Privacy

Dear Customer,
In this document, in compliance with the regulations on data protection and privacy in the electronic communications sector, Banca Sistema S.p.A. provides information to help you understand what data are collected when you browse our website and how they are used.

The information below is based on Recommendation 2/2001 adopted by the European Data Protection Authorities on 17 May 2001, within the Working Party established by Article 29 of Directive 95/46/EC, to identify minimum requirements for collecting personal data online and, in particular, the manner, timing and nature of the information that data controllers must provide to users when they connect to web pages, regardless of the purpose of the connection.

Banca Sistema S.p.A., with registered office in Milan, Largo Augusto 1/A, corner of Via Verziere 13 – 20122 Milan ("Banca Sistema").

The Data Protection Officer (DPO) may be contacted at:

• Banca Sistema S.p.A.'s postal address: Largo Augusto 1/A, corner of Via Verziere 13, 20122 Milan
• email address: privacy@bancasistema.it

Browsing Data

The IT systems and software procedures used to operate this website routinely acquire certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category includes IP addresses or domain names of the computers used by visitors, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numerical code indicating the status of the server response and other parameters relating to the user's operating system and IT environment. These data are used only to obtain anonymous statistics on use of the website and to check that it is working correctly.

Data provided voluntarily by the user

The optional, explicit and voluntary sending of email to addresses shown on this website entails the subsequent acquisition of the sender's address, which is necessary to answer the request, as well as any other personal data included in the message. Specific summary information may be progressively displayed on pages dedicated to particular services available on request.

The data are processed using manual, IT and electronic tools according to procedures strictly related to the purposes for which they were collected. Specific security measures are used to prevent data loss, unlawful or incorrect use and unauthorised access.

This processing takes place within the limits of the optional consent you have provided. You have the right at any time to ask anyone using these solutions to delete information collected through cookies.

You may exercise your rights under Articles 15 to 23 of the GDPR at any time by contacting:

Banca Sistema S.p.A.
Largo Augusto 1/A, corner of Via Verziere 13 – 20122 Milan
Email: compliance&antiriciclaggio@bancasistema.it
DPO email: privacy@bancasistema.it

Exercising the rights set out in this section is not subject to formal requirements and is free of charge. The Data Controller must provide information on action taken without undue delay and at the latest within one month of receiving the request. Extensions are permitted under Article 12(3) of the EU Regulation.

In relation to the processing described in this notice, you may exercise the following rights:

• right of access;
• right to rectification, anonymisation or erasure of data;
• right to withdraw consent previously given at any time, without affecting the lawfulness of processing based on consent before withdrawal;
• right to restriction of processing;
• right to data portability;
• right to object;
• right to object to direct marketing;
• right to lodge a complaint with the Italian Data Protection Authority if you believe your rights have not been respected.

Any rectification, erasure or restriction of processing carried out at the data subject's request — unless this proves impossible or involves disproportionate effort — will be communicated by the Data Controller to each recipient to whom the personal data were disclosed.

The data collected may be transferred or disclosed to other companies controlled by or connected with the Bank for activities strictly related and instrumental to operating the service, such as management of the IT system, or for processing carried out by other Group companies for the same purposes. Personal data supplied by users who request information materials are used only to provide the requested service and are disclosed to third parties only when necessary for that purpose. Outside these cases, data will not be disclosed or released unless required by contract or authorised by the data subject. Personal data may be disclosed to third parties only when:

• there is explicit consent to share the data with third parties;
• the information must be shared with third parties to provide the requested service;
• this is necessary to comply with requests from judicial or public security authorities.

No data resulting from the web service are disseminated.