Privacy Information Notice on collection and processing of personal data

In accordance with Regulation (EU) 2016/679 ("GDPR"), Eni SpA sets out below the privacy information notice on the processing of your personal data - obtained directly from you and/or obtained from third parties – for the purposes of the qualification process for possible inclusion/updating of your company in our supplier/contractor lists, as well as for assessment of any contractual Bid and the administration of the potential Contract, if awarded to you. In this context, personal data relating to your company, your employees, collaborators and subcontractors may or shall be collected and processed.


1.Identity and contact details of the Data Controller

The Data Controller is Eni SpA, with registered office in P.le Mattei 1, Rome and principal place of business in Via Emilia, 1, 20097 San Donato Milanese (Milan). The Data Processor for personal data relating to the procurement activities of Eni SpA is the Executive Vice President of the Procurement Dept., via Emilia 1, 20097 San Donato Milanese (MI), email address, or any subsequent substitute.

2. Contact details of the Data Protection Officer (“DPO”)

Eni SpA has appointed a Data Protection Officer who can be contacted at the following email address:

3. Purposes of data processing and its legal basis

  • Necessary legal and contractual purposes – data processing is required to comply with the Data Controller's contractual or legal obligations or to execute a specific request of the data subject. Your personal data may be processed without your consent, in cases where this is necessary to fulfil the obligations of law, as well as standards, codes or procedures approved by the Authorities and other competent Institutions. Your personal data will also be processed for the following purposes:
    - verify the technical, economic and financial suitability of your company and compliance by your company with all statutory requirements for the purposes of any inclusion/update in our lists of qualified suppliers/contractors. This is to enable you to participate in tender processes organized by our company;
    - assess the technical, economic and financial suitability of any bids submitted by you and verify compliance by your company with all statutory requirements for the award of potential contracts;
    - allow, in the event of contract award, the proper and correct handling of the contractual relationship in terms of technical and economic conditions, and fulfilment of all legal obligations related to the contract award.
    Since the provision of your personal data for the above purposes is required, failure to do so may make it impossible for Eni SpA to successfully accomplish the qualification process of your Company/consider the bid in question/establish the relationship concerned.
  •  Purposes of compliance and management of the contract- Your personal data will be processed for the purposes necessary for the proper management of the contractual relationship with Eni SpA.
  •  Defence of a legal claim - Additionally, your personal data will be processed whenever it is necessary to ascertain, exert or defend a legal claim of the Data Controller or of Eni SpA subsidiaries in a court.


4. Recipients of personal data

For the purposes listed in Section 3, the Data Controller may disclose your personal data to third parties, such as, for example, those belonging to the following categories:
_ police forces, the armed forces and other government bodies, for the fulfilment of the obligations envisaged by law, regulations or EU legislation;
_ other Eni SpA subsidiaries, for administrative reasons related to the management of the contract/relationship;
_ insurance companies responsible for the settlement of claims;
_ companies specialized in credit recovery;
_ companies specialized in the management of business information or related to credit, or advertising and promotion;
_ other companies that provide services similar to those supplied by Eni SpA with which the Data Controller has agreements of various types;
_ other companies contractually bound to the Data Controller that provide consultancy, service delivery support, etc.

The Data Controller will take the utmost care to ensure that the disclosure of your personal data to the above recipients involves only the data required to accomplish the specific purposes for which it is intended.


5. Transfer of personal data outside the EU

In the context of the contractual relations between Eni SpA and its subsidiaries, for some of the purposes listed in Section 3 above, your personal data may be transferred outside the EU, including through inclusion in databases shared and managed by third parties both within and outside Eni SpA's scope of control. The management of the database and the processing of this data are performed only for the purposes for which it was collected and with maximum respect for the privacy and security standards described in applicable personal data protection laws. Whenever your personal data is transferred outside the EU, the Data Controller shall  take every suitable and necessary contractual measure to guarantee an adequate level of personal data protection in accordance with this Privacy Information Notice, including, among other things, the Standard Contractual Clauses approved by the European Commission.

6. Data retention period

Your data will be kept for ten years from the termination of any contractual relationship in order to allow Eni SpA to defend itself against possible claims in relation to the contract. At the end of this period, all data will be deleted or otherwise irreversibly de-identified, unless the continued retention of some or all of the data is required by law.


7. Rights of data subjects

As a data subject, you have the following rights over the personal data collected and processed by the Controller for the purposes indicated in point 3: (i) the right of access, in particular to request at any time confirmation of the existence of your personal data in the Company’s archives and the making available of this information in a clear and intelligible form, and the right to know the origin, logic and purpose of the processing with express and specific indication of the data supervisors and processors and the third parties to which your data may be communicated; (ii) the right to have your data updated and rectified (except for subjective data), to have superfluous data erased or anonymised, and to block processing and to have your data definitively erased in the event of unlawful processing; and (iii) where the conditions are met, to restrict processing and data portability. The law also grants data subjects the right to complain to the Supervisory Authority for Personal Data Protection if you become aware of a violation of your rights under applicable personal data protection legislation.
 You can exercise the above mentioned rights by sending an email to, or by writing to the Eni Data Protection Officer