Data subjects: customers and suppliers and contact persons care of customers and suppliers
the company Loma S.p.A. (hereinafter “DataController”) with registered offices in Via G. Galilei, 12/14/16, 42046 Reggiolo (RE), Italy, in the capacity of personal data controller pursuant to and for the purposes of European Regulation 2016/679/EU (hereinafterthe “Regulation”),incompliance with Articles 13 and 14 of the Regulation provides the datasubjects with the information on the processing of their personal data,which will be based on the principles of correctness, lawfulness, transparency and protection of confidentiality and of your personal rights, in accordance with the provisions of current legislation.
Nature and type of the data collected
In the course of our business activities, we collect general personal data from customers and potential customers,suppliers,or personal data belonging to the contact persons care of these organisations with whom we have business and professional dealings.Most of the personal data we collect and use is provided directly by the data subjects, other personal data we process may come from external sources or from public sources. The data we process includes basic contact information such as first and lastname,e-mail address,telephone numbers,place and address of work,role in the company or job title, and information about the data subject's business activities. In addition, we may acquire other personal data from sales or purchase agreements, business cards, websites and social media profiles, digital or printed publications, and from the individuals themselves in the course of normal businessdealings.
Purposes and legal basis of the processing
The data will be processed for the following purposes related to the implementation of legal or contractual fulfilments, or for the execution of obligations related to contractual or pre-contractual measures:
Handling of relations with customers and suppliers and their contact persons;
Correct and complete execution of the agreement with customers and suppliers;
Execution of fulfilments mandatory by law;
Provision or supply of contracted services or products;
Managing purchases and sales and scheduling workactivities;
Retention of sales and purchase documents and those relating to the datasubjects.
The provision of data that is compulsory for the fulfilment of legislative or contractual obligations is necessary: failure to provide, or incorrect communication of, the data processed may make it impossible for the Data Controller to guarantee the appropriateness of the processing itself and the correct performance of the services for which the data isused.
The Data Controller also discloses that the legal basis of the processing could also be the exercise of its own legitimate interest, in which case the personal data could also be used for the following purposes:
Direct marketing activities for information and updates on products and services similar to those already provided by the Data Controller;
Quality management and customer and supplier satisfaction surveys;
Defence of the Data Controller or of third parties in legal proceedings;
Handling of litigation and/or debt recovery.
Processing formalities
The personal data will be processed using manual and IT procedures in observance of the formalities as per Articles 5 and 6 of the Regulation and by means of the adoption of the appropriate security measures envisaged by Article 32. The data will only be processed by authorised personnel instructed by the Data Controller pursuant to Article 29, or by third parties in their capacity as Data Supervisors for the relevant processing pursuant to Article 28 of the Regulation.
Communication
For the purposes indicated, personal data will only be communicated to parties competent to carry out the necessary services, with guaranteed protection of the rights of the data subject:
Internal companystaff;
Companies, consultants and freelancers, also in associated form, for services functional to the performance of ouractivities;
Private and/or public bodies whose communication is required bylaw;
Transport companies, post offices, logistics companies;
Banks, insurance companies, credit or debt collection companies.
Further information on the parties to whom the data may be communicated will be provided to data subjects when exercising their rights under Article 15 of the Regulation.
Dissemination and transfer outside the EU
The personal data will not be divulged in any way. The personal data will not be transferred outside Europe.
Retention
In accordance with the principles of lawfulness, purpose limitation and data minimisation, the period of retention of your personal data is established for a period of time not exceeding the achievement of the purposes for which it has been collected and processed, or for the duration of the contractual or commercial relationship, subject to any legal obligations to retain tax or legally binding documents.
EU Regulation 2016/679 - Articles 15 to 22 - Rights of the data subject
The data subject has the right to obtain confirmation of the existence or otherwise of personal data which concerns them, even if not yet registered, and communication of the same in intelligible form.
The data subject has the right to obtain indication:
of the origin of the personal data;
of the purposes and methods of the processing;
of the logic applied in the event of processing carried out with the aid of electronic instruments;
of the identifying details of the data controller,the data supervisors and the representative as per Article 5.2;
of the parties or categories of parties to whom the personal data may be communicated or who may become aware of the same in the capacity of representative appointed in Italy, data supervisor or individual in charge ofprocessing.
The data subject has the right to obtain:
the up-dating, rectification or, when they have an interest in doing so, supplementing of thedata;
the cancellation,transformation in anonymous form or the blocking of the data processed inviolation of the law, including that whose conservation is not necessary in relation to the purposes for which the data has been collated or subsequentlyprocessed;
the declaration that the operations as per letters a) and b) have been brought to the attention-also with regard to their content - of those to whom the data has been communicated or divulged, except in the cases where said fulfilment turns out to be impossible or involves the use of means manifestly disproportionate with respect to the rightprotected;
the portability of thedata.
The data subject has the right to oppose, in full or in part:
the processing of the personal data which concerns them for legitimate reasons,even if pertinent to the purpose of the collation;
the processing of personal data which concerns them for the purpose of sending advertising or direct sales material or for the performance of market research or commercial communication.
In order to exercise their rights, the data subject must contact the Data Controller at the following address: Loma S.p.A.
Registered offices: Via G. Galilei, 12/14/16 – 42046 Reggiolo (RE), Italy
The data subject also has the right to lodge a complaint, in the manner and within the time limits envisaged, with the Italian Data Protection Authority: see www.garanteprivacy.it for more information.
