1.   Which Company of Generali Group will process your personal data* 

Generali Asset Management S.p.A. Società di Gestione del Risparmio (hereinafter also the “Company” or “we” or “us”), with registered office in Trieste, Via Machiavelli no.4, will process your personal data as Data Controller in accordance with Regulation (EU) 2016/679 (hereinafter also the “GDPR”).

If you wish to contact us or exercise a right regarding the processing of your personal data you can contact the Company at the following addresses:

By letter: 

Generali Asset Management S.p.A. Società di Gestione del Risparmio, Via Machiavelli 4, 34132 Trieste

By e-mail: 

• privacy.genam@generali.com

For any questions or to exercise a right regarding the processing of your personal data, you can contact our Data Protection Officer at the following addresses: 

By letter:

Generali Asset Management S.p.A. Società di Gestione del Risparmio, Via Machiavelli 4, 34132 Trieste, to the attention of the Data Protection Officer

By e-mail:

• DPO.GENAM@generali.com

In order to help you understand this Privacy Notice, on the last page you will find a glossary explaining the main terms used herein.

2.   How do we process your information, and what is the legal basis for processing?

GenAM will process your information for the following processing purposes and in accordance with the below modalities:

a)     To inform you about our business activities, products and services by sending you informative communications. These communications can be sent via either electronic or traditional means (including e-mails). These communications may include information about products and services similar to those you have already purchased or in which you have expressed an interest, as well as papers, studies, market survey results, analyses relating to industrial or commercial sectors, other informational materials concerning investment funds and the relevant markets, and invitations to events, seminars, round tables, conferences and professional training sessions. This processing activity is optional and is based on our legitimate interest pursuant to Article 6(1)(f) GDPR to promote and develop our business relationship with you by providing information about products, services, market developments and initiatives that are relevant to your professional interests and reasonably aligned with your expectations.

Our emails may contain tracking pixels or similar technologies that enable us to understand whether a communication has been opened and to measure aggregate engagement with our communications. The information collected may be used to: (i) manage the frequency of our communications; (ii) improve the relevance of the content we share; (iii) better tailor communications to your interests; and (iv) limit the delivery of communications that may be of limited relevance to you. The purpose of this processing is to improve the effectiveness of our communications and to provide information, products, services and initiatives that are relevant to your relationship with GenAM and reasonably aligned with your expectations.

At the time of data collection or at any time thereafter, you may object to the receipt of such communications by using the unsubscribe button in the footer of our emails, or otherwise indicated in our communications to you (see paragraph 7 below). 

b)     To manage and develop our relationship with you more effectively by maintaining accurate and up-to-date records of our interactions with you. This processing activity may involve aggregated analysis, profiling and clustering of the information referred to in paragraph 3, in order to better understand your professional interests, preferences and needs. The information may be used to improve our products and services, conduct market research, support the development of new offerings, and provide you with communications, content, products and services that are relevant to your interests and consistent with your relationship with GenAM, including information about products and services similar to those you have already purchased or expressed an interest in. This processing is optional and based on our our legitimate interest pursuant to Article 6(1)(f) GDPR to manage and develop our relationship with you, improve our business offerings and provide communications that are relevant and reasonably aligned with your expectations. At the time of data collection or at any time thereafter, you may object to the processing for such purpose by using the unsubscribe button in the footer of our emails, or otherwise indicated in our communications to you (see paragraph 7 below);   

c)     Evaluate and conduct corporate transactions and operations, including the transfer of a branch or business unit, acquisitions, mergers, de-mergers, which may involve sharing your personal data with relevant parties involved in the transaction or operation, such as potential buyers, investors, or merged entities. This processing is optional and based on our legitimate interest (art. 6 lett. f) GDPR) to evaluate business opportunities. You may object to the processing according to the instructions of paragraph 7 below; 

d)     Establishment, exercise, or defense of our rights or the rights of third parties in legal claims. This processing is optional and based on our legitimate interest (art. 6 lett. f) GDPR) to protect or assert legal rights. You may object to the processing according to the instructions of paragraph 7 below;

3.   Which personal data we use 

The Company will process only the personal data strictly necessary to achieve the above-mentioned purposes.

In particular, the Company will process your common personal data (e.g., identification and contact details) and any additional information that may be included in exchanges with you and is relevant to our processing purposes (including, date of our last interaction with you, purchase history and any feedback you may have provided regarding our product and services).

4.   With whom we share your information 

Our staff processes your information with modalities and procedures, also in electronic form, appropriate to ensure an adequate level of security. 

Your personal data will only be shared with third parties to whom we have entrusted the performance of certain activities related to the performance of the service you have requested. Depending on the service provided, these third parties may act as data processors or autonomous data controllers. In case the third parties act as autonomous data controllers, they will provide their privacy notice to inform you about the processing activities they undertake on your personal data. 

Our employees and third parties who process your personal data for the above-mentioned purposes receive adequate instructions on the correct methods of processing. 

In particular, the third parties we engage as data processors fall into the following categories:

·       IT and cloud service providers that provide hosting, cloud storage and other IT services for processing and storing information;

·       Marketing and communication providers engaged for client management purposes and/or to send newsletters or other communications;

·       Professional advisors including lawyers, auditors, consultants that may request access to data for legal, compliance and advisory purposes;

·       Transferees of a company or business branch, companies resulting from possible mergers, demergers or other corporate operations possibly carried out by the Company, as independent data controllers;

·       Other companies under the direction and coordination of Generali Investments Holding S.p.A. for the purposes of coordinating the initiatives on prospects and customers;

·       Companies belonging to Generali group to the extent that they perform, as outsources, services of technical, organizational or operational nature to GenAM.

5.   Where we transfer your information 

Where this is necessary to pursue the purposes indicated above in (see paragraph 2), your personal data may also be transferred abroad both within and outside the European Economic Area.

In particular, the Company’s activities may be supported by a computer network, cloud-based servers and other information infrastructures and technologies also provided by third parties. 

In the event that, for technical and operational services, our suppliers are located in countries outside the European Economic Area which may not guarantee a level of protection of personal data equivalent to that provided within the European Economic Area, the Company will verify that the level of protection of personal data is adequately guaranteed through other measures, such as binding corporate rules, standard contractual clauses adopted by the European Commission or on the basis of specific exemptions provided by the GDPR. 

Further information on the countries to which personal data is transferred and the safeguards adopted can be requested by writing to DPO.GENAM@generali.com

6.   The rights you can exercise regarding the processing of your personal data

You may exercise the following rights with respect to the processing of your personal data:

·         Right of access 

You may ask GenAM to access your personal data to know, for example, what data the Company is currently processing.

·       Right to rectification 

You may ask GenAM to correct any personal information that is inaccurate or incomplete.

·       Right to erasure 

You may ask GenAM to delete your personal data when one of the following circumstances occurs:

a)     Personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

b)     You have objected to the processing, and there are no overriding legitimate grounds for the processing;

c)     Personal data has been processed unlawfully;

d)     Personal data have to be erased for compliance with a legal obligation under Union or Member State law to which GenAM is subject.

·       Right to restriction 

You may ask GenAM to restrict the processing of your personal data under one of the following circumstances:

a)     You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data;

b)     The processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead;

c)     The Company no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defence of legal claims;

d)     You have objected to the processing of your personal data pending the verification whether the legitimate grounds of the Company override those yours.

·       Right to data portability 

You may ask the Company to transfer the personal data you have provided to another company or organization and/or to receive your personal data in a structured, commonly used and machine-readable format. If your personal data has been transferred outside the European Economic Area, you have also the right to obtain a copy of such data or an indication of where it has been made available.

Your rights can be exercised by contacting the Company or the Data Protection Officer at the addresses indicated under paragraph 1.

The Company will not charge you any cost for the tasks resulting from your request, unless this request is manifestly unfounded or excessive. 

In order to verify your identity, the Company might request your personal information. The collected personal data will be kept confidential.

7.   The right to object to the processing of your personal data

 You have the right to object and request termination of processing of your personal data which is based on the legitimate interest of the Company (see paragraph 2 above), unless there are legitimate reasons for the Company to continue processing under article 21 of the GDPR.

For objecting to the processing for the purposes under paragraph 2, lett. a) and b) above, you can use the unsubscribe button in the footer of our emails, or the other means indicated in our communications to you.

For objecting to the processing for the other purposes under paragraph 2 above, you can contact the Company or the Data Protection Officer at the addresses indicated under paragraph 1.

8.   Possibility of filing a complaint with the competent Supervisory Authority 

In case you consider that the processing of your personal data infringes the applicable privacy laws, you have the right to lodge a complaint to the Garante per la Protezione dei Dati Personali by following the process described on its website (www.garanteprivacy.it). 

You have also the right to lodge a complaint with the Supervisory Authority of the EU Member State where you reside, work or place of the alleged infringement. The contact details of the supervisory Authorities of the EU Member States can be found at the following link: www.edpb.europa.eu/about-edpb/board/members_it.

9.   How long we retain your personal data

Personal data may be retained for different periods of time depending on the purposes for which they are processed by the Company. 

More in detail:

·       Personal data processed for the purpose under paragraph 2, lett. a) are retained for 24 months following your last interaction with the Company (e.g., last time you clicked on or responded to our communications, liaising with us during business meetings and events). A shorter retention period may apply if you object to the processing, in that case we will promptly delete the data after your objection;

·       Personal data processed for the purpose under paragraph 2, lett. b) are retained for 12 months following your last interaction with the Company. A shorter retention period may apply if you object to the processing, in that case we will promptly delete the data after your objection;

·       Personal data processed for the purpose under paragraph 2, lett. c) are retained for the entire duration of the transaction or operation, unless a longer period is otherwise necessary for the other processing purposes enlisted in this paragraph 2;  

·       Personal data processed for purpose d) are retained for the entire duration of the relevant legal proceedings.

Once personal data is no longer needed, we will securely delete or anonymize the data, unless otherwise required by law.

10.          Amendments and updates to this Privacy Notice 

Also, in the event of future changes to the applicable privacy laws, the Company may supplement and/or update this Privacy Notice, in whole or in part. Any amendments, supplements or updates will be made available and promptly communicated to you.

*********************

GLOSSARY

To help you understanding our Privacy Notice, please find below the meaning of the main terms contained therein: 

Processing is any operation or set of operations that are performed on personal data such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure or destruction, whether or not by automated means. 

Personal data is any information relating, directly or indirectly, to a person (such as, for example, name, identification number, location data, an online identifier, one or more elements able to identify the physical, physiological, genetic, mental, economic, cultural or social identity, etc.). 

Data controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. the employer is the owner of the processing of the personal data of its employees) 

Data processor is the natural or legal person, public Authority, agency, or other body which processes personal data on behalf of the controller (for example, the company that provides services to the data controller, at its instructions). 

Data Protection Officer is a person who has the task of carrying out support activities for the company functions and control activities in respect of the processing of personal data. It is also in charge of cooperating with the Supervisory Authority, and it represents the contact point, also for the data subjects, for any matters connected with the processing of personal data.

Supervisory authority means an independent public authority which is established by a EU Member State to monitor the application of the GDPR and the applicable data protection legislation.