Data protection notice for third parties (O_IS_IT)

Privacy notice pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR")

 

This notice (Notice) is provided in relation to the processing of personal data of customers and/or potential customers and/or suppliers of Technoform Bautec Italia S.p.A. who have or intend to enter into a business relationship with the Controller as identified below.

 

  1. Controller

For the purposes of the Notice, the Controller is Technoform Bautec Italia S.p.A., with registered office in Lainate (MI) at Via Settembrini, 80, registered in the Milan Register of Companies under no. 184951/1998 - Economic and Administrative Index no. 1562624, Tax Code 02264970126 - VAT no. 12483790155 (Controller).

 

  1. Collected Data

Your personal data (e.g. first name, surname, company name, address, telephone number, e-mail, bank and payment details) provided by you and collected at the time of entering into contracts with the Controller, including during the pre-contractual phase, are limited to those necessary for the establishment, management, execution and/or conclusion of the contractual relationship with the Controller (collectively also referred to as Data).

 

  1. Purposes and legal basis of processing in accordance with Regulation (EU) 2016/679

The legal basis for processing your personal data is the performance of the contractual relationship with the Controller, and fulfilment by the Controller of legal, regulatory and/or EU obligations.

The legal bases for processing your personal data are listed below:

art. 6(1)(b): processing carried out for contractual reasons within the context of the business relationship between the Controller and the data subject; 

art. 6(1)(c): processing required to fulfil a legal obligation to which the Controller is subject.

Your personal data will be processed exclusively to ensure proper performance of your contract with the Controller and, in particular, for the following purposes: 

  1. entering into contracts for services provided to or for the benefit of the Controller, aimed at the provision of services or the sale of products; 
  2. fulfilling pre-contractual, contractual and tax obligations arising from existing relationships with you; 
  3. requirements of an operational, managerial, administrative and accounting nature, including potentially sending commercial invoices by e-mail, and in general complying with the obligations provided for by law and/or regulations, in particular with regard to tax matters; these requirements may be fulfilled by e-mail;
  4. exercising the rights of the Controller, such as the right of defence in court.

Your data will also be processed, with your express consent, for the purpose of:

  1. marketing, commercial information and promotional activities, including sending newsletters and advertising material by e-mail, and including through use of technological platforms.

Processing will also be lawful if based on express consent for the purposes specifically indicated.

 

  1. Methods of processing 

The Data shall be processed by employees and/or collaborators of the Controller, specifically designated as persons authorised to process the Data pursuant to Art. 29 GDPR (including, by way of example, the persons in charge of the human resources function, the legal function, the administrative function, the compliance and risk management function and the information systems) or external data processors pursuant to Art. 28 GDPR, whose respective names shall be provided by the Controller upon request. 

The Controller and its third-party collaborators process the Data by means of manual processing or using electronic or otherwise automated tools, according to logic strictly related to the purposes and, in any case, in such a way as to guarantee the security and confidentiality of the Data. In this regard, the Controller declares that it has carried out a security risk analysis and has taken all appropriate measures pursuant to Art. 32 of the GDPR, as well as having carried out the necessary "Data Protection Impact Assessments" in accordance with Art. 35 of the GDPR.

 

  1. Transmission of the Data 

Data may be disclosed to third parties only where necessary for the establishment, management, performance and/or conclusion of the contractual relationship with the Controller.

Third-party recipients of the Data, independent data controllers or persons duly designated as data processors belong to the following categories: 

  1. persons who, on behalf of or for the benefit of the Controller, perform tasks of a technical and organisational nature or professional support/consultancy tasks, and in particular accounting and payroll consultants, legal consultants and notaries, providers of the software infrastructures used by the Controller or the companies in the Technoform Group and abroad, in their capacity as internal or external appointed persons and/or data processors and/or system administrators; 
  2. third-party companies or other entities (by way of example, credit institutions, professionals, consultants, and insurance companies for the provision of insurance services) that perform activities on behalf of the Controller and in their capacity as external data processors;
  3. supervisory bodies, judicial authorities and public security authorities, as well as those persons to whom disclosure is mandatory by law for the fulfilment of said purposes;
  4. professionals or professional associations;
  5. the Data may also be disclosed to third-party companies for the performance of marketing, commercial information and promotional activities, including sending newsletters and advertising material by e-mail;
  6. companies in the Technoform group.

 

  1. Dissemination of the Data

The Data will not be disseminated, except in anonymous form.

 

  1. Data storage period

The Data are processed for the period of time strictly necessary to achieve the purposes for which they have been collected and, in any case, for no longer than 10 years from the termination of the relationship established with the Controller, with the exception of the processing of Data for tax and/or social security audits and/or for obligations arising from regulations applicable to the Controller, in relation to which they will be stored for the limitation period provided for by the applicable regulatory provisions, including tax regulations.

Data collected for marketing purposes, on the other hand, will be stored for no longer than 2 years after their collection.

 

  1. Rights of the data subject under Chapter III of Regulation (EU) 2016/679

Data subjects have the right at any time to: (I) obtain confirmation as to whether or not personal Data concerning them exist; (II) know the purposes of the processing and the methods, the recipients of such Data, the storage period; (III) obtain rectification or erasure and, where applicable, restriction of processing; (IV) object to processing; (V) where applicable, receive the Data concerning them provided to the Controller in a structured, commonly used and machine-readable format, and transmit such Data to another data controller without hindrance from the Controller; (VI) lodge a complaint with the Data Protection Authority. 

You may contact Technoform Bautec Italia S.p.A. to assert the rights listed above by e-mailing: privacy [dot] oisit [at] technoform [dot] com. 

You may submit an appeal at any time for the protection of your rights to the Privacy Authority under Art. 77 GDPR.

 

  1. Privacy Contact Person and Persons Who May Have Access to Personal Data

The Privacy Contact Persons are Adalberto Banfi and Raffaella Galli, domiciled for this purpose at the Company. In any event, you can access the updated list of Data Processors at the registered office of the Company (the Controller).

Consistent with the purposes set out above, your personal data may be disclosed to the Company's staff in charge of the relevant administrative and IT management tasks, as well as staff entrusted with activities involving the processing of your data for one of the purposes set out in this notice.

 

  1. Consequences of failure to provide personal data

With regard to personal data relating to performance of the contract to which you are a party, or compliance with a legal obligation (e.g. compliance with accounting and tax record keeping obligations), failure to provide the Data prevents fulfilment of the contract. With regard to Data for marketing purposes, failure to provide the information will prevent the sending of newsletters.

 

  1. Consent to processing

The processing of Data for the purposes referred to in Articles 3 (v) and 5 (e) requires your consent, which will be specifically requested from you.