Information for suppliers

SUPPLIERS – PROCESSING OF PERSONAL DATA INFORMATION pursuant to Art. 13 EU Reg. 679/2016

Zero Branco (TV),  10/25/2022

Dear Mr/Mrs.
Pursuant to EU Regulation 679/2016, with reference to the processing of your personal data, the undersigned Company L’ORTOLANA S.A.S. (fiscal code and VAT number 02421580263, with registered office in Via Scandolara 126, 31059 Zero Branco (TV) Tel. 0422 345033 Email info@lortolana.com) inform you that, in relation to the relationship with you, the undersigned Company will be the Data Controller of your personal data.

In accordance with the current regulations in force, the processing of your personal data that our company will carry out will be based on the principles of lawfulness, correctness, transparency and the further principles set out in Art. 5 EU Reg. 679/2016. The undersigned Company therefore provides you with the following information

A) Processing of personal data

‘Processing’ means, pursuant to num. 2 of Art 4 EU Reg 679/2016, any operation carried out with or without the help of automated processes and applied to personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction.

B) Purpose of processing.

Your personal data will be processed for the purposes of the existing contract/agreement with you (including payment of invoices and related tax obligations).

C) Processors

Your personal data may be disclosed to all subjects specifically identified as “Data Processors” by the Data Controller. The Data Processors, identified according to the scope and profile assigned to each, shall act only upon authorisation by the Data Controller and Data Processors appointed by him and, in compliance with the provisions of Articles 29 and 32, paragraph 4 of EU Regulation 679/2016, shall process your data only after having been instructed to do so by the Data Controller, acting under the latter’s direct authority.

D) Persons to whom the data are disclosed

In order to carry out certain activities relating to the processing of your personal data, the undersigned Company, in its capacity as Data Controller, may disclose your data to subjects who carry out activities connected with, useful or necessary to the performance of the employment relationship and of the operations or services that you may request or that you will request in the future, such as, by way of example but not limited to:

  • parties that provide specific processing services or business, legal or tax/tax consultancy;
  • other entities, public or private, for the fulfilment of legal obligations.

An up-to-date list of these subjects can be requested from the Company as Data Controller. The Company will be able to indicate which of these subjects are acting as “Data Processors”, carrying out processing on behalf of the Controller. The Data Processors chosen by our Company have undertaken to implement appropriate technical and organisational measures so that the processing meets the requirements of EU Reg 679/2016 and guarantees the protection of your personal data.
The Responsible Persons have also committed themselves, by a specific deed, to fulfil all specific obligations under Art. 28 EU Reg 679/2016 and to act, pursuant to Art. 29 of the same Regulation, under the authority of the Data Controller and subject to his instructions, as well as to notify the Data Controller (pursuant to the second paragraph of Art. 33 EU Reg 679/2016) of any breaches of your personal data.

 E) Transfer of data abroad

Your personal data will not be transferred abroad.

F) Treatment modalities

he data will be processed, in such a way as to guarantee their security and confidentiality, with the support not only of paper materials but also of computerised or telematic materials.
The processing may also be carried out by means of automated tools designed to store, manage or transmit the data, and this in any case in compliance with the provisions of EU Reg. 679/2016.

G) Rights that may be exercised by the data subject; complaint to the Supervisory Authority and judicial review

You can always exercise your rights under Articles 15 ff. of EU Regulation 679/2016 (access to personal data, rectification or erasure of personal data, restriction of processing, objection to processing, data portability) vis-à-vis the data controller.
In addition, it is always possible to lodge a complaint with the competent supervisory authority (pursuant to Art. 77 EU Reg 679/2016) or a judicial remedy (pursuant to Art. 79 EU Reg 679/2016) if the Data Subject considers that his or her rights have been violated as a result of processing.

H) Data retention period

Your personal data collected by the undersigned Company will be kept by it, for the pursuit of the purposes referred to in point B, for the entire duration of the relationship with you. They will also be kept after the termination of the relationship for the fulfillment of any obligations connected or deriving from the conclusion of the relationship, and for a maximum of 10 (ten) years from the end of this. They will then be destroyed or anonymised.

I) Mandatory supply of personal data and legal bases

The undersigned Company informs you that the provision of your personal data constitutes a contractual obligation, since such provision is a necessary requirement for the conclusion of the contract; any refusal to provide your personal data would therefore make it impossible for the Company to execute the contract and correctly perform all related legal obligations, such as those of a fiscal nature.
The legal bases justifying the processing of your data are:

  • by the need to execute the contract with you (legal basis under letter B, paragraph 1, Art. 6 EU Reg 679/2016);
  • by the need to fulfil legal obligations to which the company is subject (legal basis under C(1), Art. 6 EU Reg. 679/2016);
  • by the legitimate interest of the Controller in the proper management of the relationship (legal basis under F(1), Art. 6 Reg EU 679/2016);

L) Data Protection Officer

The undersigned Company has not appointed its own DPO, pursuant to Art. 37 ff EU Reg. 679/2016, because it is not obliged to do so.