Policy for customers and suppliers

• To perform the contract and fulfil pre-contractual requirements, including managing commercial communications (initial contact, sending offers/quotes), on-site surveys, assessments or projects, establishing and developing the relationship, and providing the service/products.

Processing is based on the necessity to fulfil contractual obligations or pre-contractual requirements.

• To comply with legal obligations regarding tax/accounting and internal administrative requirements related to the relationship and management control (such as invoicing, accounting records, issuing transport documents, managing payments, shipments, debt collection, etc.).

Processing is based on legal obligations incumbent upon the Data Controller, the fulfilment of contractual obligations and administrative requirements.

• To manage disputes and protect the rights of the data controller in litigations.

Processing is based on the need to satisfy a legitimate interest of the data controller.

• To send promotional communications and updates on the data controller’s activities via e-mail.

Processing is based on the data controller’s legitimate interest in using soft spam methods for existing customers, or on the express consent of potential customers.

• WHAT PERSONAL DATA WILL BE PROCESSED?

Common personal data (including, for example, identification data, physical, telephone or email contact details, tax code, residence, information on economic activity and company organization, commercial agreements and payment instruments, specific information necessary to provide the service, etc.) necessary to achieve the purposes – management of commercial relations, provision of services, administration and litigation.

• WHY DO WE ACQUIRE THIS DATA?

The data is processed to answer your requests and to fulfill needs that arose during the pre-contractual steps, as well as to establish, follow up on, and manage the business relationship, administration and to provide the agreed service.

• HOW DOES PROCESSING OCCUR?

The data may be processed in digital or paper form, including through electronic databases, specific management systems (accounting, CRM, production/warehouse) and communication tools (e-mail), by our sales/administrative department. To fulfil your order, your data may be processed by personnel involved in the production/delivery of the service.

Some documents, such as electronic invoices, certified e-mails or digitally signed contracts, may be subject to electronic storage in accordance with the law and kept for these reasons by third-party suppliers.

Data on the relationship may be aggregated to create statistics and indices for management control purposes.

Finally, all data is kept secure and appropriate security measures are applied (backups, authentication, diversified authorisation levels, etc.) to prevent unlawful processing or data breaches.

Finally, in order to assess your level of satisfaction with the service, you may receive anonymous questionnaires. Completing these questionnaires is optional.

• WHO PROVIDED US WITH YOUR DATA?

The data is provided directly by the data subject during the pre-contractual stages or in the course of the commercial relationship. Some information may be obtained from public registers, lists, records or documents that are accessible to anyone within the limits and in the manner established by the rules on their accessibility (e.g. Chamber of Commerce records).

• IS PROVIDING DATA MANDATORY?

Yes, the provision of data is mandatory to the extent that processing is necessary to comply with contractual and legal obligations and to ensure the proper execution of the commercial relationship. Failure to provide such data would make it impossible to proceed with the relationship and the contract.

• HOW LONG IS YOUR DATA RETAINED?

Depending on specific legal obligations and the achievement of objectives, your data will be stored for a maximum period of 10 years after the termination of the relationship, except for needs related to litigation or the defence of the data controller’s rights in court. Obsolete or no longer necessary data will be deleted prior to this deadline.

• TO WHOM CAN DATA BE COMMUNICATED?

• • public bodies and administrations (e.g. the Revenue Agency);
  • banks, credit institutions and insurance companies;
  • law firms and debt collection agencies;
  • entities providing accounting, administrative or management control services;
  • lawyers, legal advisors and judicial authorities, in the event of litigation;
• IT support companies and providers of IT services and systems used by the data controller to manage the relationship (e.g. accounting/invoicing management systems, customer management systems, cloud service providers, email service providers, web application and service providers, etc.)

• WHAT IS MEANT BY ‘SOFT SPAM’?

‘Soft Spam’ is a marketing method that involves sending emails to existing customers who have provided their email address as part of the commercial relationship; the promotional content must relate to products and services similar to those already purchased. The purpose is to keep customers up to date on new products, services, discounts or news about us.

If you are not a customer, your express consent will be required in order to carry out this activity.

• HOW OFTEN WILL ‘SOFT SPAM’ COMMUNICATIONS BE SENT?

Generally, these emails will be sent occasionally and not on a regular basis. They will be sent as needed when there are new products or activities to promote.

•  WHAT PERSONAL DATA WILL BE PROCESSED?

Common personal data (including, for example, identification data, contact details, email addresses, information on economic activity and existing commercial relationships) necessary to forward our communications.

• IS PROVIDING DATA MANDATORY?

No, providing your data is not mandatory, and failure to do so will only result in you not receiving promotional communications.

• CAN YOU ASK TO STOP THE PROCESSING?

Sure, you can ask to stop the processing at any time by contacting the controller or, if the email is sent through email marketing systems, you can also use the unsubscribe link at the bottom of all communications.

• HOW LONG IS YOUR DATA RETAINED?

Your data will be stored as long as you remain our customer and for a maximum period of 3 years after the end of our relationship, or until you withdraw your consent.

• TO WHOM CAN DATA BE COMMUNICATED?

Your data will never be disclosed to other parties for their marketing purposes or for the promotion of third-party services. The parties to whom the data may be disclosed perform a purely technical or advisory role on behalf of the data controller, including:

• IT support companies and IT service providers used by the data controller (e.g. email marketing services);
• consultants and professionals involved in the design, structuring and implementation of promotional campaigns.

• • Access to personal data: you can ask us to confirm that processing of your personal data is taking place and obtain access to data in our possession concerning you.
• Rectification and updating of personal data: if you believe your data is incorrect or no longer updated, you have the right to ask us for rectification.

• • Erasure of personal data: when processing is concluded, you withdraw consent or object to processing and there are no other legal reasons why we can retain your personal data, you can request its deletion.
  • Restriction of processing: if processing is based on the legitimate interest of the controller or third parties or you wish to restrict the processing scope of such data, you can request restriction of processing.
• Objection to processing and use of automated decision-making processes: you can object to processing for a particular purpose when it is based on the legitimate interest of the controller or third parties; furthermore, you can object to the use of automated decision-making processes, including profiling.

• • Portability of personal data: in certain circumstances, you can request that your data be provided to you in a structured, commonly used and machine-readable format.
• Withdraw given consent: if processing is based on your consent, you can withdraw it at any time.

For more information, you can visit the Privacy Authority website: https://www.garanteprivacy.it/i-miei-diritti