Website Privacy Policy

The data controller (the “Controller”) hereby informs you that your personal data (“Personal Data”) are collected through the video surveillance system installed at certain electric vehicle charging stations operated by FastWay S.p.A. S.B. The system consists of IP cameras equipped with on-edge video analytics and local recording on SD cards installed within the cameras. Personal Data are processed in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), as well as the applicable European and national legislation supplementing and/or amending it (“Applicable Privacy Legislation”), including Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018 (the “Privacy Code”).

The system provides for the recording of images on SD cards installed within the cameras and the activation of on-edge video analytics functionalities to support the operational management of the charging stations. The system is capable of capturing video images of individuals who access or are present within the areas subject to surveillance (the “Data Subjects”).
The presence of the video surveillance devices is indicated by appropriate information signs placed before entering the cameras’ field of view. Accordingly, this privacy notice (the “Notice”) supplements the “short-form” notice provided through such signage.

Data Controller

Denominazione Sociale: FastWay S.p.A. S.B.con sede legale in Via Enrico Forlanini 23, – 20134 Milano (MI), P. IVA: 12511460961

E-mail: assistenza@fastway.energy

Data Protection Officer (DPO)

The Data Protection Officer (“DPO”), appointed by the Data Controller, may be contacted at the following e-mail address: privacy@fastway.energy

Dati Personali trattati

Personal Data are collected directly from the Data Subject. The processing activities are aimed at collecting the following Personal Data: Ordinary personal data, consisting of images of the Data Subject captured through the video surveillance devices (Hanwha Vision IP cameras, models QNV-C8013R / QNO-C8013R or equivalent) installed at the charging station.

Purpose of Processing and Legal Basis

Personal Data are processed by the Data Controller through the installation of a video surveillance system consisting of high-definition IP cameras equipped with on-edge video analytics functionalities (performed directly on the camera) and local recording on SD cards. The cameras are installed at certain electric vehicle charging stations.

The video surveillance system is not intended, under any circumstances, to monitor employees’ work activities remotely. Its sole purpose is to protect individuals and property, ensure the security of the service area, and support the proper operational management of electric vehicle charging stations.

The Personal Data are processed by the Data Controller for the following purposes:

• To protect individuals present within the service area, as well as the Data Controller’s assets, including electric vehicle charging equipment and infrastructure, and for the purpose of preventing, detecting, and investigating incidents of theft, damage, vandalism, or misuse of the facilities. The legal basis for the processing is the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR
• to ensure the safety of users and the proper use of the service area, as well as to enable the operational management of charging stations through video analytics, in compliance with Article 4 of Law No. 300/1970 (Workers’ Statute) and the GDPR, while excluding any form of indiscriminate monitoring of the activities of employees who may be present. The legal basis for the processing is the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.
• where necessary, for the establishment, exercise, or defence of legal claims, whether in judicial, administrative, or out-of-court proceedings. The legal basis for the processing is the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.
• where necessary, to comply with specific requests from judicial authorities, law enforcement agencies, or any other competent authority. The legal basis for the processing is the necessity to comply with a legal obligation to which the Controller is subject, pursuant to Article 6(1)(c) of the GDPR.

Please note that image recording is a direct consequence of accessing the service area subject to video surveillance, the presence of which is indicated in advance by appropriate information signage placed before entering the cameras’ field of view. Data Subjects who do not wish to be recorded have the option not to enter the monitored area.

Periodo di conservazione dei Dati Personali

Personal Data are processed for the period necessary to achieve the purposes for which they were collected and are retained for a maximum period of 7 (seven) days from the date of their acquisition. Recordings captured by the cameras are automatically overwritten upon expiry of the applicable retention period. Such retention period is considered proportionate and necessary in light of the purposes described above.

Personal Data may be retained for a longer period where the Controller is required to comply with specific requests from judicial authorities or law enforcement agencies, or where such retention is necessary for the establishment, exercise, or defence of legal claims, whether in judicial, administrative, or out-of-court proceedings.

Methods of Processing

Personal Data are processed by the Data Controller’s personnel who have been expressly authorized by the Data Controller, using electronic means, in compliance with the GDPR and the applicable provisions of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), including, in particular, the Video Surveillance Decision of 8 April 2010, with due regard to security and confidentiality requirements, and in accordance with procedures and processing logic related to the purposes described above.

Communication of Personal Data

Within the Data Controller’s organization, Personal Data are processed exclusively by personnel authorized to carry out such processing and duly trained in accordance with Article 29 of the GDPR, strictly within the limits necessary to pursue the purposes described above. In particular, access to Personal Data is restricted to the System Administrator and to the technical personnel responsible for the management and maintenance of the video surveillance system.

Personal Data may also be processed by third parties performing activities necessary for the operation of the video surveillance system, including, by way of example, service providers responsible for the installation, configuration, technical support, and maintenance of the system. Such parties act as Data Processors, appointed pursuant to Article 28 of the GDPR, and process Personal Data solely on behalf of and in accordance with the documented instructions of the Data Controller, implementing appropriate technical and organizational measures to ensure the security and confidentiality of the data. An updated list of Data Processors is available from the Data Controller upon request.

Personal Data will not be disclosed to the public, except where disclosure or communication is required by law, by competent public authorities for purposes of national security, public security, crime prevention, investigation or prosecution, or where Personal Data must be communicated to other entities, bodies, or authorities pursuant to legal obligations or official orders.

Transfer of Personal Data to Countries Outside the European Union

No transfer of Personal Data outside the European Economic Area (“EEA”) is envisaged. Recordings are stored exclusively locally on SD cards installed within the cameras located at the Data Controller’s service areas.
Should any Personal Data be shared with recipients located outside the EEA, the Data Controller shall ensure that such processing is carried out in compliance with the GDPR. Any transfer shall be based on an adequacy decision adopted by the European Commission, the Standard Contractual Clauses approved by the European Commission, or another valid legal basis under applicable data protection laws. Further information is available from the Data Controller upon request.

Rights of the Data Subject

In relation to the processing activities described in this Notice, you, as a Data Subject, may, where the conditions set out in the GDPR are met, exercise the rights provided for under Articles 15 to 22 of the GDPR, including in particular the following rights:

• Right of access: the right to obtain confirmation as to whether or not Personal Data concerning you are being processed and, where that is the case, to obtain access to your Personal Data, information on the purposes of the processing, the categories of data concerned, the recipients or categories of recipients to whom the data have been or will be disclosed, particularly recipients in third countries or international organizations, and the envisaged retention period or the criteria used to determine such period;
• Right to rectification: the right to obtain, without undue delay, the rectification of inaccurate Personal Data concerning you and/or the completion of incomplete Personal Data;
• Right to erasure (right to be forgotten): the right to obtain, without undue delay, the erasure of Personal Data concerning you. The right to erasure shall not apply where processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise, or defence of legal claims;
• Right to restriction of processing: the right to obtain restriction of processing where: (a) the Data Subject contests the accuracy of the Personal Data; (b) the processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead; (c) the Personal Data are required by the Data Subject for the establishment, exercise, or defence of legal claims; or (d) the Data Subject has objected to processing pending the verification whether the legitimate grounds of the Data Controller override those of the Data Subject;
• Right to data portability: the right to receive the Personal Data concerning you, which you have provided to the Data Controller, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance, where the processing is based on consent and is carried out by automated means. Where technically feasible, you also have the right to have your Personal Data transmitted directly from one controller to another;
• Right to object: the right to object, at any time, to the processing of Personal Data concerning you based on the condition of legitimacy of the Data Controller’s legitimate interests, unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
• Right not to be subject to automated decision-making: the Data Subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects the Data Subject, unless such processing is necessary for entering into or performing a contract or is based on the Data Subject’s explicit consent. In any event, any automated decision-making process shall not concern the Data Subject’s Personal Data, and the Data Subject has the right at any time to obtain human intervention by the Controller, express his or her point of view, and contest the decision.
• to withdraw consent at any time, with the same ease with which it was provided, without affecting the lawfulness of processing based on consent before its withdrawal;
• Right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it) if the Data Subject believes that the processing of Personal Data relating to him or her has been carried out in breach of the GDPR or applicable data protection laws, without prejudice to any other administrative or judicial remedy available under applicable law.

Requests to exercise the above rights should be submitted in writing to the DPO at the following email address: assistenza@fastway.energy