Client and Supplier Privacy Notice

Privacy notice for clients and suppliers issued by Promoservice Parma S.r.l. under Articles 13 and 14 of European Regulation 2016/679

Pursuant to Articles 13 and 14 of GDPR 2016/679, client companies, supplier companies, third parties and their relevant contacts (hereinafter 'data subjects', under Article 4(1) of the GDPR) are informed that professional relationships established with this company may involve the processing of personal data in accordance with the following general principles:

all data is processed lawfully, fairly and transparently in relation to the data subject, in accordance with the general principles in GDPR Article 5;
specific security measures are applied to prevent data loss, unlawful or improper use, and unauthorised access;
the Data Controller is Promoservice Parma Srl, with its registered office at Viale Mentana 92, Parma, represented by its current legal representative;
Promoservice Parma Srl may be contacted to exercise all rights under GDPR Articles 15–21 (access, rectification, erasure, restriction, portability and objection), withdraw previously given consent or lodge a complaint with the data protection supervisory authority;
Promoservice Parma Srl may act as processor for processing required by service clients, who act as controllers and may be contacted to exercise all the rights mentioned above;
Promoservice Parma Srl has appointed a Data Protection Officer, who may be contacted to exercise all rights under GDPR Articles 15–21: access, rectification, erasure, restriction, portability and objection, withdrawal of previously given consent, or lodging a complaint with the data protection supervisory authority. Contact: privacydpo@promoserviceparma.it

a) Subject of processing

The Controller processes identifying personal data of client companies, supplier companies and/or third parties in relationships with data controllers (for example, first name, surname, company name, personal and tax details, address, phone number, email, bank and payment details), as well as their operational contacts' names and contact details, collected and used in providing this company's services.

b) Purposes and legal basis for processing:

Data is processed to:

conduct and conclude contractual or professional relationships;
fulfil pre-contractual, contractual and tax obligations arising from existing relationships, and manage the related communications;
fulfil obligations under laws, regulations, EU rules or an authority's order
pursue a legitimate interest or exercise the Controller's rights, such as defence in legal proceedings, protection of creditor positions and ordinary internal operational, management and accounting needs. Failure to provide this data will prevent a relationship with this company from being established. Under GDPR Article 6(1)(b), (c) and (f), these purposes constitute valid legal bases for processing. Any processing for other purposes will require specific consent from data subjects.

c) Methods

Personal data is processed through the operations listed in GDPR Article 4(2), including collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction. Processing takes place on paper and electronically or automatically. All data is processed lawfully, fairly and transparently in relation to the data subject, in accordance with GDPR Article 5. Specific security measures prevent data loss, unlawful or improper use, and unauthorised access.

d) Scope of processing

Data is processed by duly authorised and trained internal personnel pursuant to GDPR Article 29. You may also request details of the disclosure of personal data, including precise information about external parties acting as processors or independent controllers (client companies acting as controllers, consultants, technicians, banks, carriers, etc.). Data is not made public or transferred outside the EU. If, in connection with tenders or contracts or compliance with legal obligations (such as joint liability, anti-corruption, anti-mafia or anti-money-laundering requirements), it becomes necessary to obtain personal data about employees of clients or suppliers, the parties agree that this company will be entitled to process it as an external processor (GDPR Article 28) or authorised party (GDPR Article 29). Within that relationship, this company undertakes to process the data in accordance with GDPR compliance requirements and to disclose it to any further parties solely where required by specific legal obligations.

e) Data retention period

Data will be retained for the period strictly necessary to fulfil the data subject's requests, or as required by current regulations or applicable contractual terms.

At any time, the data subject may exercise the right to:

request confirmation of whether personal data concerning them exists.
obtain information about processing purposes, personal data categories, recipients or categories of recipients to whom data has been or will be disclosed, and, where possible, the retention period.
obtain rectification and erasure of data.
obtain restriction of processing.
obtain data portability: receive data from a controller in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance.
object to processing at any time, including processing for direct marketing purposes where previously consented to.
lodge a complaint with the Italian Data Protection Authority.