PERSONAL DATA PROCESSING NOTICE — SUPPLIERS

CATEGORIES OF DATA PROCESSED

The data controller processes the identification data of the supplier and of its contact persons, contact details, tax data and bank details, as well as the documentation required for supplier qualification and monitoring (company records, certifications, social security compliance certificates, insurance policies, licences and authorisations). For transport service providers, the identification data of drivers and their relevant qualifications may also be processed, limited to what is necessary for the performance of the service and for safety-related obligations.

​

METHODS OF PROCESSING

The data is processed both in paper form and with the aid of electronic and/or automated tools. In compliance with the applicable legislation on the matter, the data controller adopts technical and organisational measures appropriate to ensure the confidentiality, integrity, availability and accuracy of the data, as well as to prevent unauthorised access and accidental loss or destruction.

​

AUTOMATED DECISION-MAKING AND PROFILING

The data controller does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them. Any artificial intelligence applications are used exclusively to support the internal organisation of work, under the supervision of designated staff and in full compliance with the applicable legislation, including Regulation (EU) 2024/1689 (the AI Act).

​

RECIPIENTS AND CATEGORIES OF RECIPIENTS OF PERSONAL DATA

The data is processed by employees and other persons authorised to process it engaged by the data controller in carrying out its business activities, as well as by third parties designated as data processors pursuant to Art. 28 GDPR, in particular providers of IT and software development services, tax, labour and legal advisors, credit institutions and certification bodies. The data may also be disclosed to the competent authorities in compliance with legal obligations. The data is not disseminated.

​

PLACE OF PROCESSING

Personal data will generally be processed within the European Union. Certain applications of the services used by the data controller may, however, entail the transfer of personal data to the United States. Such transfer is lawful pursuant to Art. 45 of Regulation (EU) 2016/679, by virtue of the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU-U.S. Data Privacy Framework, and concerns exclusively providers certified under that Framework. Should it become necessary, the data controller reserves the right to relocate its electronic archives to other non-EU countries, ensuring that any transfer of data outside the EU will be carried out only to States capable of offering a level of protection adequate to the standards laid down by the applicable legislation, in compliance with Arts. 45, 46 and 49 of Regulation (EU) 2016/679.

​

NATURE OF THE PROVISION OF DATA

The provision of data is optional; however, failure to provide the data necessary for supplier qualification and for the performance of the contractual relationship will make it impossible to enter into or continue the supply relationship.

​

RETENTION PERIOD

The data is processed for the period necessary to fulfil the purposes set out above and, in particular:

• contractual data and data relating to the performance of the relationship: for the duration of the relationship and, thereafter, for ten years, in line with the ordinary limitation period;

• accounting and tax data: ten years from the last entry, as provided for by specific statutory provisions;

• supplier qualification documentation: for the duration of the accreditation and for the period required by the applicable certification schemes;

• data necessary for the defence of a right in legal proceedings: for the time strictly necessary and within the limits of the applicable limitation periods.

​

DATA SUBJECT'S RIGHTS REGARDING THE PROCESSING OF DATA

Pursuant to Arts. 15, 16, 17, 18, 19, 20, 21 and 77 of the EU Regulation, the data subject is hereby informed that:

• they have the right to request access to their personal data, its rectification or erasure, or the restriction of the processing concerning them, to object to such processing, and to have their data transferred to another controller in the cases provided for;

• where the processing is based on consent, they have the right to withdraw that consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal;

• any rectification, erasure or restriction of processing carried out at the data subject's request — unless this proves impossible or involves disproportionate effort — will be communicated by the data controller to each of the processors to whom the personal data has been transmitted;

• they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority's official website at www.garanteprivacy.it.

To exercise the rights set out above, the data subject must contact the data controller at the addresses indicated above. The exercise of these rights is not subject to any formal requirement and is free of charge.
 

Notice updated on 16 June 2026.