Information notice geolocalization for IP Service

INFORMATION NOTICE ON TO THE USE OF GEOLOCALIZATION IN THE IP REPLENISHMENT SERVICE

1. Data controller and data protection officer

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan.

You can contact the Data Protection Officer at UniCredit SpA, Data Protection Office, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan; E-mail: Group.DPO@unicredit.eu; PEC: Group.DPO@pec.unicredit.eu.

2. Purpose and legal basis of the processing

UniCredit S.p.A. has made available in its Application for Authorized Mobile Devices, which can be downloaded through the appropriate On-Line Stores (By way of example: App Store iOS and Google Play Android), the IP Refueling Service, which provides the possibility to make payments at the service stations Affiliated by API Group.

This Service provides the possibility to carry out the refueling process by concluding the payment directly from UniCredit's Mobile Banking App.

Specifically, for the service in question, UniCredit's Mobile App can access the Geolocation functionality of the Mobile Device on which UniCredit's Application is installed for the sole purpose of:

verify that the Customer's location coincides with the location of the Agreed Service Stations;
enable the Customer to locate the Service Station closest to him to refuel.

UniCredit, therefore, uses the Geolocation Data of the Customers' Mobile Devices only for the purpose of locating the Service Station closest to the location of the Customer's Mobile Device and verifying that the device is actually within 30 meters of the station itself.

Geolocation Data will not, however, be stored or historicized or processed for any other and/or different purposes than those stated above.

The legal basis for the processing is the consent given by the Customer pursuant to and in accordance with Article 6 letter "a" of Regulation (EU) 2016/679 ("GDPR"), by selecting "I AGREE" in the specific function provided in the UniCredit Application.

The User is free to decide whether to enable both the Geolocation function of his/her Mobile Device, and whether to give his/her Consent for the use of the "IP Refresh" function based on such Geolocation.

The User may revoke the aforementioned consent at any time either by using the function of the Mobile Device's Operating System, or by using the specific function made available for this purpose in the UniCredit Application (Communication Hub Section > Settings > Geolocation Services).

In the event of lack of consent, the "IP Replenishment" Service will not be usable by the Customer.

The processing is carried out by means of computer and telematic tools with logics strictly related to the aforementioned purpose and, in any case, in such a way as to guarantee the security of the Geolocation data by also applying suitable encryption techniques aimed at guaranteeing confidentiality and making "pseudoanonymized" the data processed both at the premises of the Data Controller and externally by the persons appointed as Data Processors pursuant to Art. 28 GDPR.

3. Categories of personal data processed

UniCredit collects GPS Geolocation coordinates only from Mobile Devices on which UniCredit's Mobile Application is installed and on which both the Geolocation function is enabled at the Operating System level of the Device (By way of example: function available in iOS or Android) and the Consent to Processing is given in the appropriate function of the Application itself.

The data related to the GPS Geolocation coordinates used to provide in the Customer's Mobile Device the location of the Affiliated Merchants closest to him/her, will in any case neither be saved nor historicized and nor processed for other and/or different purposes than those mentioned above.

4. Recipients or categories of recipients of personal data

In order to provide the "IP Replenishment" functionality, UniCredit makes use of an IT Platform made available by the Partner Gruppo Api, with its sole office in Via Salaria, 1322 - 00138 Rome, which acts as Data Processor pursuant to Article 28 GDPR.

In addition, in order to provide such functionality of the IP Replenishment Service, UniCredit makes use of other Companies appointed as Data Processors pursuant to the aforementioned art. 28 GDPR, whose updated list is available at the following link:

List of external data processor – italian version

List of external data processor – english version

5. Rights of the data subjects

Regulation (EU) 2016/679 ("GDPR") grants Individuals, Sole Proprietorships and/or Freelancers (the "Data Subjects") specific rights, including the right to know what personal data UniCredit holds about them and how they are used (Right of Access), to obtain their updating, rectification or, if there is interest, integration, as well as their deletion, transformation into anonymous form or restriction.

The User may exercise his or her rights and revoke his or her consent to the processing of his or her personal data related to geolocation in the IP Replenishment service at any time by using the specific functions made available in the UniCredit Mobile Application.

5.1 Period of data storage and right to erasure (i.e. right to be forgotten)

UniCredit will not retain any personal data of the Data Subject related to or referable to the Geolocation function "PIN Replenishment". UniCredit will retain for a short period of time only the data made pesudoanonymized through the application of suitable irreversible encryption mechanisms, aimed at verifying the proper functioning of the IP Replenishment Service, and in any case no longer than three months.

6. Methods of exercising rights

Each Data Subject to exercise the rights referred to in paragraph 5 and 5.1 may contact: UniCredit S.p.A., Claims, Via Del Lavoro n. 42, 40127 Bologna (BO), Tel. +39 051.6407285, Fax +39 051.6407229, E-mail address: diritti.privacy@unicredit.eu

The deadline for the reply is one (1) month, which may be extended by two (2) months in particularly complex cases; in these cases, the Bank will provide at least one interim communication within one (1) month.

The exercise of the rights is, in principle, free of charge; the Bank reserves the right to charge a fee in the event of manifestly unfounded or excessive requests (including repetitive ones).

The Bank has the right to request information necessary for the identification of the applicant.

7. Complaint or report to the personal data protection authority

The Bank informs you that you have the right to file a complaint or a report to the Personal Data Protection Authority or alternatively to appeal to the Judicial Authority. The contacts of the Personal Data Protection Authority are available on the website https://www.garanteprivacy.it

TERMS AND CONDITIONS OF THE "IP REPLENISHMENT"

In order to access the "IP Refueling" feature, you have to read and adhere to the Terms&Conditions presented below.

Dear Customer, in order to allow the refueling through the use of the "IP Refueling" feature at the IP Affiliated Service Stations near you, with payment through the App by means of payment cards (credit, debit, prepaid), we request you to read in advance the T&Cs reproduced below as well as the Privacy Policy available at the following link and to click on "I agree" if you intend to accept the T&Cs and authorize the processing of the Geolocation Data of Your Device", processing necessary for the use of the feature.

We confirm that the data will neither be saved nor processed in any other way or for purposes other than those represented in the Disclosure; the aforementioned consent is optional, but failure to give it will make the feature not usable.

You may revoke your Consent to Processing at any time by modifying your choice from the Communication Hub > Settings > Geolocation Services section.

Art. 1 - Description of the "IP Replenishment" feature

The "IP Refueling" feature allows the Payment Card Holder (debit, credit or prepaid) - once the Card Enablement is completed to refuel and make the related payment at API Affiliated Service Areas, using the UniCredit Mobile Banking App.

Art. 2 - Requirements for access to the functionality

The functionality is reserved exclusively for natural persons, customers of the Bank, over 18 years of age, (hereinafter "Customer"/"Clients") who:

are owners of the Devices necessary for the use of the functionality or that they can legitimately dispose of them also for personal use on an exclusive basis;
are members of the Multichannel Banking Service;
have downloaded the UniCredit Mobile Banking App from the reference market and have activated it on the Device;
have provided the Bank with a cell phone number and email address, and that these have been verified;
are Payment Card Holders (debit, credit or prepaid) issued by the Bank , and the same is in "ACTIVE" status. In case of Payment Card in "NOT ACTIVE" status or in "LOCKED" status, the Bank does not allow the use of the functionality.

Art. 3 Ways to make the choice of payment card

Mobile Banking App.

On the screen for accessing the Mobile Banking App, whether activated on the main device, or on the secondary devices, the Customer at the first access to the "IP Replenishment" functionality will firstly be able to select the payment card to be used. Upon tapping on the card, the Customer displays a pop-up asking whether or not he/she wishes to select the card as preferred; the Bank does not allow the use of the feature for a payment card that is in "NOT ACTIVE" or "LOCKED" status. The card selection process may also be repeated later for the use of additional payment instruments.

Art. 4 Modalities for refueling and payment

For each payment card the limits of use as defined in the relevant contract as well as the specific rules of use, which form an integral part of the contract itself, apply, as far as the App is concerned, in addition to the contractual provisions of the Multichannel Bank Service, the provisions given -in the time to time version of the Multichannel Bank Service Guide- accessible from the page https://www.unicredit.it/it/privati/internet-emobile/tutti-i-servizi-internet-e-mobile/internet-e-mobile-banking/banca-via-internet.html.

Once in the vicinity of the fuel dispensers, the Customer, having selected the card, pre-authorizes the amount of refueling by means of MPIN/Mobile code/biometric or by other methods from time to time provided for in the Contract of the Multichannel Bank Service. In case of using the feature on App activated on secondary device, the confirmation of the transaction must be done from the primary device via MPIN/Mobile code/biometric. Once the pre-authorization for payment has been obtained, the Customer will be able to choose the amount to be dispensed and the dispenser (among those available) to be used for refueling. Having also completed the dispenser selection, the Customer lands on the Thank You Page, containing the details of the transaction. Once the refueling is completed, the Customer will receive a Push Notification confirming the successful transaction. Upon completion of the refueling at the IP station, the Customer receives an e-mail notification, summarizing the details of the transaction just completed.

Art. 5 Relationship between the Customer and the Bank and the Customer and the operator of the refueling facility

These "Terms and Conditions" do not invalidate or modify, in whole or in part, the contractual and economic conditions governing the use of the Customer's Devices, App and Payment Cards. These "Terms and Conditions" are to be understood as additional to those of the Payment Cards (debit, credit or prepaid) and the App. Consequently, the transaction charge, any related documentation, as well as any limits on the amount of preauthorized transactions, individually or cumulatively considered, or on the number of transactions during specific time periods, will be settled according to the conditions and within the timeframes provided by the contracts signed independently and directly by the Client with the Bank, as the Issuer of the Payment Cards.

Expenses related to the use of the functionality (e.g. costs related to the Device's data network, costs charged for the use of the Payment Instruments, any tax charges, etc.) are entirely borne by the Client ; the Bank does not charge any fees for the use of the "IP Replenishment" functionality.

The Bank, in case of violation of these "Terms and Conditions" may temporarily or permanently suspend access to the "IP Replenishment" functionality.

The Bank offers only the fueling fee payment functionality and is extraneous to the relationship between fueling facility operator and the Customer. Therefore, the calculation of the refueling fee are the responsibility of the operator of the refueling area, as well as any complaint regarding non-dispensing or non-compliant refueling is the responsibility of the operator, who will be responsible for handling the complaint and related verifications.

Art. 6 - Enabled Devices and Payment Cards - Custody and Loss

The Customer is obliged to keep and properly use his Device and his Payment Cards and is therefore, responsible in case of undue use, however it occurs, even if as a result of loss or theft; in particular, the Customer is obliged to scrupulously keep and properly use the Device, taking all appropriate measures of caution.

In the event of loss or theft, or in any case in the event of suspected misuse of the Device and/or the Payment Cards, the Client is obliged to activate all the procedures provided for, for the blocking of the Device and such Payment Cards, in the contracts it has signed with the Device's data network operator and with the Issuer of the Payment Cards, the Client being aware that any blocking, under the terms provided by these "Terms and Conditions", does not prevent misuse of the Device and the Payment Cards by third parties.

As far as the Mobile Banking App is concerned, the obligations under the Multichannel Banking Service apply.

Art. 7 Variations to the Terms & Conditions

In the event of a variation to these "Terms and Conditions" or modifications, the Customer will be required to give express acceptance in the same manner as used at the time of joining, without prejudice to the Customer's right not to use the functionality.

RULES OF CONDUCT PROVIDED BY IP FOR THE PROTECTION OF SAFETY FOR THE USE OF THE "IP REFUELING" FEATURE ON AFFILIATED FUEL OUTLETS

CARS (with enclosed passenger compartment)

Upon arrival on Point of Sale the Customer:

1. Places the vehicle near the dispensing column.

2. Turns off the engine.

Use of the APP:

3. Remains inside the passenger car, with windows and doors closed.

4. Opens the UniCredit Mobile Banking APP and selects the "Refuel IP "function and proceeds to the refueling request operation by indicating the dispenser column where he has positioned the car.

5. He waits for authorization.

6. Keeping the smartphone inside the closed vehicle, he gets out and proceeds with the refueling activity.

Before departure:

7. When refueling is complete, places the dispensing gun back into the appropriate slot.

MOTORCYCLES, MOTORCYCLES, MOPEDS AND VEHICLES WITH OPEN COCKPITS

Use of the "IP Refueling "feature is permitted only within the premises of the Fuel Sales Point or in the safe zone indicated by the operator where present.