Tokenization: the strategic tool for PSD2-compliant Ecommerce

On this page, we inform you of the characteristics of the processing of your personal data carried out by Axerve S.p.A. (hereinafter 'Axerve).

1. Who is the Data Controller?

The Data Controller of your personal data is Axerve S.p.A., with registered office in Biella (BI) - 13900, Piazza Gaudenzio Sella, n. 1 - Tel. 015 2526511.

2. How can you contact the Data Protection Officer?

The Data Protection Officer (hereinafter also referred to as "DPO") may be contacted at the following addresses:

• E-mail address: privacy@axerve.com
• Postal address: Axerve S.p.A., Piazza Gaudenzio Sella n. 1, 13900 Biella - DPO

3. What data are or may be processed, on what legal basis and for what purposes are the data processed?

The processing concerns your personal data due to the following roles at Axerve's client (hereinafter, "Data Subject"):

• legal representative/owner;
• business contact person of the client;
• company employee of the client.

In particular, Axerve process:

b. the following categories of personal data:

• identifying and personal data (such as: name, surname, date and place of birth, gender);
• contact data (such as: e-mail address, telephone number, PEC);
• information relating to the company (such as: company name, kind of business, VAT number, tax code, headquarters, contacts);
• information relating to payments (such as: merchant's payment account details, payee and payment transaction amount);
• information on the product or service purchased;

in performance of a contract or of pre-contractual measures, including the management of judicial and extra-judicial disputes, and provide assistance to customers, including when signing contracts, pursuant to Article 6(1)(b) of the Regulation.

c. The following categories of personal data

• identifying and personal data (such as: name, surname, date and place of birth, gender);
• contact data (such as: e-mail address);
• information relating to the company (such as: company name, kind of business, headquarters);
• information on the product or service purchased;

based on your consent, pursuant to Article 6(1)(a) of the Regulation and where consent is not required, on the basis of our legitimate interest pursuant to Article 6(1)(f) of the Regulation:

• keep the documentation of the pre-contractual activities (e.g. quotations, requests for products and services) that did not end with the signing of the contract
• to carry out activities which aim at the continuous improvement of the service offered, such as:
• detection of the degree of satisfaction about the quality of the services;
• the preparation of studies and market research;
• marketing of its own products and services, those of companies of the Banca Sella Group and/or of third parties;
• profiling activities to offer you personalized products and services that meet your needs.

d. The following categories of personal data

• identifying and personal data (such as: name, surname, date and place of birth, gender);
• contact data (such as: e-mail address, telephone number, PEC);
• information relating to the company (such as: company name, kind of business, headquarters);
• information on the product or service purchased;

to pursue Axerve's legitimate interest to identify the recipients of the commercial offer in order to offering products and services that best meet customer needs, pursuant to Article 6(1)(f) of the Regulation. Axerve carries out a prior assessment of the impact of this activity on the rights, interests and freedoms of the recipients. In addition, Axerve allows the same data subjects to not benefit further from this service through the option of cancellation from the list provided at each occasion of contact.

Within the limits of the specific purposes indicated above, the processing of your personal data is carried out by manual, computer and telematic means. Axerve adopts organisational and technical measures to guarantee the security and confidentiality of your personal data.

4. To whom may the data be disclosed?

Axerve may communicate your data to third parties belonging to the following categories:

• entities responsible for auditing and certifying the financial statements;
• supervisory authorities and entities (Banca d'Italia, MEF, CONSOB, EBA, etc.);
• public entities within the scope of communications provided for by law (e.g. Inland Revenue);
• entities that manage debt collection or provide professional consulting, tax and legal assistance;
• marketing and market research companies;
• companies of the Sella Group, subsidiaries or associated companies pursuant to Article 2359 of the Italian Civil Code, which provide the technological (IT infrastructure) or other services (customer care);
• service providers (as set out below, this may include by way of an example providing mailing, customer relationship management)

These persons, if the conditions are met, are appointed as Data Processors, pursuant to Article 28 of the Regulation.

5. Can data be transferred to countries outside the European Economic Area?

The Company may allow access to the data, in traced mode, to the company Sella India Software Services Private Limited, based in India, on the basis of standard contractual clauses, approved by the European Commission, to guarantee the adequacy of data protection, for the following activities:

• profiling, as referred to in paragraph 8;
• technical assistance, aimed at investigating and resolving anomalous situations, reported by customers or Axerve employees;
• application testing for the purpose of commissioning.

Personal data are not stored at the foreign company but are accessed remotely and continue to reside in the Company's information system.

6. How long are data stored?

Axerve keeps the data in a form that allows the identification of interested parties for a period of time necessary to achieve the specific purposes of the processing, in compliance with contractual and/or regulatory obligations.
At the end of the storage period, personal data relating to Data Subjects will be stored in a form that does not allow them to be identified (e.g. irreversible anonymisation), unless their processing is necessary for one or more of the following purposes:

• resolution of pre-litigation and/or litigation initiated before the expiry of the retention period;
• follow up on investigations/inspections by internal control functions and/or external authorities initiated before the expiry of the retention period;
• follow up on requests from Italian and/or foreign public authorities received by/notified to Axerve before the expiry of the retention period.

7. What are my rights?

We hereby inform you that you, as the data subject, may exercise specific rights on data protection, set forth in the list below:

We also inform you that, at any time, you have the right to withdraw the consent given to specific optional activities, without prejudice to the lawfulness of the processing performed prior to the withdrawal.

To exercise your rights, you may forward your request to the following addresses:

• E-mail address: privacy@axerve.com
• Postal address: Axerve S.p.A., Piazza Gaudenzio Sella n. 1, 13900 Biella - DPO

Axerve provides you with information regarding the action taken in relation to your request without undue delay and at the latest within one month from receipt of your request.

8. Why could Axerve process special categories of data?

Axerve does not require you to provide your particular data (by way of example but not limited to; personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data concerning health or life, or the sexual orientation of the person). However, Axerve can incidentally process them to execute your specific requests for services and operations (e.g. request for payment of membership fees to political / trade union organizations, transfers to religious associations, etc.). For this reason, pursuant to art. 9 of the Regulation, the Data Controller is required to request your specific consent to the processing of these data. Axerve only processes this information to fulfil legal obligations and/or to perform the contract.

9) How does marketing profiling activity work?

Profiling activity to personalise the services and/or products we offer you concerns personal data that you provide directly and/or indirectly, as well as data available on social networks, websites, external databases (e.g. credit information systems) and public archives (e.g. ISTAT data). These data are processed, in pseudonymized form (therefore without identification of the subject), to evaluate your propensity to purchase a product of Axerve or of other Companies of the Banca Sella Group or of other third parties and to offer you, consequently, products and services that meet your needs.
The profiling activity is partly carried out by Sella India Software Services Private Limited, based in India.
We also inform you that your personal data are processed for profiling activities for direct marketing for a period not exceeding 12 months from their collection.
This processing activity takes place within the limits described in this information notice and it is subject to your optional consent. You have the right to object at any time to the profiling for the personalisation of the commercial offer. In case of opposition, your personal data will no longer be processed for this purpose.

10. How do we notify you of updates to this policy?

We may update this privacy policy from time to time and so we encourage you to periodically check the Privacy and Cookie page. When we change this privacy policy in a material way, we will update the "last modified" date at the end of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.

11. Notice to you

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on our website The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

Last update on 01/06/2022