Privacy Policy Suppliers

Information on the processing of personal data pursuant to art. 13-14 of Regulation (EU) 2016/679

Data Subjects: suppliers

ECOSTAR S.r.l. in its role as Data Controller of your personal data, pursuant to and for the purposes of General Data Protection Regulation 2016/679 hereinafter referred to as the ‘GDPR’, we hereby inform you that the aforementioned legislation provides for the protection of data subjects with regard to the processing of personal data and that such processing will be based on the principles of correctness, lawfulness, transparency and protection of your privacy and your rights.

Your personal data, and those of the natural persons who work on behalf of your company as persons in charge of the processing, will be processed in accordance with the legislative provisions of the aforementioned legislation and the confidentiality obligations provided for therein.

Purpose and legal basis of the processing: in particular, your data will be processed for the following purposes related to the implementation of obligations relating to legislative or contractual obligations:

• Management of orders and existing contracts (l.b. execution of a contract)
• Mandatory legal obligations in the tax and accounting field (l.b. legal obligation)
• defensive investigation activities to ascertain, exercise or defend a right in court (l.b. legitimate interest of the Data Controller)

The processing of functional data for the fulfilment of these obligations is necessary for the proper management of the relationship and their provision is mandatory to implement the purposes indicated above. The Data Controller also informs that any non-communication, or incorrect communication, of one of the mandatory pieces of information, may cause the Data Controller to be unable to guarantee the adequacy of the processing itself.

Processing methods: your personal data may be processed with the following methods:

• processing by means of electronic computers
• manual processing by means of paper archives

All processing takes place in compliance with the methods set out in art. 6, 32 of the GDPR and through the adoption of the appropriate security measures provided.

Communication: your data may be communicated exclusively to public bodies and offices to which the tax data must be communicated (e.g. Revenue Agencies), as well as banks and credit institutions; in case of necessity for the performance of the services requested, to competent and duly appointed parties for the performance of the services necessary for the correct management of the relationship, as consultants and service providers, with a guarantee of protection of the rights of the data subject.

Your data will be processed only by personnel expressly authorized by the Data Controller.

Dissemination: Your personal data will not be disseminated in any way.

Retention Period: Please note that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of the GDPR, the retention period of your personal data is:

• accounting and tax data: 10 years in compliance with the obligations relating to the storage of accounting and tax records (art. 2220 of the Civil Code which provides for the storage of accounting records for 10 years; art. 22 of Presidential Decree no. 600 of 29 September 1973)
• other data: 10 years from the time of termination of the effectiveness of the contract or, in the event of disputes, for the limitation period provided for by the legislation for the protection of related rights

Rights of the Data Subject

1. The data subject has the right to obtain confirmation of the existence or otherwise of personal data concerning him/her, even if not yet recorded, and their communication in intelligible form.
2. The data subject shall have the right to obtain information:
   1. the origin of the personal data;
   2. the purposes and methods of processing;
   3. the logic applied in the case of processing carried out with the aid of electronic tools;
   4. the identification details of the data controller, the data processors and the representative designated pursuant to Article 5, paragraph 2;
   5. of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representatives in the territory of the State, data processors or persons in charge.
3. The data subject has the right to obtain:
   1. updating, rectification or, when interested, integration of data;
   2. the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including those whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
   3. certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfilment proves impossible or involves the use of means manifestly disproportionate to the protected right;
   4. data portability.
4. The data subject shall have the right to object, in whole or in part:
   1. for legitimate reasons to the processing of personal data concerning him/her, even if pertinent to the purpose of the collection;
5. The data subject has the right to request the restriction of processing.

You can exercise your rights by sending an email to info@ecostarsrl.it. In addition, if the data subject believes that the processing of his or her data is contrary to the legislation in force, he or she may lodge a complaint with the Supervisory Authority for the protection of personal data pursuant to art. 77 of Regulation 2016/679 or submit a report pursuant to art. 144 of Legislative Decree no. 101/2018.