Management Systems

The trend in the competition situation on the markets where the Acea Group operates requires growing attention to the matter of compliance with antitrust law and the regulations concerning consumer protection.

Acea believes that competition and consumer protection is a core value for company business activities and pursues its objectives in obersvance of the rules regulating the market. Consistent with the principles set out in the Code of Ethics, the Group specifically abstains from anticompetitive, exploitive and abusive practices and, more generally, from any conduct that might impede the correct functioning of market mechanisms and imply detriment to consumers.

In order to safeguard these values, the Acea Group has adopted an extensive Antitrust Compliance Programme, within the scope of which it has created the role of Antitrust Contact Person (for both the Holding Company and the subsidiaries) and defined organisational policies, rules, measures and control units intended to ensure the compliance of its actions with legislation and promote the development of a business culture oriented towards respect for principles of fair competition and correctness vis-à-vis consumers.
Within this framework, in 2018 the Acea Spa Board of Directors approved:

• the "Manual of Compliance with Antitrust and Consumer Protection Legislation”, setting out the main points of the legislation and providing a series of behavioural rules, with which all Group staff and third parties acting on behalf of the Group are obliged to comply when carrying out their work;
  
  
• the "Organisational Regulation on Antitrust Compliance and Consumer Protection" which defines the corporate organisation for the purpose of effectively implementing the Compliance Programme.
  

In 2022, the Programme was revised and updated, with a view to defining and formalising a structured Antitrust Compliance governance model, in line with related domestic and international best practices, which exploits experience gained and the ideas derived from domestic and EU Antitrust Authority application practices and case law.
In this connection, Acea’s Board of Directors approved the “Antitrust Compliance and Consumer Protection Guidelines”, with the aim of making available to subsidiaries, within a shared framework, guidelines for creating their respective Antitrust Compliance Models, each according to their own specifics.
In fact, the Guidelines set out the principles and indications imparted by Acea to the Group Companies, concerning the series of organisational, management and procedural tools designed to prevent, manage and mitigate risks of non-compliance and to promote a widespread culture within the Group on issues pertaining to fair competition and consumer respect.

Considering the trend in personal data protection regulations, the Acea Group has undertaken to develop and implement effective policies to protect the personal data of employees, customers, suppliers, shareholders, stakeholders, partners, as well as any persons whose personal data, for whatsoever reason, are processed by the Company, adopting a Privacy Governance Model, in accordance with EU data protection Regulation 2016/679 (GDPR).
During 2021, the Privacy Governance Model was revised based on the results of the previous two years and in 2022 the Board of Directors approved the “Privacy Governance Guideline”, which forms part the integrated framework adopted by the Acea Group, for application of the GDPR.
The Group Privacy Governance Model constitutes the organisational and control framework within which both roles and responsibilities and procedures for implementing the basic principles of the Privacy rules are identified, by way of a preventive risk based approach supported by continuous monitoring and periodical reviews.
Acea constantly oversees the various areas progressively emerging that impact privacy and periodically carries out an analysis of the “processing” risks included in the Parent’s register, to enable the updating of associated risks on an ongoing and timely basis.
Regarding the outsourced operations, specific contractual tools are used to regulate the processing of personal data and a continuous monitoring of procurement activities is ensured.
The indications issued by the Italian Data Protection Authority, wherever applicable, are always implemented and privacy-related training sessions are periodically carried out, as well as supplier checks, with a view not only to fulfilling the direction and control obligations, including with regard to personal data processing carried out by third parties on behalf of the Acea Group, but also to always having a vision of the entire reference scenario. Moreover, a second-level governance and monitoring system has been developed, comprising a series of controls consistent with the risks pertaining to privacy security and data protection.
The Data Protection Officer (DPO) at Group Parent and Company level can be contacted at the following address: privacy@aceaspa.it. Some "privacy control units" have also been identified to act as internal reference and liaison points with the DPO.