controlled companies), or among consortiums, corporate networks and/or corporate joint ventures, for the following administrative and accounting purposes: in-house organizational activities; activities aimed at fulfilling contractual and pre-contract obligations, managing employer-employee relationships, keeping accounting records, and implementing the legislation on taxation, trade unions, social security and welfare, health and safety on the job (see Section 34, letter 1-ter hereof),
5. RIGHTS OF DATA SUBJECTS
In compliance with the Law, Data Subjects are entitled to the rights mentioned in art. 7 of the same Law. Besides, in compliance with the said Section, Data Subjects may ask for the access to their personal data, obtain a copy of the data processed, ask for their updating, rectification, integration, erasure or termination, where conditions occur or may object, on legitimate grounds, to the processing of personal data concerning them.
Moreover, with specific reference to the processing of personal data for the purposes of section 7, paragraph 4, letter b) of the Code, the Data Subject concerned is entitled to object to the same, in whole or in part, in particular, the right to object to the processing of personal data for purposes of "direct marketing", carried out through automated means, also extends to the traditional methods.
Data Subject may, however, express his willingness to receive communications relating to the aforementioned purposes exclusively using traditional methods, should they be adopted by the Company.
Data Subjects may assert their rights by writing to Borsa Italiana S.p.A., Piazza degli Affari 6, 20123 Milan, at the attention of the Data Controller.
The informative document has been updated on April 2014.
Borsa Italiana S.p.A.