Information for customers and suppliers on the processing of personal data
pursuant to Article 13 of the EU Regulation No. 679/2016 (GDPR)
Introduction
Azienda Agricola Rosset – Società Semplice, as Data Controller (hereinafter: “Data Controller”) pursuant to EU Regulation No. 679/2016 (hereinafter: “GDPR”) invites you, before communicating any personal data to Data Controller, to read this document carefully because it contains important information on the protection of your personal data.
For personal data, for processing and for all the other nomenclatures indicated in this information, reference must be made to the definitions set out in article 4 of the EU Regulation.
1. Subject and type of data
Azienda Agricola Rosset – Società Semplice, to manage the existing contractual relationship, will collect personal data.
If the contractual relationship is stipulated with an individual, the personal data processed will be personal data, billing data and, if necessary, shipping data.
In any case, for the maintenance of the relationship, personal data of any employees of customers or suppliers such as personal data (name and surname), company contact data (e-mail address and telephone number) and company role may be processed.
2. Purpose of the processing
The data of the data subject, in this case personal data, are collected for the following purposes:
2.1. fulfilment of contractual and/or pre-contractual obligations.
2.2. Customers and suppliers’ management.
2.3. legally required fulfilments in tax and accounting fields.
2.4. ascertaining, exercising or defending a right of the Controller in court or whenever the judicial authorities exercise their functions.
Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
3. Legal basis and mandatory or optional nature of the processing
The legal basis for the purposes referred to in sections 2.1. and 2.2. is Article 6(1)(b) of the GDPR ([…] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract […]), as the processing is necessary for the provision of services. The provision of personal data for these purposes is mandatory since failure to provide them would make it impossible to use the services provided by Data Controller.
The legal basis for the purpose referred to in section 2.3. is Article 6(1)(c) of the GDPR ([…] processing is necessary for compliance with a legal obligation to which the controller is subject […]), as the processing is necessary to fulfil legal obligations or to respond to requests from competent authorities, to which the Controller is subject. This implies that such provision of personal data is mandatory.
The legal basis for the purpose referred to in section 2.4 is Article 6(1)(f) of the GDPR ([…] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject […]), to establish, exercise or defend a right in court. The processing is mandatory, as it is necessary to satisfy the legitimate interest of the Controller.
4. Methods of data processing
Data processing is carried out with the aid of electronic tools or paper supports, in compliance with the security and data protection measures referred to in GDPR and Italian Privacy Code. The processing of personal data is carried out by Data Controller and by Data Processor designated by the company. Data processing is carried out by Azienda Agricola Rosset – Società Semplice in compliance with the principles of lawfulness, necessity and proportionality of the processing.
5. Data retention
The personal data processed for the purposes referred to in point 2 will be kept for the time strictly necessary to achieve those same purposes as well as up to the period of time envisaged and admitted by the Italian legislation for the protection of the interests and the right of defence of Azienda Agricola Rosset – Società Semplice, regarding the limitation periods established by the applicable legislation. In any case, the data in question will be kept for ten years after the last recording to fulfil tax and accounting obligations.
6. Recipients of the data
Your personal data may be shared with:
6.1. subjects that typically act as Data Processors, namely: i) consultant and freelance professionals; ii) subjects delegated to technical maintenance; iii) banks and lenders (collectively “Recipients”).
6.2. subjects, bodies or authorities to whom it is mandatory to communicate your personal data in accordance with the provisions of law or orders of the authorities.
6.3. persons authorized by Azienda Agricola Rosset – Società Semplice to process personal data necessary to carry out activities strictly related to the provisions of services, who are committed to confidentiality or have an adequate legal obligation of confidentiality and who guarantee the processing of data in accordance with the GDPR.
The complete and updated list of Data Processors is kept at the operational headquarters of Data Controller, located in Quart (AO) and can be sent by sending a written request to Data Controller at the addresses indicated in the “Data Controller and contact details” section of this document.
7. Rights of the data subject
As a data subject, you have the right to request from the Controller, pursuant to Articles 15-22 of the GDPR, the exercise of the following rights under the GDPR:
· right of access: enables the data subject to obtain confirmation as to whether or not personal data relating to him or her is being processed by the Controller and, where applicable, to access such data and information relating thereto.
· right to rectification: enables the data subject to obtain the amendment of inaccurate personal data relating to him or her without undue delay and, taking into account the purposes of the processing, to obtain the supplementation of incomplete personal data.
· right to erasure: allows the data subject to obtain the erasure of data concerning him/her without undue delay (e.g. when his/her personal data are no longer necessary in relation to the purposes for which they were collected), subject to the exceptions provided for in the applicable legislation (e.g. when the retention of data is necessary to comply with legal obligations applicable to Data Controller).
· right to restriction of processing: allows the data subject, in certain circumstances provided for by the legislation, to obtain the restriction of the processing of his/her personal data.
• right to data portability: allows the data subject, in certain circumstances provided for by the legislation, to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to the Controller.
· right to object: allows the data subject, in certain circumstances provided for by the legislation, to object to the processing of his/her personal data. In such cases, the Controller shall refrain from further processing the personal data of the data subject, unless the Controller can demonstrate the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims
IIn any case, the data subject always has the right to lodge a complaint with the Supervisory Authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the GDPR, if he or she considers that the processing of his or her data is contrary to the legislation in force.
To obtain more information on the processing of your personal data or to exercise your rights, you may contact the Controller as indicated in the section “Data Controller and contact details”.
8. Data Controller and contact details
Data Controller is Azienda Agricola Rosset – Società Semplice, with headquarters in Località Torrent de Maillod, 4 – 11020 Quart (AO).
For questions, requests or to exercise your rights, please contact us at the following e-mail address: info@rosseterroir.it or send a registered letter to our registered office.
