Suppliers Policy
This policy is provided to suppliers, in the form of legal persons, and to natural persons operating in the name and on behalf of suppliers, in the form of legal persons, of the company, OFFICINE AMBROGIO MELESI & C. S.r.l., pursuant to Italian Leg. Decree 196/2003 “Personal Data Protection Code” and subsequent amendments and articles 13 - 14 of Regulation EU 2016/679 “European Regulation on the protection of natural persons with regard to the processing of personal data” to inform them of the essential elements about the processing carried out.
Data Controller
The Data Controller is the company, OFFICINE AMBROGIO MELESI & C. S.r.l., with offices in Italy, Cortenova (LC) Largo De Vecchi No. 11, in the person of the pro tempore legal representative.
Data processors and appointees
The updated list of the data processors and appointees is kept at the offices of the data controller.
Type of data collected
The data collected are personal and physical data of the legal and natural persons who operate in the name and on behalf of suppliers, in the form of legal persons, in carrying out and managing contractual relationships.
Data source
The personal data are those provided by the data subject during:
- requests for information and quotes;
- completion or fulfilment of a contract.
Purpose of the processing
The personal data are collected and processed for the purpose of:
- fulfilling all the operations required by regulatory obligations;
- carrying out operations strictly connected and related to the initiation of contractual relationships, including the acquisition of preliminary information to complete the contract;
- exchanging information aimed at executing the contractual relationship, including post-contractual activities and the management of any litigation;
- managing relations with the supplier for administrative and accounting activities, orders, shipping, invoicing or services;
- sending out communications of various types and with different methods of communication, and formulating requests.
The personal data duly collected will be processed in compliance with the principles of fairness, lawfulness, transparency and safeguarding the confidentiality and rights of the data subject, in accordance with art. 5 of Regulation EU 2016/679.
Processing method
The data processing for the above-mentioned purposes will be carried out both by automated methods, on electronic or magnetic supports and by non-automated methods on paper, in compliance with the rules for confidentiality and security laid down by the European and Italian regulation.
Mandatory and optional nature of data provision
Some data are essential for entering into the contractual relationship or for fulfilling it while others may be deemed accessories to these purposes. All the data requested are considered mandatory unless otherwise specified.
Refusal to provide the data
The data subject can refuse to provide personal data to the data controller or revoke his/her consent.
If the provision of data, however, is required due to a legal or contractual obligation, any refusal or revocation of the provision will result in the data controller being unable to execute or continue the contract, for reasons not attributable to the latter.
Data recipients
The personal data processed by the data controller will not be disclose, i.e. they will not be brought to the attention of unknown parties, in any possible form, including making them available or for simple consultation. They may, however, be communicated to employees of the data controller and some external parties working in partnership with the data controller. They may also be communicated, within the strictly necessary limits, to parties who, for the purpose of issuing orders or requests for information or quotes, must provide goods and/or perform services. Lastly, they may be communicated to parties who are authorised to access them by virtue of the provisions of the law, regulations and EU regulations.
In particular, on the basis of the roles and tasks performed, some workers are authorised to process personal data, within the scope of their responsibilities and in accordance with the instructions given to them by the data controller.
Data storage time
The data provided will be stored in our archives and processed for the time required to fulfil the purposes indicated herein. Subsequently, the personal data stored and no longer processed, will be stored for the time laid down by the current provisions on civil and fiscal matters.
Data storage place
The data are currently processed and stored at the registered and operational headquarters of the data controller in Italy, Cortenova (LC) Largo De Vecchi no. 11.
They are also processed on behalf of the data controller by professionals and/or companies appointed to carry out technical, management, development, administrative, accounting, fiscal and legal activities, etc.
The data subject’s rights
The data subject shall, at any time, under Italian Leg, Decree 196/2003 and subsequent amendments and articles 15 to 22 of Regulation EU 2016/6791, have the right to:
- Accessing your data. The data subject shall have the right, at any time, to request and obtain from the data controller, information on the personal data processed (including confirmation as to whether or not personal data concerning him or her are being processed). He/she also has the right to access these data under article 15 of Regulation EU 2016/679 and extract a copy, provided that the rights and freedoms of others are not infringed.
- Verifying and rectifying your data. The data subject has the right to verify the accuracy of his/her data, to update, correct and integrate any inaccurate personal data concerning him/her, without undue delay, under article 16 of Regulation EU 2016/679.
- Obtaining erasure (Right to be forgotten). If the conditions indicated under art. 17 of Regulation EU 2016/679 exist, the data subject shall have the right to request the erasure of his/her data by the data controller.
- Obtaining restriction of the processing. If the conditions indicated under art. 18 of Regulation EU 2016/679 exist, the data subject shall have the right to request the restriction of data processing. In this case, the data controller shall not process the data for any purpose, with the exception of storage or for“for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State”.
- Obtaining data portability. The data subject has the right to receive his/her data in a structured, commonly used and machine-readable format and, where technically feasible, have the right to request and transmit those data to another controller without hindrance.
- Objecting to data processing. When the personal data are processed for the purposes of “the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” or “the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”, the data subject shall have the right to object to the processing on grounds relating to his or her particular situation. The data subject shall also have the right to object to the processing, at any time for direct marketing purposes, without the need to indicate specific reasons.
- Lodging a complaint. If the data subject considers that the processing of personal data relating to him or her infringes Regulation EU 2016/679, “he/she shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”.
- Objecting to automated decision-making. The data subject shall have the right to object to the processing of his/her personal data wholly by automated means, including profiling, unless this form of processing is required to complete and/or fulfil the contract, is required by current legislation or carried out following the explicit consent of the data subject, who shall have the right to revoke it at any time.
- Revoking consent at any time. The data subject shall have the right to revoke consent to the data processing at any time. Revocation of consent does NOT, however, affect the lawfulness of the processing based on the consent given before the revocation;
The data subject can exercise his/her rights by writing to the data controller at the address indicated above either by certified email or by letter to the following address gdpr@melesi.it, specifying the reason for the request, the right that he/she intends to exercise and attaching a photocopy of his/her identity card which proves the legitimacy of the request.
Data transfer
For all the purposes indicated in this statement, personal data of a common nature related to the data subject will not be disclosed to any of the companies belonging to the group, subsidiaries, associated, etc., including those located abroad, inside and outside the European Union, in compliance with the rights and safeguards provided for by current legislation, subject to verification that the country in question guarantees an “appropriate” level of protection. The data controller hereby reserves the right to use cloud services, ensuring that the suppliers of the service are selected from those who supply suitable safeguards, as per article 46 of Regulation EU 2016/679 “European Regulation on the protection of personal data”.
Automated decision-making processes
The data controller does not carry out automated decision-making processes on the data of natural persons who operate in the name and on behalf of the suppliers.
OFFICINE AMBROGIO MELESI S.r.l. recommends that you inform the data subjects (e.g. directors, employees and partners whose data the company receives for the purpose of executing the contract) about the content of this policy.