Privacy notice for Members and Stakeholders
This privacy notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).
Where personal data are not collected directly from you, they may be obtained from the ABI Member institution and/or from another organisation to which you belong.
This privacy notice explains how the Italian Banking Association (hereinafter, the “Association” or “ABI”) processes your personal data in accordance with applicable data protection law.
The information provided below will help you understand:
• who processes your data and how to contact them;
how your data is analysed and for what purpose;
• Your rights.
Contacts
ABI processes your personal data in its capacity as data controller within the meaning of Article 4(7) GDPR.
As data controller, ABI determines the purposes and means of the processing and implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
The Association's headquarters are located at Piazza del Gesù n. 49, Rome, 00186 – Tel: +39.06.6767.1 Fax: +39.06.6767.457, e-mail: [email protected].
ABI has appointed a Data Protection Officer (“DPO”), who may be contacted regarding any matter relating to the processing of personal data and the exercise of data subject rights at:
– [email protected] for the Italian Banking Association
More information about your rights can be found in the section "your rights".
Information on Data Processing
Personal data are processed in accordance with the GDPR and applicable national data protection legislation. ABI processes personal data lawfully, fairly and transparently, and in accordance with the principles of purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
ABI processes identification, professional and contact data, including first name, surname, e-mail address, telephone number, role or position, and the Member institution or organisation represented, for the following purposes:
1. managing institutional and operational relations with Members and stakeholders, including general correspondence;
2. conducting discussions and exchanges on matters of public interest relevant to the banking sector;
3. inviting Members and stakeholders to participate in initiatives organized by ABI, including as attendees or speakers;
4. retaining materials produced or collected to document ABI’s institutional activities.
The legal bases applicable to the processing are as follows:
• for purpose 1) ABI’s legitimate interest in managing institutional relations with Members and stakeholders (Article 6(1)(b) and/or (f) GDPR);
• for purpose 2), performance of the membership relationship, where applicable, and ABI’s legitimate interest for stakeholders in promoting dialogue on matters of public interest relevant to the banking sector (Article 6(1)(b) and/or (f) GDPR);
• for purpose 3), ABI’s legitimate interest in organizing and promoting institutional events, seminars and other initiatives relevant to its activities (Article 6(1)(f) GDPR);
• for purpose 4), ABI’s legitimate interest in maintaining documentary evidence of its institutional activities (Article 6(1)(f) GDPR).
The provision of personal data is necessary to manage the relevant institutional or membership relationship
and the related activities. Failure to provide the data may prevent ABI from establishing or continuing such
relationship or from carrying out the requested activities.
Retention period of personal data
Your personal data will be processed:
• for purposes 1), 2) and 3), for the duration of the membership or stakeholder relationship;
• for purpose 4), as long as ABI continues to carry out its institutional activities.
Transfer of personal data
Personal data may be disclosed to service providers carrying out activities on behalf of ABI. Depending on
the circumstances, such recipients process the data as processors appointed pursuant to Article 28 GDPR
or as independent controllers.
Personal data may also be accessed by ABI employees and collaborators who are authorized to process
personal data and act under ABI’s authority and instructions.
Personal data will not be transferred to countries outside the European Economic Area.
Your rights
With regard to your data, the legislation recognizes specific rights, where applicable, such as:
• obtaining confirmation of the existence and access to your personal data;
• obtaining any updates, corrections or integrations of your data;
• requesting the deletion of your data within the terms permitted by law;
• objecting, in whole or in part, for legitimate reasons, to the processing of your personal data;
• limiting the processing, in the event of a breach, request for rectification or opposition;
requesting the portability of electronically processed data, provided on the basis of consent or
contract;
• withdrawing your consent to the processing of your data, where applicable;
• in the case of automated decision-making processes, obtaining human intervention from the Data
Controller to express your opinion and contest the decision.
To this end, ABI gives you the opportunity to exercise your rights by sending an e-mail to: [email protected].
ABI will respond to requests without undue delay and, in any event, within one month of receipt. That
period may be extended by a further two months where necessary, taking into account the complexity and
number of requests. ABI will inform you of any extension and the reasons for the delay within one month
of receipt of the request.
The outcome of your request will be provided to you in writing. If you request rectification, erasure or
restriction of processing, ABI undertakes to communicate the outcome of your requests to each of the
recipients of your data, unless this proves impossible or involves a disproportionate effort.
Where requests are manifestly unfounded or excessive, in particular because of their repetitive character,
ABI may charge a reasonable fee or refuse to act on the request, in accordance with Article 12(5) GDPR.
Finally, if you deem it appropriate, you may file a complaint with the Italian Data Protection Authority, in
the manner and form provided for by law. For further information, please consult the Authority's website.
Updated information as of October 15, 2026