INFORMATION TO CUSTOMERS AND SUPPLIERS FOR THE PROCESSING OF PERSONAL DATA

Pursuant to EU Regulation no. 679/2016 (GDPR) and Legislative Decree no. 196/2003 as amended. and in relation to personal data concerning you and which will be processed, we inform you of the following.

  1. PERSONAL DATA PROCESSED, PURPOSE and legal basis OF THE PROCESSING

Personal data  (“Data”) means data relating to natural persons processed by CASEIFICIO DEFENDI LUIGI SRL for the stipulation and execution of the contractual relationship with its customers/suppliers, such as those of the legal representative of the customer/supplier who signs the contract in the name and on behalf of the latter, of the employees/consultants of the customer/supplier involved in the activities referred to in the  contract, as well as any other information necessary for the execution of the contract and/or the provision of the service. 

In particular, said Data shall be processed for the purposes indicated below. 

  1. Management of the contractual/commercial relationship, such as: satisfaction of specific requests of the customer/supplier before the conclusion of the contract; conclusion, modifications, execution of the contract; provision and management of related services; management of complaints.

The legal bases of the processing in relation to the aforementioned purposes are: 

    • the fulfilment of contractual obligations and/or execution of pre-contractual measures adopted at the request of the interested party, for contracts stipulated directly with the interested party;
    • the legitimate interest (to manage and execute the contract) for the processing of data of the employees /consultants of the supplier/customer involved in the activities referred to in the contract.  
  1. Administrative – accounting, such as: invoicing; management of payments, delays and non-payments; communication of the Data between group companies, for organisational, administrative, financial and internal accounting purposes functional to the aforementioned activities. 

The following is the legal basis of the processing in relation to the aforementioned purposes 

    • the need to comply with the legal obligation to keep accounts;
    • the fulfilment of contractual obligations, for contracts stipulated directly with the interested party. 
  1. Fulfilment of legal obligations under national or European Union law or collective bargaining agreements in accordance with national law, such as: fulfilment of obligations under EU and national regulations, in particular regarding health and safety at work and crime prevention (e.g. anti-mafia, anti-corruption legislation, Legislative Decree 231/2001).  The legal basis of the processing is the need to fulfil a legal obligation to which the data controller is subject.
  2. Exercise and/or defence of legal and credit recovery rights, such as: management of any litigation, protection and recovery of credits, directly or through third parties (lawyers / agencies / credit recovery companies).   The legal basis of the processing is legitimate interest. 

2. RETENTION PERIOD 

The data shall be processed for the duration of the contractual relationship and, after its termination, until the limitation period of the mutually arising rights between the parties. In the case of judicial litigation, for the entire duration of the same, and until the conclusion of the decision-making process.

  1. DATA PROCESSING METHODS

The processing of personal data may be carried out with the aid of both analogue and electronic or automated means, with methods and procedures strictly necessary for the pursuit of the above-mentioned purposes.

  1. Scope of communication, subjects authoriSed to process data

The Data may be disclosed to external parties operating as independent data controllers, such as public or private parties entitled to process the Data (e.g. public authorities,  banks and  credit institutions, accountants, notaries, lawyers and other professionals).  The Data may be processed, on behalf of the controller, by external parties designated as data processors, who carry out specific activities on behalf of the controller, for example, its distribution network, companies and agents that carry out debt collection activities for the controller, legal, tax and administrative consultants. The Data may be processed by employees of the company departments responsible for pursuing the above-mentioned purposes, who have been expressly authorised to carry out the processing and who have received adequate operating instructions. The Data is not subject to disclosure.

  1. Provision of Data

Any refusal by the interested party to provide personal data may make it impossible (partial or total) to fulfil legal obligations, or to stipulate or correctly execute the contract or service. In this case, without prejudice to the right of the interested party not to provide its data, the Data Controller reserves the right to suspend, interrupt or not establish the contractual relationship. 

  1. Data controller 

The data controller is CASEIFICIO DEFENDI LUIGI SRL, with registered office in 24043 Vidalengo – fraz. di Caravaggio (BG), Via Francesca, 82, Tax Code and VAT no. 01627260167.  The controller may process the data directly, through its employees authorised to do so, or using external collaborators, who in this case assume the status of Data Processors.  The updated list of Data Processors is made available by the Data Controller upon request.

  1. Rights of the interested party

The legislation on the protection of personal data (articles 12-22 of EU Regulation 679/2016) guarantees the interested party the right to be informed about the processing of data and the right to access the data at any time and to request its updating, integration and correction.  Where the conditions provided for by the law are met, the interested party may also claim the right to the deletion of the Data, to the limitation of its processing, the portability of the Data, the opposition to the processing and not to be subjected to decisions based solely on automated processing. If the processing  of personal data is based on the consent of the interested party, the latter has the right to revoke the consent given. To exercise its rights, as  well as for more detailed information about  the processing of data,  the interested party can contact CASEIFICIO DEFENDI LUIGI SRL by writing to the following e-mail address: [email protected].  If the interested party considers its rights to have been violated, the interested party may protect itself by lodging a complaint before the Data Protection Supervisory Authority.

  1. PROCESSING OF THIRD-PARTY DATA

The customer/supplier is informed that, if it makes use of its employees or collaborators (including any subcontractors) to execute the contractual relationship, the personal data of the latter may be processed by CASEIFICIO DEFENDI LUIGI SRL, always as the data processor, for the purposes referred to in point 1.  This processing has the same purposes, methods and retention times as the data described in this statement; moreover, in relation to this processing, the interested parties have the same rights defined in point 7. The customer/supplier has the burden of correctly informing its employees and collaborators about the above-mentioned processing, also by giving this privacy policy to them.