PRIVACY POLICY

Privacy information sheet regarding the processing of personal data of customers/suppliers and their representatives pursuant to Reg. EU 2016/679 – G.D.P.R. General Data Protection Regulation Art.12, 13, 14

GENERAL INFORMATION

We inform all those involved in the processing (customers, suppliers, stakeholders in general) and their representatives (hereinafter "interested parties", ex Art.4, p.1 of the GDPR)) that the professional relationships established with the undersigned Holder may involve the processing of personal data, in compliance with the following general principles:

  • all data are processed in a lawful, correct and transparent manner in relation to the party concerned, in compliance with the general principles set out in Article 5 of the GDPR;
  • specific safety measures are observed to prevent data loss, illicit or incorrect use and unauthorized access;

·         the Data Controller is the undersigned Company (Synthesis S.p.A., via Bianconese, 118 - 43010 Fontevivo PR) ·         the Data Controller may be applied to in order to exercise all the rights provided for by Article 15-21 of the GDPR (right of access, rectification, cancellation, limitation, opposition, right to portability), as well as to revoke a consent previously agreed or propose a complaint to the Data Protection Authority.

 

SUBJECT OF THE PROCESSING

The Data Controller processes personal identification data of the customer/supplier (for instance, name, surname, company name, personal/fiscal data, address, telephone, email, bank and payment details) and of their operational representatives (name, surname and data contact information) acquired and used in the provision of services provided by the Data Controller.

PURPOSE AND LEGAL BASIS OF THE PROCESSING

Data are processed for:

completing contractual/professional relationships;

  • fulfilling the pre-contractual, contractual and tax obligations deriving from existing relationships, as well as managing the necessary communications connected to them;
  • fulfilling the obligations established by law, by a regulation, by the community legislation or by an order of the Authority;
  • exercising a legitimate interest and a right of the Controller (for instance: the right of defense in court, the protection of credit positions, the ordinary internal needs of an operational, managerial and accounting nature).

 

Failure to provide the aforementioned data will make it impossible to establish the relationship with the Controller. The aforementioned purposes represent, pursuant to Article 6, paragraphs b, c, f, suitable legal bases for the lawfulness of the processing. If it is intended to carry out the processing for different purposes, a specific consent will be required from the parties concerned.

PROCESSING METHOD

Personal data are processed by means of the operations indicated in Art. 4 n. 2) GDPR and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Personal data are subjected to both paper and electronic and/or automated processing. The Data Controller will process personal data for the time necessary to fulfill the purposes for which they were collected and their relevant legal obligations.

SCOPE OF THE PROCESSING

Data are processed by internal subjects regularly authorized and instructed pursuant to Article 29 of the GDPR. The scope of communication of personal data can be also requested, obtaining precise information on any external subjects operating as independent Data Holders or Data Controllers (consultants, technicians, banks, transporters, etc…). We also inform you that personal data may be the subject of intercompany communication between the Group companies. Data are not subject to diffusion or transfer to non-EU countries. Should it be necessary to acquire personal data of their employees from customers/suppliers  in the context of tenders/contracts or in the performance of regulatory obligations (e.g. joint liability, anti-corruption, anti-mafia, anti-money laundering, etc…), it is agreed between the parties that the undersigned company shall be entitled to the processing as external Holder (Art.28 GDPR) or as authorized subject (Art.29 GDPR). Within this relationship, the undersigned company shall undertake to process such data abiding by the compliance requirements established by the GDPR, guaranteeing any communication to other parties exclusively within the scope of specific legal obligations.