This privacy notice is provided by Master Mind NPL 114 S.r.l., with registered office at Via Fra’ Paolo Sarpi 46/A, 35138 Padua (PD), Italy (hereinafter, the “Company” or the “Processor”), pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), in connection with the activities of management and recovery of non‑performing loans carried out on behalf of the respective data controllers.
The Company acts as data Processor pursuant to Article 28 GDPR, on the basis of specific contractual agreements with purchasers of non‑performing loans or other principals who act as data Controllers.
The Data Controller is the purchaser of the credit or the principal that has entrusted the Company with the management of the debtor position.
The identification details and contact information of the Controller are indicated in the communications sent to the data subject (e.g. transfer notice or communication of mandate for loan management).
Master Mind NPL 114 S.r.l. processes personal data exclusively on behalf of the Controller and in accordance with the instructions provided by the latter.
The Company’s Data Protection Officer (DPO) is: Avv. Luigi Ciccarese – PEC: luigi.ciccarese@ordineavvocatipadova.it.
In the context of the activities carried out on behalf of the Controller, the Company may process:
Processing may be carried out by electronic means and/or on paper, using methods strictly related to the purposes described above and limited to what is strictly necessary for the performance of the loan management activities entrusted to the Company.
The personal data processed by the Company in the context of non‑performing loan management activities originate primarily from the Data Controller (purchaser of the credit or principal), who provides data sets relating to the debtor positions under management, including personal, tax, contractual, economic and accounting information.
During the management of the loans, the Company may also acquire additional personal data relating to the same data subjects (debtors, guarantors, jointly liable parties or other persons involved in the relationship) from further sources, such as:
In all cases, the data acquired relate exclusively to information relevant to the debtor position under management and are processed by the Company on behalf of the Controller and in accordance with the Controller’s instructions, as well as in compliance with Articles 13 and 14 GDPR.
Personal data are processed by the Company exclusively on behalf of the Controller and within the limits of the instructions given by the latter, in order to enable the performance of the loan management activities covered by the mandate. In particular, processing is carried out for the following purposes:
The legal bases for processing are determined by the Controller pursuant to Article 6 GDPR and may include, by way of example, the performance of a contract or pre‑contractual measures, compliance with legal obligations or the Controller’s legitimate interest in managing and protecting its credit.
The Company does not independently determine the purposes and legal bases of the processing, but acts exclusively as Processor pursuant to Article 28 GDPR.
The provision of personal data is necessary for the proper management of the debtor position; failure to provide relevant information may result in the impossibility to process requests or to agree and implement negotiated solutions.
The personal data processed relate to the following categories of data subjects:
In addition to the categories listed above, personal data may also concern other persons who are involved, in various capacities, in legal, property or contractual relationships connected with the management of non‑performing loans, including any jointly liable parties, heirs, legal representatives or delegates.
Personal data processed by the Company in the context of loan management activities may be disclosed, within the limits of the instructions given by the Data Controller and in compliance with applicable law, to the following categories of recipients:
Where such parties process personal data on behalf of the Company, they are appointed as sub‑processors pursuant to Article 28 GDPR by means of a specific written agreement and act in compliance with the instructions given and the required security measures.
Personal data may also be disclosed to the Data Controller for reporting, monitoring and control activities relating to the management mandate.
An up‑to‑date list of sub‑processors is available upon request from the data subject.
The Company retains personal data processed on behalf of the Controller for as long as is strictly necessary for the performance of the mandate and, in any event, in accordance with the instructions provided by the Controller.
In particular:
Upon termination of the relationship with the Controller, personal data will be returned or deleted in accordance with the contractual agreement pursuant to Article 28 GDPR, unless their further retention is required by law or necessary for the protection of the Company’s rights.
Personal data are processed using electronic and paper‑based tools, in compliance with the principles set out in the GDPR. The Company adopts appropriate technical and organisational measures, including:
The measures adopted are reviewed periodically, also in light of regulatory and technological developments.
Data subjects may exercise the rights set out in Articles 15–22 GDPR (access, rectification, erasure, restriction, objection, portability where applicable) by contacting the Data Controller directly.
Requests may also be addressed to the Company using the contact details indicated in this notice; in such cases, the Company will promptly forward the request to the Controller and cooperate with the latter in handling it, in accordance with the instructions received.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 GDPR.
The processing activities carried out by the Company on behalf of the Controllers are recorded in the Processor’s Record of Processing Activities, prepared pursuant to Article 30(2) GDPR.
The Record is updated periodically and made available to the competent Authority upon request or inspection.
For specific activities closely related to its internal organisation and to regulatory obligations directly applicable to the Company (such as, by way of example, accounting and tax compliance, supervisory obligations or the management of disputes relating to its own business), Master Mind NPL 114 S.r.l. may act as an independent Data Controller.
In such cases, processing is carried out in compliance with the GDPR and applicable legislation, on the basis of the relevant legal grounds.
This privacy notice is subject to periodic review in order to ensure its continued adequacy and compliance with applicable legislation. In particular, it is reviewed at least annually and, in any event, updated whenever legislative, regulatory or organisational changes affect the way personal data are processed.