personal data processing policy

this information is provided pursuant to articles 13 and 14 of european regulation no. 679/2016 (gdpr).

1) data controller

Viabizzuno s.p.a. (henceforth, Viabizzuno), represented by its legal representative pro tempore, with registered office at via romagnoli 10, bentivoglio (bo), privacy@Viabizzuno.com.

2) nature of the data processed

the personal data of the data subject, i.e. first name, surname, e-mail address, bank details and billing information, will be processed.

relevant e-mail and telephone contact details of persons acting on behalf of the supplier, which the supplier guarantees have been lawfully obtained and are accurate and up to date, will also be processed.

3) purpose and legal grounds

the personal data provided by the data subject will be processed by Viabizzuno for the purposes indicated below.

a) the purpose of executing the contract with the supplier. the personal data of the data subject will be processed in order to execute the contract between the parties and to evaluate the supplier. the legal basis for this processing is the need to execute the contract between the parties.

b) administrative, fiscal, accounting and reporting purposes. the personal data of the supplier and of the persons acting on its behalf will be processed for all activities related to administrative, fiscal, accounting and reporting obligations. the legal basis for this processing is compliance with legal obligations.

c) the purpose of protecting Viabizzuno. the personal data of the supplier and of the persons acting on its behalf may be processed for the purpose of protecting the rights and interests of Viabizzuno. the legal basis for this processing is the legitimate interest of the data controller to take action or defend its rights and interests.

4) recipients of the personal data

the appointed persons who are authorised to process data under the direct authority of Viabizzuno and the data processors and sub-processors who provide the company with specific services and with whom the company has entered into specific contracts, pursuant to article 28 of the gdpr, have access to personal data.

if the necessary conditions are met, the personal data collected by the company may be disclosed to group companies, subsidiaries and/or affiliates, as well as to professionals who act as independent data controllers and with whom the company has relations for the provision of services and the pursuit of its purposes.

all the above parties undertake to use the information received only for the processing purposes indicated above, to keep it confidential, intact and inaccessible to unauthorised third parties. furthermore, personal data may have to be disclosed pursuant to a legal or regulatory provision or in order to comply with an order by an administrative or judicial authority.

5) transfer of data

data subject to processing may be transferred outside the european union if the servers of the recipients of the data, with whom the company has entered into appropriate contracts necessary for the provision of its services, are located there. in this case, the company will take all appropriate safeguards required by european regulation 2016/679 to protect the data subject’s personal data.

6) processing methods and retention times

personal data will be processed by automated means for the time strictly necessary to achieve the purposes for which it was collected and processed.

no fully automated decision-making processes are used.

specific security measures will be observed to prevent loss of data, illegal or improper use and unauthorised access. all information collected is stored and maintained in secure facilities that restrict access to authorised personnel only.

the data will be deleted when it is no longer necessary for the purposes indicated above, with the exception of the obligation to retain the data for administrative, accounting and fiscal purposes for a period of 10 years from the date of invoicing. the data may be retained for the same period in order to assert or defend a right of Viabizzuno.

7) right of access and other rights

a data subject who is a natural person has specific rights under articles 15 to 22 of european regulation 2016/679.

article 15 gives the data subject the right to access and obtain a copy of his/her personal data. the right to obtain a copy of the data must not infringe the rights and freedoms of others.

by requesting access, the data subject has the right to obtain confirmation from Viabizzuno as to whether or not his/her personal data is being processed and to know the purposes and categories of the data being processed, the third parties to whom the data is being communicated and whether or not the data is being transferred to a non-eu country with adequate safeguards. the data subject also has the right to know how long his/her personal data will be kept for the purposes mentioned above.

with regard to his/her personal data, the data subject has the right to request the rectification of inaccurate data and the integration of incomplete data, the erasure of data (right to be forgotten) under the conditions indicated in article 17 of european regulation 2016/679, the restriction of processing and the portability of data. in order to exercise these rights, the data subject may contact the company by sending an e-mail to privacy@Viabizzuno.com or by writing to the address of the registered office of the data controller.

before replying, the data controller may need to identify the data subject by requesting a copy of his/her identity document. a written reply shall be provided to the data subject without undue delay and, in any event, no later than one month from the date of receipt of the request.

8) complaint

in the event that the data subject considers that the processing of his/her personal data violates the provisions of european regulation 2016/679, he/she has the right to lodge a complaint with the italian data protection authority, based in rome, pursuant to article 77 of the gdpr, as well as to appeal to the judicial authorities.