Information Notice pursuant to Articles 12, 13 and 14 of EU Regulation 2016/679.
Suppliers
Pursuant to and for the purposes of the above-mentioned Regulation, concerning the “protection of natural persons with regard to the processing of personal data”, Value Group S.r.l., with registered office at Via Antonio Cechov 50/2, 20151 Milan (hereinafter the “Company”), in its capacity as Data Controller (hereinafter also the “Controller”), is required to provide certain information regarding any personal data collected from the Supplier relating to natural persons (the “Data Subjects”).
The data held by the Controller are normally collected directly from the Supplier and/or the Data Subjects, and occasionally from third parties.
In cases where the personal data of the Data Subject are not collected directly from the same, the Controller, pursuant to Article 14, letter g) of the Regulation, informs that no automated decision-making processes are in place, including profiling as referred to in Article 22, paragraphs 1 and 4.
The data are processed within the ordinary course of the Controller’s activity for the following purposes:
- Purposes strictly connected and instrumental to the agreement in force between the parties and to the fulfilment of the obligations deriving therefrom.
- Purposes connected to obligations laid down by national or supranational laws or regulations, as well as by measures issued by national or supranational bodies or authorities. These purposes include activities required to comply with anti-money-laundering regulations, where applicable.
In relation to the above purposes, the processing of personal data will be carried out so as to ensure their security and confidentiality, as well as the respect of the rights and freedoms of the Data Subjects, and may be performed through manual, IT, or electronic means suitable for storing, managing, and transmitting such data. The logic of processing will be strictly related to the stated purposes.
Providing data for the purposes referred to under point (1) is optional; however, refusal to provide them would make it impossible to manage pre-contractual and/or contractual relationships.
Providing data for the purposes referred to under point (2) is mandatory, as it is necessary to comply with legal obligations.
The processing of personal data for the purposes indicated above does not require the consent of the Data Subjects.
The legal basis for the processing is set out in Article 6, paragraph 1, letter b) of EU Regulation 679/2016.
It should be noted that, if the order assigned to us necessarily involves the processing of personal data of natural persons other than the Supplier (such as its employees, its customers, suppliers, consultants, or other counterparties), it is the Supplier’s responsibility to inform the Data Subjects and to obtain, where required, the necessary consents for the processing of their personal data by the Controller. It is understood that the Supplier’s request for the execution of the assignment shall constitute a presumption, pursuant to Article 2729 of the Italian Civil Code, that the Supplier has duly fulfilled the related information duties and obtained the necessary consent (where applicable) from the Data Subjects in favour of the Controller.
The Data Subjects’ personal data may be disclosed to the following categories of third parties:
- public authorities in fulfilment of specific legal obligations or pursuant to lawful orders;
- administrative, customs, judicial, and tax authorities, in the cases and within the limits established by law;
- consultants and/or insurers of the Controller;
- service providers.
The personal data collected and processed as described above may be disclosed to entities based or resident within the European Union, which are also subject to the Regulation. The communication of data to the above categories of recipients does not require the consent of the Data Subjects.
The personal data of the Data Subjects will be accessed by the staff appointed by the Controller for the execution of the assignment, as well as by any authorised support personnel, duly appointed pursuant to Article 29 of EU Regulation 679/2016.
Duration of Processing and Data Retention
The processing activities covered by this notice will last for the period strictly necessary to comply with the obligations imposed on the Controller by national and/or supranational legislation, as well as by the laws of countries to which the data may be transferred.
By way of example, personal data will be processed and retained for the entire duration of the contractual relationship and, subsequently, for ten years, corresponding to the ordinary limitation period.
Contact Details of the Data Controller and the Data Protection Officer
The Data Controller is Value Group S.r.l., with registered office at Via Antonio Cechov 50/2, 20151 Milan.
E-mail: privacy@valueg.com
The Data Protection Officer is Mr Paolo Recla, lawyer, domiciled for this role at the Controller’s registered office, and contactable at the certified e-mail address: paolorecla.dpo@legalmail.it
Rights of the Data Subjects (Articles 15–22 of the Regulation)
Pursuant to Articles 15 to 22 of the Regulation, Data Subjects are granted specific rights. In particular, Data Subjects may obtain from the Controller, in relation to their personal data: access (Article 15); rectification (Article 16); erasure – right to be forgotten – (Article 17); restriction of processing (Article 18); notification of rectification, erasure, or restriction (Article 19); portability (Article 20); right to object (Article 21); and the right not to be subject to automated decision-making or profiling (Article 22). Data Subject has the right to claim to the Supervisory Authority.
