With this document, drawn up under Article 13 of EU Regulation no. 679/2016 (hereinafter also "Regulation") Fincantieri S.p.A. informs you, as the data subject for the processing of personal data, of the following.


1. Data Controller for personal data processing


The data controller for the personal data requested from you (i.e. name, surname, email address, tax code) is Fincantieri S.p.A., VAT no. 00629440322, with registered office in Trieste, Via Genova 1, (hereinafter also referred to as just the "Controller"), email, tel. +39 040 3193111 fax +39 040 3192305.


The Data Protection Officer ("DPO") of Fincantieri S.p.A. can be contacted at the following e-mail address: .



2. Purpose and legal basis of the processing of personal data


In relation to your professional collaboration and/or employment relationship with the Controller, and on the basis of the relevant/privileged information that you get in rder to execute the same, your personal data will be processed, with the support of computer and/or paper means, solely for the purpose of being registered in the appropriate List of persons who have access to privileged information or in the appropriate List of persons who have access to relevant information (socalled List of Insiders) prepared by the Controller. The processing is necessary to fulfil the legal obligations of the Controller as a listed entity, issuer of shares and bonds. It should also be noted that your data will be communicated and processed within Fincantieri S.p.A. by personnel duly appointed and instructed by the Controller.


3.Recipients of personal data


Your personal data may be communicated, strictly in relation to and in line with the purposes set out above, to the following categories of subjects:

  • Authorities requesting information;

  • any other parties, who must be informed under the current legislation.

The contact data of the external processors who carry out activities in the Controller's interest may be requested by you at the following emailaddress: .


4.Transfer of personal data to a third country or an international organisation


The Controller will transfer your personal data to countries outside the European Union only in relation to specific List of Insiders’ management needs or in relation to the relationship between you and the Controller.


In all other cases, the Controller does not intend to transfer your personal data to countries outside the European Union.


5. Period of retention of personal data


Your data will be kept for the time necessary to fulfil legal obligations, for a time period of 5 years from the erasure of your data from the List of Insiders.


In any case, the terms of limitation in force will be respected to enforce the rights and obligations relating to your relationship with the Controller and other contractual or legal obligations that the Controller is required to comply with.


6. Rights of the data subject


We inform you that as data subject for the processing you have the right to obtain from the Data Controller:



Right of access:

(Article 15 of the Regulation)

confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, the right to obtain, among other things, access to your personal data and information regarding the purposes of the processing, the categories of personal data concerned and the recipients or categories of recipient to whom the personal data have been or will be disclosed.

Right to rectification:

(Article 16 of the Regulation)

(i) rectification without undue delay of inaccurate personal data concerning you and (ii) completion of your personal data, where incomplete.

Right to erasure ("right to be forgotten"):

(Article 17 of the Regulation)

erasure of personal data concerning you without undue delay (the Data Controller has the obligation to erase personal data without undue delay in the cases set out in Article 17 of the Regulation).

Right to restriction of processing:

(Article 18 of the Regulation)

restriction of processing in the cases set out in Article 18 of the Regulation.

Right to data portability:

(Article 20 of the Regulation)

receipt in a structured, commonly used and machine-readable format of personal data concerning you; the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, in the cases set out in Article 20 of the Regulation.

Right to object for processing carried out under Article 6(1)(e) or (f):

(Article 21 of the Regulation)

objection, at any time, on grounds relating to your particular situation, to the processing of personal data relating to you under Article 6(1)(e) or (f), including profiling on the basis of such provisions.


At any time you will be able to exercise the above-mentioned rights by sending a request to the following e-mail address: .


Users also have the right to object to the processing at any time, as well as to lodge a complaint with the Data Protection Authority if they believe that the processing of their personal data breaches the provisions of EU Regulation no. 679/2016.


7. Nature of consent for the processing of data and consequence of failure to give consent


The processing of personal data for the purposes referred to in paragraph 2 above is necessary to carry out the specific obligations arising from the legal obligations incumbent on the Controller; failure to provide these data for this purpose may therefore make it impossible for you to continue your relationship with the Controller.