INFORMATION ON THE PROCESSING OF PERSONAL DATA OF USERS WHO FILL-IN THE “CLIENT’S/SUPPLIER’S REGISTRY INSERTION/UPDATE” FORM pursuant to Article 13 of Regulation (EU) 2016/679 – GDPR
Definitions
The definitions of the terms used in this Policy are to be understood as per Article 4 of Regulation (EU) 2016/679 (hereinafter also referred to as “GDPR” for brevity).
Identification details of the Data Controller
Identity of the Data Controller:
The Data Controller is Drafinsub S.r.l., VAT number 02627860105, a single-member company subject to the management and coordination of Sparrows Holding S.r.l., with registered office in Milan, Corso Concordia no. 11, postcode 20129 (MI), in the person of its pro tempore legal representative (hereinafter also referred to as the ‘Data Controller’).
Contact details of the Data Controller:
The Data Controller may be contacted:
- by e-mail, at [email protected]
- by mail, writing to the operational headquarters in Genoa, Via Molo Giano sn, postcode 16128 (GE) – Italy.
Purpose of the Policy
Drafinsub S.r.l. hereby provides the information referred to in Article 13 of the GDPR regarding the processing of the personal data you have provided by completing the form in the “Client’s/Supplier’s Registry Insertion/Update” section of the Data Controller’s digital system.
Your personal data is processed by authorised persons, namely employees or contractors of the Data Controller, who have been identified in advance, trained and made aware of the legal obligations, and who have been granted specific access to the data for the purpose of carrying out their duties.
Purpose of processing
Your personal data will be processed for the following purposes:
-
to enter into, manage, and execute the contract between the company you represent and the Data Controller;
-
to communicate with you regarding the contractual relationship with the Data Controller;
-
to protect the rights of the Data Controller in the event of any disputes.
Legal basis for processing
The legal basis for the processing of your personal data is based on the following legal grounds:
-
for the purposes referred to in points 1) and 2) above, it is the execution of pre-contractual measures or the contract entered into between the company you represent and the Data Controller pursuant to Article 6(1)(b) of the GDPR;
-
for the purposes referred to in point 3) above, it is the legitimate interest of the Data Controller to protect its rights, both in and out of court, in the management of complaints, disputes, contractual breaches, debt recovery, the prevention and suppression of unlawful acts, as well as the protection of the legitimate rights and interests of the Data Controller and/or third parties. This legitimate interest of the Data Controller is considered to prevail over the consequent restriction of the Data Subject’s right to privacy, following the balancing exercise carried out by the Data Controller.
Retention period for personal data
Your personal data will be retained, for the aforementioned purposes, for the entire duration of the contract and, after its termination, for a further 10 years or until the expiry of the rights that may be exercised by the Data Controller through such data.
Processing methods
Your personal data will be processed using manual, IT and electronic means, in accordance with procedures strictly related to the processing purposes set out below, with the implementation of security measures designed to ensure the confidentiality of the data in accordance with current legislation and to prevent unauthorised access by third parties or unauthorised personnel.
Your personal data is processed by authorised persons, namely employees or associates of the Data Controller, who have been identified in advance, trained and made aware of the legal obligations, and to whom specific access to the data has been granted for the performance of their duties.
Recipients or categories of recipients of personal data
Your personal data may be disclosed to professional consultants who assist the Data Controller in the contract negotiation phase, who act as independent data controllers.
The company responsible for the assistance and maintenance of the Data Controller’s IT systems, appointed by the Data Controller as data processor pursuant to Article 28 of EU Regulation 2016/679, may also have access to your personal data, limited to this purpose.
Given the dynamic nature of commercial relationships, the updated list of Data Processors is available on request by writing to: [email protected].
Employees or collaborators of the Data Controller who are authorised to process data may have access to your personal data. Each person authorised to process personal data is specifically identified and trained, and acts on the basis of specific instructions from the Data Controller regarding the purposes and methods of the processing itself.
Mandatory disclosure of personal data and consequences of failure to disclose personal data
The provision of your personal data is mandatory for the conclusion of the contract between the company you represent and the Data Controller.
Failure to provide your personal data will make it impossible to proceed with the conclusion of the supply contract.
Rights of the Data Subject
The Data Controller informs you that, as a data subject, pursuant to Article 15 et seq. of the GDPR and within the limits prescribed therein, you have:
| Article | Right | Description and Details |
|---|---|---|
| Art. 15 | Right of Access | the right to obtain data and information on the processing, in particular in relation to the type of personal data processed, the purposes for which the personal data are processed, the period of processing and the subjects to whom the data are communicated. |
| Art. 16 | Right to Rectification | the right to obtain the rectification or integration of inaccurate personal data concerning you. |
| Art. 17 | Right to Erasure (Right to be Forgotten) | the right to obtain the erasure of personal data concerning you in the following cases:
However, the storage of your personal data by the Data Controller is lawful if it is necessary to enable the Data Controller to fulfil a legal obligation or to establish, exercise or defend a right in court. |
| Art. 18 | Right to Restriction of Processing | the right to obtain that personal data concerning you be only stored without being used in the following cases:
|
| Art. 20 | Right to Data Portability | the right to receive personal data concerning you in a commonly used, machine-readable and interoperable format, where such data is processed on the basis of a contract or on the basis of your consent, and/or to request that the data be transmitted to another data controller, where feasible. |
| Art. 21 | Right to object | the right to object at any time to the processing of your personal data. |
| Art. 22 | Right not to be subject to automated decision-making | the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and the right to request, on any automated decision, including profiling, human intervention on the part of the Data Controller on the automated intervention carried out by the latter, to express your opinion and to contest the decision. |
The aforementioned rights may be exercised upon request, to be sent to the Data Controller at the dedicated email address [email protected] or by writing by post to Drafinsub S.r.l., Via Molo Giano sn, 16128 Genoa (GE) – Italy.
| Article | Right | Description and Details |
|---|---|---|
| Art. 77 | Right to lodge a complaint with the supervisory authority | Without prejudice to any other administrative or judicial remedy, if you, as the data subject, believe that the processing of your personal data by the Data Controller is in breach of the provisions of Regulation (EU) 2016/679, you have the right to lodge a complaint with the Data Protection Authority (GPDP). For information on how to lodge a complaint with the supervisory authority, you can use the following contact details:Italian Data Protection Authority: Switchboard: +39 06.696771 Mail: Rome, Piazza Venezia 11 Scala B, Postcode 00187 (RM) – Italy E-m@il: [email protected] PEC: [email protected] (Note: this address is configured to recive only Certified Emails) Website: www.garanteprivacy.it |
| Art. 79 | Right to effective judicial remedy | Without prejudice to any other administrative or non-judicial remedy available, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, every data subject shall have the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of processing. |
The Data Controller reserves the right to update or amend this policy at any time in the event of regulatory, organisational or technological changes. Any amendments will be published on this webpage.
The Data Controller
Drafinsub S.r.l.