Your data.
Transparent information.

What data do we use?

At Sirius we use various types of your personal data (hereinafter “personal data” or “data”), namely:

• Identifying and non-sensitive data you provide, such as your first name, surname, identity document, tax code, address, email, telephone number, credit card, IBAN and data relating to Sirius services you have used. These are the data you provided when requesting a Sirius subscription, Sirius services or products, or subsequently, for example when contacting Sirius installers or commercial partners;
• Data relating to your preferences and interests, in particular: content accessed, use of services, features used, connection times, traffic data, browsing data on websites and social profiles belonging to Sirius, commercial partners or third parties, IP address, telephone records, devices and connections used. These data may also be collected through cookies and metadata;
• Data identifying your location during use, collected through your IP Address and Country Code.

When you submit a contact form, the email sent to the Sirius department also includes the server receipt date and time in UTC, the request IP address and the browser-declared User-Agent. These technical details accompany your request to help analyse spam and abuse; this form does not use them for commercial profiling or automatically attribute an identity, bot activity or AI use. User-Agent can be changed and IP addresses can be shared or belong to VPNs and proxies. The backend creates no separate archive of these details: they are included in the department’s email together with your message.

Why do we collect your data, and on what legal basis?

The data you provide allow us to carry out administrative activities relating to your contract and meet your requests. They also help us understand your habits, interests and preferences, so we can provide increasingly personalised services and develop them in line with your needs. Specifically, your personal data are processed for the following purposes and on the following legal bases:

a) Without your prior consent, for service purposes, in particular:

• Performance of the contract or fulfilment of pre-contractual commitments: – activating, providing, suspending and managing your subscription, including billing, service communications and assistance; – providing all services included in the Sirius commercial offering; – improving technical support, customer care, our services, content and products through aggregated anonymous statistical analysis, such as analysis of any conversations you have with our call centre operators.

In particular, calls are analysed anonymously – after their voice content has been appropriately altered and made non-identifiable – using speech and keyword analytics techniques; – carrying out aggregated anonymous statistical analysis; – allowing you to download, use, update and maintain Sirius Apps on your devices, where supported;

– Registering you on Sirius websites, managing and updating the websites and your account, and enabling you to use the services offered by Sirius websites (such as services available at clienti.siriustec.it); – sharing your identifying data with commercial partners (when activating bundled offers) to check whether the offer can be sold by comparing your data with the partner’s database.

Pursuit of a legitimate interest of the Data Controller:

1. Managing complaints and disputes, recovering debts and preventing fraud and unlawful activities;
2. Exercising rights and protecting the legitimate interests of the Data Controller or third-party controllers, for example the right to defend a claim in court;
3. Sending commercial communications to the email address you provided, if you are already our customer, concerning Sirius services and products similar to those you have already used. Each email will allow you to refuse further messages by clicking the relevant link.

Compliance with legal obligations:

• Respecting and fulfilling obligations imposed by laws, regulations, EU rules, orders and requirements of competent authorities.

b) Only after you have given your consent, for other purposes unrelated to providing the service, specifically:

• Marketing purposes: informing you by ordinary mail, telephone calls, email, SMS, MMS, notifications and newsletters about Sirius initiatives and offers, and inviting you to complete Sirius questionnaires and market research;
• Profiling purposes: analysing, including automatically, your preferences and interests (for example content and services accessed, features used, connection times, traffic data, etc.) and offering services, content, initiatives and offers tailored to you (by ordinary mail, telephone calls, email, SMS, MMS, notifications and newsletters).

How are your data used?

Your personal data are used for collection, recording, organisation, storage, consultation, analysis, matching, processing, modification, selection, extraction, database comparison (for example to check whether an offer can be sold), use, interconnection, cross-referencing, blocking, disclosure, erasure and destruction. Your personal data are processed on paper, electronically and through automated means, and stored in databases.

Which data are mandatory and which are optional?

Some of the information we collect is essential to enter into and administer your contract; other information helps us offer a better service day after day. In particular:

• Providing your personal data processed for service purposes is necessary to subscribe to and use Sirius services;
• Providing your personal data processed for other purposes is optional. Failure to provide them does not prevent you from using Sirius services, but you will not receive our commercial communications and personalised offers.

How long are your data retained?

Sirius uses your personal data for no more than 10 years after the end of the relationship for service purposes and, in any event, for the statutory limitation period; for no more than 13 months after the end of the relationship for marketing purposes; and, for profiling purposes, for the duration of your consent and in any event no more than 36 months after collection. Your data are then anonymised and processed for aggregated anonymous statistical analysis.

Who can access your data?

We care about your privacy and do everything we can to protect it. We therefore share your data only when strictly necessary and only with those who help us offer you a better service every day. Your data are accessible to:

• Employees and/or collaborators of Sirius or Sirius Group companies who help create, maintain and improve Sirius services, acting as authorised persons and/or internal processing managers and/or system administrators;
• Sirius Group companies, commercial partners (when activating bundled offers) and service providers performing outsourced activities on behalf of Sirius – as external processors – that are connected, instrumental or supportive to Sirius activities. Examples include managing and maintaining Sirius website and App content, customer support, customer care and call centre services, Information Technology systems management, publishing services, debt collection, billing data processing and storage of customer relationship documentation, etc.

To whom may your data be disclosed?

For service purposes, Sirius may disclose your data without your express consent:

• To judicial authorities, at their request;
• To Sirius Group companies and all other parties to whom disclosure is necessary by law or contract to carry out the purposes described above (such as credit institutions, professional firms and commercial partners). Sirius may disclose data to Sirius Group companies to enable them to pursue the independent marketing purposes described above: Sirius will request specific consent before such disclosure.

These parties will process your data as independent data controllers. In any event, we reassure you that your data will not be publicly disseminated.

Where may your data be transferred?

Your data will never be transferred outside the European Union.

What are your rights?

So far we have explained how we process your data and how we operate. We will now explain your rights, so that you can always remain in control of your privacy and information. Unless statutory limitations apply, you have the right to:

• Obtain confirmation as to whether your personal data exist, even if they have not yet been recorded, and request that they be made available in a clear and understandable manner;

Request information and, where appropriate, a copy of:

1. The origin and category of your personal data;
2. The logic applied where your information is processed electronically;
3. The purposes and methods of processing;
4. The identifying details of the Data Controller and processors;
5. The parties or categories of parties to whom your personal data may be disclosed or who may become aware of them;
6. The period for which your data are retained or, where possible, the criteria used to determine that period;
7. The existence of automated decision-making, including profiling. In that case you may request information about the logic used and its significance and envisaged consequences for you;

Obtain, without unjustified delay, updates, amendments or rectification of inaccurate data, or completion of incomplete data, where you have an interest in doing so;

Obtain erasure, blocking or, where possible, anonymisation of your data:

• If unlawfully processed;
• If no longer necessary for the purposes for which they were collected or subsequently processed;
• If you withdraw the consent on which processing is based and there is no other legal basis;
• If you have objected to processing and there are no further legitimate grounds for continuing to use your data;
• If required by law;
• If they relate to minors.

The Data Controller, Sirius, may refuse to erase your data in the following cases:

1. Exercise of the right to freedom of expression and information;
2. Compliance with a legal obligation, performance of a task in the public interest or exercise of official authority;
3. Reasons of public interest in the area of health;
4. Archiving in the public interest, scientific or historical research, or statistical purposes;
5. Establishment, exercise or defence of legal claims.

Obtain restriction of processing in the following cases:

• You contest the accuracy of personal data, if you have not preferred to request their amendment, update, modification or rectification;
• Unlawful processing by the Data Controller, Sirius, to prevent erasure;
• Exercise of a right in court;
• Verification of whether the legitimate grounds of the Data Controller override those of the data subject;
• Receive, where processing is automated, without hindrance and in a structured, commonly used and readable format, the personal data concerning you that you provided on the basis of consent or a contract, in order to transmit them to another controller or – where technically feasible – obtain direct transmission from one controller to another;

Object at any time, in whole or in part:

1. On legitimate and overriding grounds relating to your particular situation, to the processing of personal data concerning you;
2. To the processing of personal data concerning you for marketing and/or profiling (for example, you may object to receiving advertising or direct sales material, market research or commercial communications through automated calling systems without an operator, email and traditional marketing methods, telephone and paper mail).

In all the cases mentioned above, where necessary, Sirius will inform third parties to whom your personal data have been disclosed of your exercise of rights, except in specific cases (for example where this is impossible or requires an effort manifestly disproportionate to the right being protected).

You may change or withdraw your consent and exercise your rights at any time in several ways: by calling 05731798000, sending a request to Sirius Technology s.r.l. – Legal Affairs Department – Data Protection Officer, Via di Folonica 63/A, or emailing privacy@siriustec.it or our DPO at dpo@siriustec.it.

Finally, for the processing covered by this notice, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Who is the Data Controller? Who is the Data Protection Officer?

For any needs, please remember that the Data Controller of your personal data is Sirius Technology s.r.l., with its registered office at via di Folonica 63/A, 51039 Quarrata (PT). Our Data Protection Officer is Riccardo Burrai. You can contact him at riccardo.burrai@siriustec.it or by calling 0573/179800 and selecting option 1. An updated list of our processors is available at the offices of Sirius Technology SRL. This notice may be amended.

For updates, please consult our websites and the other channels made available by Sirius Technology SRL.

Last updated: 26/11/2020