Legal notice
Privacy Policy
Last updated:
This notice explains how New Energy S.r.l. processes the personal data of visitors to www.newenergyitaly.com (the “Website”) and of anyone who contacts the company through the channels listed here, in accordance with Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”), as amended by Legislative Decree 101/2018.
1. Data controller
The data controller is New Energy S.r.l., with registered office at Via dei Cignoli 9, 20151 Milano, Italy — VAT no. IT02358790695, Companies Register (REA) MI-2668838, certified e-mail (PEC) newenergyitaly@servercertificato.it.
For any request concerning your personal data you can write to info@newenergyitaly.com or send a letter to the registered office. Toll-free number (Italy): 800 168632.
2. What data we process
- Browsing data. The systems that run the Website collect, during normal operation, some data whose transmission is implicit in the use of Internet protocols: IP address, browser and device type, pages requested, time of the request, response code. They are used only to operate the Website, to produce anonymous statistics and to check its security; they are kept for the time strictly necessary, unless they are needed to establish liability in the event of unlawful acts.
- Data you provide voluntarily. By filling in the Website forms (consultation or contact request: name, e-mail, phone, message; spontaneous application: name, e-mail, phone, professional profile, CV and anything you write in the message) or by writing to us, calling the toll-free number or contacting us on WhatsApp at the published numbers. Please do not include in forms or CVs special categories of data (art. 9 GDPR, e.g. health data) that are not needed for your request.
- Cookies and tracking tools. Described in the Cookie Policy.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering requests for information, free energy consultations and quotes; managing the pre-contractual phase and any resulting contract | Pre-contractual measures taken at your request and performance of the contract (art. 6(1)(b) GDPR) | 24 months from the last relevant contact; if a contract is signed, for its duration and for the statutory periods (10 years for tax and accounting records) |
| Assessing spontaneous applications and possibly contacting you for future vacancies | Pre-contractual measures taken at your request (art. 6(1)(b) GDPR); art. 111-bis of the Privacy Code for unsolicited CVs | 12 months from receipt, then deletion |
| Complying with legal obligations (accounting, tax, replies to public authorities) | Legal obligation (art. 6(1)(c) GDPR) | Periods set by the applicable law |
| Keeping the Website secure, preventing abuse and protecting the controller’s rights, including in court | Legitimate interest (art. 6(1)(f) GDPR) | Time strictly necessary for the purpose |
| Measuring Website traffic with aggregated statistics (Google Analytics 4) | Consent given in the cookie banner (art. 6(1)(a) GDPR) | 14 months (Google Analytics retention setting); cookies up to 2 years |
| Measuring the effectiveness of advertising campaigns and showing relevant ads on Meta platforms (Meta Pixel) | Consent given in the cookie banner (art. 6(1)(a) GDPR) | Cookies up to 3 months; data collected by Meta is kept according to its own policy |
We do not use data collected through the Website to send unsolicited commercial communications, nor for automated decision-making producing legal effects on you.
4. Provision of data
Providing the data marked as mandatory in the forms is necessary to handle your request: without it we cannot reply. Providing any other data is optional. Consent to analytics and marketing cookies is optional and can be withdrawn at any time without affecting your browsing.
5. How we process data
Data is processed with IT tools and, where necessary, on paper, applying appropriate technical and organisational measures (art. 32 GDPR) to ensure its integrity, confidentiality and availability. Only staff authorised and instructed by the controller can access it.
Data entered in the Website forms travels over an encrypted connection to an automation hosted on a virtual private server, which forwards it to New Energy’s mailboxes. The content of each submission is not stored on that server: technical records are kept only if delivery fails, for as long as it takes to fix the problem and in any case no longer than 7 days, solely to make sure no request is lost. The sender’s IP address is used only, and for a few minutes, to limit automated submissions: it is neither stored nor disclosed.
6. Recipients
Data may be processed on behalf of the controller by parties appointed as processors under art. 28 GDPR:
- the Website hosting and CDN provider (Vercel Inc.);
- Hostinger International Ltd., which hosts the virtual private server running the self-hosted automation (n8n) that receives the Website forms and forwards them by e-mail to our mailboxes;
- the provider of the domain e-mail service, which delivers the messages generated by the Website forms;
- the provider of the company CRM platform used to handle requests;
- Google Ireland Limited, for Google Analytics 4 (only with your consent);
- Meta Platforms Ireland Limited, for Meta Pixel (only with your consent) and for WhatsApp Business;
- external consultants and professionals (legal, tax, technical) bound by confidentiality.
Data may also be disclosed to public authorities where required by law. Data is never disseminated. The up-to-date list of processors is available on request at the contacts in section 1.
7. Transfers outside the EU
Some providers (Google, Meta, Vercel) are based or operate servers in the United States. Transfers rely on the adequacy decision for the EU-US Data Privacy Framework for certified companies and, alternatively, on the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR), supplemented by the necessary additional measures. You can request a copy from the controller.
8. Phone, WhatsApp, social media and external portals
- Toll-free number. Data given over the phone is used exclusively to answer your request, for the same purposes and periods set out in section 3.
- WhatsApp Business. Messages exchanged with the number published on the Website pass through the systems of Meta Platforms Ireland Limited, which processes your account data and conversation metadata under its own policy. Please do not send documents containing special categories of data via WhatsApp.
- Social pages. The Website links to New Energy’s official pages on Instagram, Facebook, LinkedIn and YouTube. Browsing on those platforms is governed by their own policies. For the aggregated statistics of the Facebook and Instagram pages (“Page Insights”), New Energy and Meta are joint controllers under the terms defined by Meta.
- Client area and consultants area. The portals linked from the Website are separate services: a dedicated notice is provided when you register or log in.
9. Minors
The Website and its services are not intended for children under 14 and the controller does not knowingly collect their personal data.
10. Your rights
As a data subject you may at any time exercise the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent, without affecting the lawfulness of processing carried out before withdrawal.
Requests should be sent to info@newenergyitaly.com or by post to the registered office: we will reply within one month of receipt (art. 12 GDPR). If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (www.garanteprivacy.it) — or bring proceedings before the courts.
11. Updates
This notice may be amended to reflect regulatory changes or changes to the Website services. The version in force is the one published on this page, with the last-updated date shown at the top.