Privacy Notice for Customers/Suppliers

The processing of your data will be carried out by the Controller for the following purposes:

1. To conclude contracts for the Controller’s services;
2. To fulfill pre-contractual, contractual, and fiscal obligations arising from relationships with you;
3. To fulfill obligations required by law, regulation, EU legislation, or an Authority order (such as anti-money laundering regulations);
4. To exercise the Controller’s rights, such as the right of defense in legal proceedings;
5. Bookkeeping and payment of invoices, bills, as well as for all acts for which you grant us specific mandate and for other purposes strictly connected or instrumental to the management of your employment relationship with the Company (such as: for example, archiving of personal data, email address, mobile number, etc.);
6. Collaboration with external professionals outside its structure whose consultation it deems necessary for the pursuit of production purposes and business management needs;
7. Optional accounting audit and balance sheet certification;
8. The provision of data necessary for pursuing the purposes referred to in the other points is optional, and your possible refusal to respond regarding the purposes referred to in point b) has no consequences; however, such refusal would make the management of the employment relationship with you less efficient.

Categories of Subjects to Whom Data May Be Communicated

For the performance of certain activities relating to the processing of personal data, the Company may communicate your data to the following categories of external subjects:

• Customers and suppliers with whom there is a contractual relationship;
• Companies, entities, consortia, professionals who, on behalf of the Controller, provide specific processing services or perform activities connected, instrumental or supportive to those of the Controller, or activities necessary for the execution of the employment relationship and operations or services requested by you or that you will request in the future, such as, by way of example, banking institutions, insurance companies, independent consultants of the company, freelance professionals, legal and tax consultants.
• Other offices of the Company or controlling, controlled, affiliated companies or otherwise belonging to the same group, including those established abroad and outside the European Union;
• Subjects to whom the transfer of your Personal Data is necessary or otherwise functional to the performance of our Company’s activities (such as auditing and certification companies, trade associations);
• Other subjects who are granted access to your personal data by law or secondary or EU legislation (such as Public Authorities).

The subjects belonging to the categories to which the data may be communicated will use the data as “Controllers” under the law, in full autonomy, being external to the original processing carried out at our Company, or as Processors only when appointed as such by our company.
Your data will not be disseminated.

Data Processing Manager and Subjects Who May Access Personal Data

The Data Processing Manager is Bocconi Bruno, domiciled for this role at Seriplast srl.
In any case, the updated list of Managers is available to you at the headquarters of the Data Controller Company.
Consistent with the purposes indicated above, the Company’s personnel in charge of related administrative and IT management and personnel assigned to activities involving the processing of your data for one of the purposes set out in this notice (such as the Financial Director and Administration Office staff) may become aware of personal data.

The Data Protection Officer
The European Data Protection Regulation establishes the figure of the Data Protection Officer, also known as “DPO”, which must be designated in the cases provided for ex arts. 37 – 39 of the Regulation. This figure must be identified based on professional qualities and specialized knowledge of data protection law and practices.
The Data Protection Officer does not need to be designated in this company.

Profiling and Similar Processing.
The European Data Protection Regulation requires the obligation to inform data subjects in case data processing is carried out with automated procedures. If such processing is carried out, the Company must also provide meaningful information about the logic used, as well as the significance and expected consequences of such processing for the data subject. The Company does not perform data processing with automated decision-making processes.

Data Transfer to Third Countries or International Organizations.
The European Data Protection Regulation requires the obligation to inform data subjects in case of transfer of their data to Third Countries (non-EU or European Economic Area: Norway, Iceland, Liechtenstein) or International Organizations. The company, as Data Controller, informs data subjects that it does not transfer data to third countries.

Data Retention.
The data collected by the Company, for the purposes previously indicated, will be retained for the time necessary to carry out the operations for which they are acquired. The retention period will be determined based on the evaluation of the individual operation and will occur, in any case, in compliance with the principles of necessity, purpose, relevance, and non-excess sanctioned pursuant to the Regulation.

Rights under Art. 11 – 20 of the European Data Protection Regulation.
Finally, we inform you that Articles 11-20 of the Regulation grant data subjects the exercise of specific rights. The rights recognized to data subjects pursuant to Art. Article 7 of the Privacy Code remains unchanged; however, the Regulation adds further rights, such as the right to obtain confirmation from the data controller regarding the existence of personal data and to have such data made available in an intelligible form; to know the origin of the data as well as the logic and purposes on which the processing is based; to obtain the deletion, anonymization, or blocking of data processed in violation of the law, as well as the updating, rectification, or, if there is an interest, integration of the data; to object, for legitimate reasons, to the processing itself.
The European Regulation also grants the data subject the right to lodge a complaint with the supervisory authority, the right to withdraw consent at any time, and the right to data portability. To exercise these rights, you may contact our Company directly at its registered office located at Via Colombaia, 1/11 50031 Barberino di Mugello (FI) by mail or via certified email at seriplast@legalmail.it