Supplier privacy

Dear Supplier,

in accordance with the provisions of EU Regulation no.679 of 2016 about Personal Data Protection and in particular art.13 of the same, the Company I.M.V. S.p.a. (Tax ID and VAT no. IT00641570254, legal headquarters in 32038 Setteville (BL), Via Feltrina 24, Tel.+39 0439 788141, Email info@imvspa.com) is the Data Controller in charge of the treatment of the personal data you will provide during the business relationship . In accordance with said regulation the Company shall process these personal data according to the principles of lawfulness, fairness, transparency, and the further principles as stated in art. 5 Reg. EU 679/2016.

Therefore, the Company provides the following information:

A) Personal Data Processing

“Processing” means, as stated in no.2 of. art.4 Reg EU 679/2016, any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

B) Purposes of Data Processing and legal grounds

Your personal data shall be processed with the purposes connected with the supply contract/agreement in force (including the payment of the invoices and connected fiscal obligations).

The legal grounds for processing your personal data come from:

• the necessity to perform the supply contract between you and the Company (letter B, comma 1^st 6 Reg EU 679/2016);
• the need to comply with a legal obligation to which the Company is subject as controller (letter C, comma 1^st, art. 6 Reg EU 679/2016);
• the legitimate interest of the controller to implement the business relationship (letter F, comma 1^st, art. 6 Reg EU 679/2016)

C) Authorized natural persons in charge of Data Processing

Your personal data may be disclosed within the Company to the persons authorized to process them by the General Manager of the Company and/or by their appointed persons.  Such persons, identified according to their area of interest and profile, will be authorized by the General Manager and their appointed persons to process Personal Data only under their direct authority and explicit instructions according to the art. 29 e 32, comma 4° Reg EU 679/2016.

D) Subjects to which the data may be disclosed – Recipients

In order to perform some activities connected to the processing of your data the Company, as Data Controller, may disclose your data to third parties providing connected, necessary or useful services as per the purposes of the processing including but not limited to:

• subjects providing specific processing and consulting services for administrative, legal and fiscal management on behalf of our Company.
• associate and subsidiary companies.
• other public or private parties in compliance with legal obligations.
• An updated list of these subjects can be requested to the Company as Data Controller. The Company will specify which of these subject act as Data Processors on behalf of the Data Controller. The Data Processors appointed by our Company undertook to implement technical and organizational measures to ensure that the processing is compliant with Reg EU 679/2016 and that your Personal Data are protected.
• Moreover, the appointed subjects undertook by countersigning a specific letter of engagement to fully comply with art. 28 Reg EU 679/2016, to act on behalf of the Data Controller and under their authority according to art.29 of the same Regulation and to notify any personal data breach according to the 2^nd comma of art.33  Reg EU 679/2016.

E) Transfer of personal data to a third country

Your personal data may be transferred to third countries. However, since it is impossible to know in advance which specific countries the data will be transferred to,  the Company undertakes to give notice of any transfer as soon as possible and anyway before it is carried on and to collect your consent or as an alternative to provide a warranty.

F) Data management

Personal data shall be processed in a manner that ensures appropriate security and confidentiality, in paper or electronic format and by computerized means.

The data may be collected by automated means with the purpose of storing, processing or transmitting them in compliance with Reg. (EU) 2016/679.

F) Rights of the data subjects; complaint with a supervisory authority and judicial remedy

The data subject shall always have the possibility to exercise the rights as per art. 15 et seq. of Reg. EU 679/2016 (access to the personal data, rectification and erasure of the same, restriction of processing, objection to processing, data portability).

Moreover, it is always possible to lodge a complaint with a supervisory authority in charge (as per art. 77 Reg EU 679/2016) or an effective judicial remedy (as per art. 79 Reg EU 679/2016) if the data subject considers that his or her rights have been infringed as a result of the processing of his or her personal data.

G) Storage period

Your personal data collected by this Company shall be stored to pursue the purposes as per lett. B for the entire duration of the relationship with you. They shall be stored also after the termination of the relationship to fulfil any obligation connected to or coming from the termination of the same, for a duration of up to 10 (ten) years from the termination. They shall be then destroyed or rendered anonymous.

H) Obligation to provide personal data

Providing your personal data is a legal and contractual obligation, a condition to close the contract. Your refusal to provide your personal data shall therefore result in the impossibility for the Company to perform the contract and correctly fulfil all the connected legal and fiscal obligations.

I) Data protection officer

The company did not designate a data protection officer because it is not mandatory according to art. 37 et seq. Reg UE 679/2016

Setteville (BL) , 01/04/2024

The Controller I.M.V. S.p.a.

In the form of its Legal Representative, Mr Claudio Gallo