Geo & Tex 2000 Spa would like to provide the following information on the processing of personal data performed in compliance with EU Regulation 2016/679 (GDPR), by the Company as Data Controller.
The data controller, in conformity with ’art. 4 of the European General Data Protection Regulation 2016/679 (GDPR), is company Geo&Tex 2000 S.p.A (C.F.: 02777710241), with registered office in Valbrenta (VI), Via XXV Aprile, 3, in the person of the legal representative pro tempore. The controller can be contacted at: email@example.com
CATEGORIES OF PERSONAL DATA
Geo&Tex 2000 Spa informs that the company is the owner of the personal data collected or received, even verbally, from you or from third parties related to you, following your free and express consent, such as:
- Common personal data and / or identification data of Customers and Suppliers (name, surname, address, telephone number, fax number, fiscal code, VAT number, e-mail address, etc.) and their employees;
- Personal and contact data (such as personal data, company emails, business phones, etc.) of the contact persons of the Suppliers / Customers directly involved (administrators, partners, employees, collaborators, etc.);
- Bank data (such as IBAN code, bank and / or postal details, etc.);
- Contact and personal data of website users.
Geo&tex 2000 will not ask to provide, and will not collect, in any case, sensitive data belonging to the particular categories referred to in art. 9 GDPR.
If the required service imposes to the Data Controller the processing of data belonging to sensitive categories, the Interested Party will receive a specific notice in advance and will be requested to provide appropriate consent.
LEGAL BASIS FOR THE PROCESSING
The data collected (from Suppliers, Customer and people related to them) are necessary in order to:
|PURPOSE OF THE PROCESSING||REFERENCE TO REGULATION|
|Carry out the operations connected to the established business relationship, as well as the stipulation (including obligations arising from pre-contractual obligations), execution and conclusion of a contract.||Art. 6 subs. 1 . letter b) of GDPR (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”)|
|Manage the relationship with Suppliers or Customers for administrative activity (including the controller's ERP systems), accounting and tax, orders, shipments, billing, services.||Art. 6 subs. 1 . letter b) of GDPR (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”)|
|Fulfill national and EU regulatory obligations (including, for example, tax and fiscal rules).||Art. 6 subs. 1 . letter c) of GDPR (“processing is necessary for compliance with a legal obligation to which the controller is subject”)|
|To receive promotional communications in the future on products and services of the Holder similar to those required by contract, without prejudice to its right to oppose such communications on the occasion of each dispatch.||Art. 6 subs. 1 . letter c) of GDPR (processing is necessary for the purposes of the legitimate interests pursued by the controller also considering Art. 47 of GDPR and Art. 130 subs 4 of Italian D.lgs 196/03)|
|Manage requests for information received by contact form or by direct request sent by email to the addresses found on the website.||Art. 6 subs. 1 . letter b) of GDPR (“processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”)
Art. 6 subs. 1 . letter a) of GDPR (“The data subject has given consent to the processing of his or her personal data for one or more specific purposes;”)
|Manage company web site.||Art. 6 subs. 1 . letter a) of GDPR (“The data subject has given consent to the processing of his or her personal data for one or more specific purposes;”)|
Geo & Tex 2000 Spa does not perform profiling or systematic and regular large scale monitoring on Customers and / or Suppliers personal data.
MANDATORY OR OPTIONAL NATURE OF PROVIDING DATA
Consequences of the possible refusal.
The provision of Data for the purposes referred above is mandatory and necessary ; in fact, any refusal to provide the Supplier or Customer’s data would maket impossible for the Data Controller to sign and/or execute the contract and perform the requested services.
METHOD OF DATA PROCESSING
In relation to the aforementioned purposes, the Data Controller informs that the data is processed both in paper and electronic and / or computerized form.
In any case, the processing will take place with instruments that guarantee the security and confidentiality of the data, as well as compliance with the specific obligations expressed in the regulations.
The data will be processed in accordance with the principles of lawfulness, correctness, relevance and not excess, in accordance with the provisions of the legislation on the protection of personal data.
Data will also be processed by authorized parties pursuant to art. 29 GDPR committed to confidentiality, formally appointed and adequately trained, or by means of Data Processors formally appointed pursuant to art. 28 GDPR.
PLACE OF DATA PROCESSING
The personal data collected are processed at the registered office of the Data Controller, and to the communicated and transmitted to the subjects indicated in the previous point and to the following point.
SCOPE OF COMMUNICATION AND DIFFUSION OR TRANSFER OF DATA
Personal data could be transmitted to the personnel in charge according to the art. 29 GDPR, in carrying out their work duties.
Furthermore, the data could be transmitted to the appointed persons in charge of the processing according to the art. 28 GDPR (or possibly communicated to subjects appointed as joint controllers), with a specific contract or other legal act, which imposes on them the obligation of confidentiality and security in the processing of personal data relating to the Customers or Suppliers of the owner and, in any case, the processing will take place within the limits necessary to carry out their professional duties (for example, banking institutions, insurance companies, service providers strictly necessary for business activities - such as shipping and transport companies, company consultants, where this proves to be necessary for fiscal, administrative, contractual reasons and for needs protected by current regulations). The data may also be shared with authorities, bodies and / or subjects to whom they must be communicated pursuant to legal provisions or orders of authority. The data will not be distributed.
The periodically updated and complete list of the persons appointed as data processors can be requested from the owner by sending an email to the owner's email address.
TRANSFER OF DATA IN FOREIGN COUNTRIES
In the context and in the execution of the established relationship, the Data Controller informs that he will not transfer data to third countries out of the EU or to international organizations.
In case this will occur in the future, the processing will take place according to one of the methods permitted by the current legislation, such as the consent of the interested party, the adoption of standard clauses approved by the European Commission, the selection of subjects belonging to international programs for free circulation of data or operating in countries considered safe by the European Commission.
STORAGE PERIOD OF PERSONAL DATA
All data will be kept for the time necessary to pursue the aforementioned purposes for which they were collected (first, for the management and development of the commercial and contractual relationship), in compliance with the principle of minimization and limitation of conservation pursuant to the art. 5 GDPR.
The data will be stored to fulfill legal obligations and to pursue the aforementioned purposes in compliance with the principles of indispensability, non-surplus and relevance.
The holder will keep the data for 10 years from the termination of the contractual relationship to fulfill regulatory and / or post-contractual obligations and for the purposes of any defense in court; subsequently, once the aforementioned reasons for processing cease to exist, the data will be deleted, destroyed or simply stored anonymously. The data relating to users who fill out the contact form of the website will be kept for the time strictly necessary to fulfill the request.
RIGHTS OF THE INTERESTED PARTY
In order to guarantee a correct and transparent treatment, we inform you that you have a set of rights pursuant to articles 15-22 of the GDPR, and in particular:
|RIGHT||DESCRIPTION||HOW TO ACT|
|Right to revoke consent (Article 13, Section II, Letter A, and Article 9, Section II, Letter A)||You have the right to withdraw your consent at any time for all those treatments whose assumption of legitimacy is an expression of your consent, as indicated in the table of purposes described above.
In particular, the revocation of the consent applies to treatments carried out for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication of a promotional nature, even if carried out pursuant to art. 130 paragraph 4 of Legislative Decree 196/03.
Withdrawal of consent does not affect the legality of the previous processing.
|Request to data controller|
|Right to access Data (art. 15)||You may request a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of third countries or international organizations; d) when possible, the period of storage of personal data provided or, if this is not possible, the criteria used to determine this period; e) the existence of the data subject's right to request the data controller to correct or delete personal data or limit the processing of personal data concerning him or to oppose their processing; f) the right to lodge a complaint with a supervisory authority; g) if the data is not collected from the interested party, all available information on their origin; h) the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such treatment for the interested party. You have the right to request a copy of the personal data being processed||
Request to data controller
|Right to rectification (art. 16)||The data subject shall have the right to obtain from the rectification of inaccurate personal data||Request to data controller|
|Right to erasure (‘right to be forgotten’) (art. 17)||You have the right to obtain from the data controller the deletion of your personal data if the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed, if you revoke the consent, if there is no legitimate reason prevalent to proceed with profiling treatment, if the data have been processed illegally, if there is a legal obligation to delete them; if the data relate to web services to minors without consent. The cancellation can take place unless the right to freedom of expression and information prevails, which are kept for the fulfillment of a legal obligation or for the execution of a task carried out in the public interest or in the exercise of public powers, for reasons of public interest in the health sector, for archiving in the public interest, for scientific or historical research or for statistical purposes or for ascertaining, exercising or defending a right in court.||Request to data controller|
|Right to restriction of processing (art. 18)||You have the right to obtain from the data controller the processing limitation when you have disputed the accuracy of your personal data (for the period necessary for the data controller to verify the accuracy of such personal data) or if the processing is illegal, but You are opposed to the deletion of personal data and instead request that their use be limited or if they are necessary for ascertaining, exercising or defending a right in court, while the Owner is no longer necessary.||Request to data controller|
|Right to data portability (art. 20)||You have the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning you and you have the right to transmit it to another if the processing is based on consent, on the contract and if the processing is carried out by automated means, unless the processing necessary for the execution of a task of public interest or connected to the exercise of public authority and that such transmission does not infringe the right of a third party.||Request to data controller|
|Right to contact the Authority for the protection of personal data|
You can contact the Controller to exercise one of the above rights the email address: firstname.lastname@example.org or by registered mail addressed to Geo & Tex 2000 Spa, Valbrenta (VI), Via XXV Aprile, n. 3 in the person of the legal representative pro tempore,.
ADDITIONAL DATA PROCESSING
Any further processing of personal data other than what is indicated in this statement will be promptly communicated before the treatment itself and will be subject to the collection of consent, if included in the cases provided for by the applicable legislation.
CHANGES TO THIS INFORMATION DOCUMENT AND FUTURE
This information may be subject to changes that will be adequately communicated.
Furthermore, if this information is not sufficient for the purpose, further appropriate information will be sent.