Privacy Policy and Protection of Personal Data pursuant to EU Regulation 2016/679 (GDPR)
PREMISE
Pursuant to Article 13 of EU Regulation 2016/679 (hereinafter also GDPR) and, as far as applicable, Legislative Decree 196/2003 (Italian Privacy Code), the undersigned Company, Systematica S.p.A., in the person of its legal representative, with registered office in Milan (MI), Via Lovanio 8, Tax Code and VAT number 03040720165, (hereinafter also the “Company” or “Data Controller”) in its capacity as Data Controller of personal data, informs you that the personal data relating to your staff or your contact persons, processed on the occasion of contractual relationships established or being established with our company (hereinafter referred to as the “Data”), will be processed as follows.
A. Data Controller and Data Processor
The Data Controller is the undersigned Company, Systematica S.p.A., in the person of its legal representative, with registered office in Milan (MI), Via Lovanio 8, Tax Code and VAT number 03040720165 (hereinafter also the “Company” or “Data Controller”), which you can contact at the following email address: milano@systematica.net
B. Purposes of processing and categories of personal data
The processing of your personal data by the Company takes place for the provision of our services.
Specifically, your personal data will be processed exclusively for the following purposes:
• management of contacts, sending of offers, quotes and commercial and technical documentation;
• establishment, execution and management of professional assignments;
• fulfilment of legal, accounting and tax obligations related to the assignments;
• management of litigation, including in or out of court.
C. Legal basis of the processing
The legal basis that legitimizes the processing of the data provided is, as the case may be, the following:
a) the execution of pre-contractual and contractual measures pursuant to Article 6, paragraph 1, letter b) GDPR;
b) the fulfilment of legal obligations pursuant to Article 6, paragraph 1, letter c) GDPR;
c) the legitimate interest of the Data Controller (e.g. for legal protection, security, efficient business management) pursuant to Article 6, paragraph 1, letter f) GDPR.
D. Categories of data processed
Within the scope of the purposes described above, we may process the following categories of personal data:
• identification data: name and surname (also of the company contact person), company name, VAT number, etc.;
• contact data: telephone number, email address, address of the headquarters;
• contractual and banking data (IBAN, commercial conditions, payment methods, etc.);
• financial data;
• tax and accounting data.
E. Protection of your data and any recipients of your data
Your personal data will be processed by our staff, specifically authorized and trained in the processing of such data and, in any case, under the responsibility of the Data Controller and exclusively for the purposes for which your data were collected.
Your personal data are stored by our Company and may be communicated or transmitted to third parties only for the purposes mentioned above, subject to verification of the adequacy of the supplier, who must offer, in any case, the same guarantees regarding data processing as our Company.
Personal data may, in particular, be communicated to:
• consultants, professional firms, accountants, IT companies or management service providers;
• credit institutions, couriers, carriers and insurance companies;
• Public Authorities, Inspection Bodies, where required by applicable legislation.
The Company may, however, be obliged, in some cases, to transmit your personal data, in whole or in part, to third parties due to legal obligations, legal proceedings of any kind or kind and/or requests from public authorities.
F. Transfer of data to third countries
The Company does not transfer your data to third countries or to International Organizations without your prior and express consent.
The transfer of data outside the EEA area is not envisaged, except for compliance with the guarantees provided for by art. 44 et seq. GDPR.
G. Personal data retention period
Your personal data are stored for the time strictly necessary to achieve the purposes described above and, at the latest, until the limitation period provided for by law.
In relation to data for which the legal basis for processing is your consent, you have the right to withdraw this consent at any time, without prejudice to the lawfulness of the processing carried out by the Data Controller and based on the consent you provided before its withdrawal.
On some occasions, the Company may retain your data even after this period, to the extent strictly necessary and indispensable for the issuance of certifications and/or documents that may be requested by private individuals or public bodies, for the achievement of the other purposes for which the data were collected or to allow our Company to exercise and/or assert a right or to defend itself in court.
H. Rights of the data subject
With respect to your personal data, you can exercise the following rights:
1. right of access to personal data; the right to obtain the rectification or erasure of the same or the limitation of the processing concerning them (Articles 15 – 18 GDPR);
2. right to object to processing pursuant to Article 21 of the GDPR;
3. right to data portability, in relation only to data in electronic format, within the limits established by art. 20 of the GDPR.
With regard to data for which the legal basis for processing is your consent, you are entitled to withdraw said consent at any time, without prejudice to the lawfulness of the processing carried out by the Controller and based on the consent you provided before withdrawal.
I. Complaint
We inform you that you have the right, if the conditions are met, to lodge a complaint with the territorially competent Supervisory Authority, as identified by art. 3, 55 and 56 GDPR.
For further information and more information, please visit the institutional website of the Italian Data Protection Authority (www.gpdp.it)
J. Communications and provision of data
It is possible that the communication of your personal data may constitute a legal obligation and/or a contractual obligation and, in any case, a necessary requirement for the conclusion and execution of the commitments undertaken by our Company.
In these cases, failure to provide data by you may make it impossible for our Company to follow up on your requests.
K. Profiling
The Company does not use automated processes aimed at profiling.