Privacy Policy for welfare services: Satispay Italy S.P.A

Satispay Italy S.p.A. (“Satispay”), with registered office in Milan, Piazza Fidia 1, Italian tax code and registration number with the Milan companies’ register 12408640964.

Satispay has appointed a data protection officer (“DPO”) who provide assistance with any questions about the data processing we carry out and/or on how to exercise the relevant rights. The DPO may be contacted at

Satispay processes personal data relating to:

• affiliated commercial businesses, and in particular their legal representatives and/or beneficial owners;
• employers interested in providing their employees and collaborators with the welfare services offered by Satispay (“Services”), as well as employees and collaborators employed by such employers.

As part of the provision of the Services, Satispay collects personal data directly from the data subjects or, in the case of data relating to affiliated commercial businesses, through Satispay Europe S.A. The personal data of employees and collaborators benefiting from welfare services will also be collected through their respective employers who share them with Satispay.

Satispay processes personal data (e.g. first name, surname, sole proprietorship, etc.) and contact data (email, telephone number) for the following purposes and according to the following legal bases:

• a) to provide feedback and contact persons interested in the Services, to the extent that such processing is necessary for the performance of pre-contractual measures taken at their request (Article 6(1)(b) GDPR);
• b) to enable the proper provision and subsequent use of the Services, to the extent that such processing is necessary for the performance of a contract to which the data subject is a party (Article 6(1)(b) GDPR);
• c) to fulfil legal obligations relating to the provision of the Services, as well as requests from the competent authorities to which Satispay is subject (Article 6(1)(c) GDPR);
• d) to verify the fulfilment of the necessary requirements for the provision of the Services, as well as to carry out analyses aimed at improving and enhancing the efficiency of the Services, including by sending surveys, on the basis of a legitimate interest of Satispay (Article 6(1)(f) GDPR);
• e) to send communications to promote the Services, as well as to inform data subjects about the latest updates and/or features related to the Services, on the basis of a legitimate interest of Satispay (Article 6(1)(f) GDPR).

Only where strictly necessary, Satispay may share personal data with:

• providers for IT, communication, compliance, marketing, customer support and management services;
• Satispay’s staff, including staff of the entire Satispay group (that provide intergroup services), and business partners for Services-related reasons;
• where requested, competent authorities, financial institutions, courts, law enforcement agencies, public administrations.

These recipients may act as autonomous data controllers or as data processors. Data processors follow Satispay’s instructions.

Personal data is stored on servers located in the European Union. If necessary for specific purposes, personal data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the data is processed securely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.

Satispay has set up strong internal data security measures as well as technical and organisational measures (such as encryption, pseudonymisation and anonymisation) to keep personal data safe from accidental loss, misuse, alteration, destruction and/or unauthorised access.

Satispay retains personal data for as long as necessary to fulfil specific purposes and comply with applicable laws. In particular:

• for the purposes referred to in points a) and b) above, Satispay retains personal data for the term of the respective contractual or pre-contractual agreement;
• for the purposes referred to in point c) above, data will be retained for as long as necessary as required by the applicable law. In particular, Satispay retains this data for 10 years after the termination of the respective contractual relationship;
• for the purposes referred in points d) and e) above, Satispay retains the data until such time as the data subject requests that it no longer be used or requests for the data to be deleted and, in any case, no longer than the term of the respective contractual relationship.

In any case, personal data may be stored longer in the event of disputes or requests by the competent authorities.

Data subjects may exercise the following rights at any time:

• the right to know whether the personal data is being processed, and, if so, to receive a copy thereof;
• the right to rectify inaccurate or outdated personal data;
• where applicable, the right to obtain the erasure of personal data;
• where applicable, the right to restrict the processing of personal data;
• the right to receive and share their own personal data with another data controller in a commonly-used format;
• where applicable, the right to object to data processing based on a legitimate interest.

To exercise these rights, you may contact support@satispay.com or dpo@satispay.com.

Data subjects also have the right to lodge a complaint with the relevant Data Protection Authority. However, data subjects are encouraged to reach out to Satispay first to resolve any issues amicably and promptly.