General informative notice on the processing of customer and supplier data

PRIVACY NOTICE ON THE PROCESSING OF CUSTOMER AND SUPPLIER DATA

pursuant to art. 13 of European Regulation No. 679 of 2016

and art. 13 of Legislative Decree No. 196 of 30 June 2003

El.En. S.p.A. intends to inform all customers and suppliers (hereinafter referred to as “Data Subject”), on the processing of their personal data, pursuant to the combined provisions of art. 13 of the Legislative Decree no. 196/2003 (“Privacy Code”) and of article 13 of European Regulation No. 679 of 2016 (“GDPR”).

Please note that, according to the Privacy Regulation, such processing shall be based on principles of correctness, lawfulness, transparency and the protection of your privacy and your rights.

1. Data Controller, Data Processors and Data Protection Officer

The personal data processing controller is El.En. S.p.A. with registered office at Via Baldanzese, No. 17 – 50041 Calenzano (FI) – Italy, TAX and VAT No. IT03137680488 (herein after referred to as the “Data Controller”).

The Data Protection Officer (article 37 GDPR) can be contacted at the following Email address: dpo@elen.it (hereinafter referred to as the “DPO”).  

2. The Personal Data subject to processing

Under the present privacy notice, personal data means the personal details and contact details relative to individuals processed by the Data Controller for the conclusion and execution of the contractual relationship with customers and suppliers, included the ones relative to customers and suppliers as natural persons, the ones of the legal representative of the customers and suppliers legal persons as well as to employees/consultants of the customers and suppliers involved in the activities referred to in the contract (“Personal Data”).

3. Purposes of processing
4. A) Without express consent

Personal Data will be processed by the Data Controller according to the purposes related to the conclusion and execution of the contract and, particularly:

• to provide information requested;
• to fulfil obligations required by law, rules, European regulations or authorities;
• to fulfil pre-contractual, contractual and fiscal obligations deriving from the business relationships entered into;
• to exercise the data controller’s rights (e.g. the right to legal defence in the event of non-fulfilment of contractual obligations);
• to facilitate the administrative/accounting management of the Data Controller;
• to facilitate the management of activities relating to the purchase of goods and services for business purposes;
• to facilitate the sale/hire/invoicing of products and/or the provision of services;
• to manage any complaints or disputes.

The processing of Personal Data for the fulfilment of the above purposes is necessary for the correct management of the contractual relationship and their provision is mandatory. The legal basis for the processing is the execution of the contract. Therefore, Persona Data will be processed without the Data Subject’s consent. Refuse to provide such data may result in failed or partial performance of the contract, and/or failure to continue the contractual relationship.

1. B) Only with declared consent

- to improve the required services;

- to allow subscription to the data controller’s newsletter and any other services required;

- to carry out marketing activities such as the sending of promotional and advertising material about products and services offered by the Data Controller also by email, mms and text message;

- to carry out marketing activities such as the sending of promotional and advertising material about products and services offered by third parties (e.g. business partners; insurance companies; etc.).

- to use images and videos that frame Data Subject in order to improve the Data Controller  activities and services and/or for promotional purposes of them.

Particularly, for that it concerns to images and videos captured by the Data Controller, they will be processed in the field of research and development and therefore in order to improve the products offered.

Please note that providing data for the purposes describe in clause B) is optional and failure to provide them or to authorise their processing will preclude sending newsletters, commercial communications and/or advertising materials. In any case and at any time, you may revoke your consent.

4. Processing methods and security measures

The processing of Personal Data will be based on correctness, lawfulness and transparency, protecting your privacy and your rights and will be done by appropriate means and procedures that guarantee security and confidentiality.

The processing methods of your Personal Data involve the use of manual and telematics tools, with logics that are appropriate to ensure an adequate level of security.

In particular, Personal Data may be processed in the following ways:

• Outsourcing of processing operations;
• Creating profiles for customers and suppliers;
• Data collection during events and/or exhibitions;
• Processing with electronic calculators;
• Processing with paper files.

5. Policy on the retention of Personal Data

Data Controller, in accordance with the principles of legality, purpose limitation and data minimisation, pursuant to art. 5 of GDPR, saves and processes Personal Data for as long as necessary to fulfil the stated purposes. As a general principle, therefore, the personal information will be retained for the entire period of validity of the contractual relationship with the Data Subject. Brought down the contractual relationship and, with it, its processing purposes, the Data Controller shall be entitled to maintain further personal data, in whole or in part, for certain purposes, as specifically requested by explicit law provisions or to establish or defend a legal claim.

For the purposes of marketing personal data may be kept for a period of 24 months from the granting of consent for these purposes, unless renewal thereof (expect the opposition to receive further communications). The Data Controller every two years shall request renewal of consent.

The processing and retention of digital material, such as pictures or video, will be performed until the data subjects communicate the withdrawal of consent to data processing.

6. Access to personal data and to whom these can be communicated

Pursuant to art. 6 of GDPR, without the express consent of the Data Subjects the Data Controller can disclose the Personal Data to the supervisory bodies, judicial authorities and all other persons to whom that kind of communication is required by law and to the accomplishment of the purposes of art. 3. These subjects will process Personal Data as autonomous Data Controllers.

Personal Data will not be disseminated.

Personal Data may be brought to the attention of:

1. Data Controller’s employees or collaborators, that are formally appointed and authorized to process and their receive opportune operational instructions in this regard;
2. External companies and third parties which Data Controller may make use of in relation to the managements of the contractual relationship with customers and suppliers or for its own organisational needs and its activities (e.g. IT service suppliers, consultants, agents, etc.);
3. Other companies of the El.En. Group.

7. Rights of the Data Subject

Pursuant to articles 15-22 of GDPR, the Data Subject is entitled:

1. a) To be inform of:

- source of the Personal Data;

- processing purposes and methods;

- logic applied when data are processed using electronic equipment;

- identity of the Data Controller, data processors and designated representative pursuant to article 5;

- parties or categories of parties to whom the personal data may be communicated;

1. b) To obtain:

- the updating, rectification or, where he/she wishes, the integration of the data;

- the cancellation, anonymization, or blocking of data processed unlawfully, including data that does not need to be retained for the purposes for which it was collected or subsequently processed;

- certification that the activities mentioned above, including their content, have been notified to those to whom the data was disclosed, unless this requirement proves impossible or implies manifestly disproportionate measures with respect to the protected right;

- data portability: the right to receive personal data in a structured, commonly used and automatically readable format, and to transmit such data to another data controller, only for cases where the processing is based on consent and for only data processed by electronic means;

1. c) to oppose, in whole or in part:

- for legitimate reasons, to the processing of his/her personal data, even if it is pertinent for collection purposes;

- for the purposes of this article, the Data Subject is entitled to request the cancellation, transformation into an anonymous form or blocking of data processed in violation of the law and, in any case, to abject, for legitimate reason, to their processing.

All requests must be addressed to the DPO at the following address: dpo@elen.it. Before responding the request, the DPO may ask for confirmation of the Data Subject’s identity and for information to substantiate its interaction with the Data Controller, so that he can identify the relevant Personal Data.

Insofar as the Data Subjects are provided with tools that allow the self-management of Personal Data, including the withdrawal of consent to the processing of the same, we expect such tools to be used.

8. Data transfer

Depending on the circumstances El.En. could transfer Personal Data collected through the Site to other companies of the El.En. Group or to third parties located in other countries, even outside the European Union, which does not offer the same level of protection of personal data. The European Commission puts the countries deemed “adequate”, namely those that preparing an adequate protection, in a separate list, which can be viewed at:  https://www.garanteprivacy.it/temi/trasferimento-di-dati-all-estero.

Transfers of Personal Data outside the European Union and to countries not belonging to the above list, will be carried out exclusively under specific agreements between El.En. and the companies involved, through the use of tools accepted by the European Commission.

,

Last amendment 12.4.2024