Privacy Information Notice on collection and processing of personal data

In accordance with Regulation (EU) 2016/679 ("GDPR"), Eni SpA ("Company" or "Controller") sets out below the privacy information notice on the processing of your personal data - obtained directly from you and/or obtained from third parties – so that you can know our privacy policy and understand how your personal information is managed when you use the services of the website eni.com (“Website”).

1. Identity and contact details of the Data Controller

The Data Controller is Eni SpA, with registered office in P.le Mattei 1, Rome and principal place of business in Via Emilia, 1, 20097 San Donato Milanese (Milan).

2. Contact details of the Data Protection Officer ("DPO")

Eni SpA has appointed a Data Protection Officer who can be contacted at the following email address: dpo@eni.com.

3. Purposes of data processing and its legal basis

  1. Necessary legal and contractual purposes – processing is necessary for compliance with a legal obligation to which the controller is subject or to execute a specific request of the data subject. Your personal data may be processed without your consent in cases where this is necessary in order to comply with obligations deriving from laws, regulations, codes or procedures approved by authorities or other competent institutions. Your personal data will also be processed for purposes relating and/or connected to the provision by the Company of services for the navigation of the Website, and specifically:

    • to provide the services requested by the user when navigating the Website, including the collection, storage and elaboration of data for the purposes of delivering the services and their subsequent operational and technical management;
    • to manage relations with third-party authorities and public bodies for purposes related to particular requests, compliance with legal obligations or particular procedures.

    This data – which is required to deliver the service – will also be processed electronically, stored in specific databases, and used strictly and exclusively in relation to navigating the Website.

    Given that providing your data for these purposes is necessary to maintain and deliver all the services connected to navigating the website, failure to provide such data will make it impossible to provide the specific services in question.

  2. Controller's legitimate interest – The Controller may process your personal data without your consent in the hypothesis of aggregate and anonymous analysis of the use of the services accessed, to identify user habits and propensities, to improve the services provided and to meet specific user requirements, or to prepare initiatives for improving the services provided.

  3. Defence of legal claims – In addition, your data will be processed whenever necessary in order to establish, exercise or defend the legal claims of the Controller or other companies under Eni’s control perimeter.

4. Recipients of personal data

For the purposes listed in Section 3, the Data Controller may disclose your personal data to third parties, such as, for example, those belonging to the following categories:

  • police forces, the armed forces and other government bodies, for the fulfilment of the obligations envisaged by law, regulations or EU legislation. In such cases, there is no obligation under applicable data protection legislation to obtain the data subject’s prior consent to these communications.
  • companies, organisations or associations, or parent companies, subsidiaries or associates pursuant to Article 2359 of the Italian Civil Code, or between them and companies subject to joint control, as well as consortia, networks of companies and groupings and temporary associations of companies and entities belonging to them, limited to communications made for administrative and/or accounting purposes.

The Data Controller will take the utmost care to ensure that the disclosure of your personal data to the above recipients involves only the data required to accomplish the specific purposes for which it is intended.

5. Transfer of personal data outside the EU

In the context of the contractual relations between Eni and its subsidiaries, for some of the purposes listed in Section 3 above, your personal data may be transferred outside the EU, including through inclusion in databases shared and managed by third parties both within and outside Eni's scope of control. The management of the database and the processing of this data are performed only for the purposes for which it was collected and with maximum respect for the privacy and security standards described in applicable personal data protection laws. Whenever your personal data is transferred outside the EU, the Data Controller shall take every suitable and necessary contractual measure to guarantee an adequate level of personal data protection in accordance with this Privacy Information Notice, including, among other things, the Standard Contractual Clauses approved by the European Commission.

6. Data retention period

The data will be stored for a period not exceeding the time necessary to fulfil the purposes for which it was collected or subsequently processed in accordance with legal obligations.

7. Rights of data subjects

As a data subject, you have the following rights over the personal data collected and processed by the Controller for the purposes indicated in point 3: (i) the right of access, in particular to request at any time confirmation of the existence of your personal data in the Company’s archives and the making available of this information in a clear and intelligible form, and the right to know the origin, logic and purpose of the processing with express and specific indication of the data supervisors and processors and the third parties to which your data may be communicated; (ii) the right to have your data updated and rectified (except for subjective data), to have superfluous data erased or anonymised, and to block processing and to have your data definitively erased in the event of unlawful processing; and (iii) where the conditions are met, to restrict processing and data portability. You can exercise the above mentioned rights by writing to the Eni Data Protection Officer dpo@eni.com.

The law also grants data subjects the right to complain to the Supervisory Authority for Personal Data Protection if you become aware of a violation of your rights under applicable personal data protection legislation.