Suppliers Privacy Policy

INFORMATION NOTE REGARDING THE PROCESSING OF PERSONAL DATA IN THE MATTER OF CONTRACTS WITH SUPPLIERS IN COMPLIANCE WITH THE 2016/679 EU REGULATION (“GDPR”)

Data Controller

The Cavagna Group companies that may process the Data (as defined hereinafter) in quality of Data Controllers are:

• Cavagna Group S.p.A., with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01390980173 and Vat No. 00622330983;
• Enne.Pi. S.r.l., with registered office in Via Risorgimento 1, 25080, Calvagese della Riviera (BS). Fiscal Code: 01127410171 and Vat No. 02100760988;
• Cori Engineering S.p.A.,with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01 6067001 75 and Vat No. 00641840988;
• Kosan International S.r.l., with registered office in Via Gavardina 46/A, 25081, Bedizzole (BS). Fiscal Code: 03576660173 and Vat No. 02152100984;
• Cavagna Group Engineering S.r.l.,with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01914030174 and Vat No. 00664470986;
• Mesura Metering S.r.l., with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS), Fiscal Code and Vat No.03996920983;
• Bigas International Autogas Systems S.r.l., with registered office in Via L. Becchetti 4, 25081, Bedizzole (BS) – Italy. Fiscal Code and VAT number 05061900485.

Where the expression “Data Controller” is used in this Information Note, such expression will refer to any of the above-listed companies whose details are indicated in the purchase order received by the supplier. Consequently, it may occur that more than one of the companies of the Cavagna Group processes Data as autonomous Data Controllers.

Definition of “Data” and “Source of Data”

With “Data” we mean the information, regarding natural persons, which is processed by the Data Controller with the purpose of stipulating and executing a contractual relationship with its own suppliers. By way of example, Data may include the data of the supplier’s legal representative who signs the contract in the name and on behalf of the latter, as well as the data of the supplier’s employees/consultants who are involved in the activities described in the contract). In this latter case, the source of the Data is the supplier.

When the data retention period expires, the Data will be destroyed or anonymized, in compliance with the procedures of erasure and backup.

Provision of personal data

It is compulsory to provide the Data in order to conclude and/or execute the contract. Consequently, the refusal to provide the Data does not allow to establish a contractual relationship and/or fulfil the corresponding obligations.

As for the other categories of Data (for example the e-mail address and mobile phone belonging to the Supplier’s employee who takes care of selling), the provision is optional but the refusal to provide the Data will not allow a prompt and optimal execution of the contract.

Recipients of personal data

The Data may be communicated to external subjects operating as data controllers, by way of example, authorities and control/supervisory bodies and, in general, public or private parties legitimized to request the access to Data, auditors and legal departments.

On behalf of the Data Controller, the Data may be processed by other companies of the Group and by other external subjects appointed as data processors, who carry out specific activities on behalf of the Data Controller. By way of example these activities may be accounting, fiscal and insurance obligations, transport and postal shipping, payments and proceeds management, development, operation and maintenance of software, etc.

The list of the recipients of personal data is constantly updated and it can be easily and freely consulted by sending a written request to the Data Controller at the following e-mail address: privacy@cavagnagroup.com

Personnel authorized to process personal data

The employees of the deputed corporate functions may process the data in order to pursue the abovementioned scopes.

These employees have been expressly authorized to perform such processing and they have received adequate operative instructions.

Data transfer to extra EU countries

The Data may be transferred to extra EU Countries and, in particular, to:

1) Extra-EU countries whose data protection level has been considered adequate by the European Commission in compliance with art. 45 of GDPR”

or

2) Extra-EU countries different from those indicated at point 1) upon signing the Standard Contractual Clauses approved by the Europena Commission in compliance with art. 46, 2 letters c) and d)”

A copy of the Data may be obtained by contacting the Legal Department via e-mail at the following address: privacy@cavagnagroup.com, in accordance with the modalities described at the section “Rights of the Data Subject”.

Rights of the data subject – complaint with the supervisory authority

By contacting Cavagna Group’s Legal Department via e-mail at the following address: privacy@cavagnagroup.com, the data subjects have the right to access the Data processed by the Data Controller; furthermore they have the right to rectification and or integration of incomplete data, to erasure and also to restriction of processing in cases envisaged by art. 18 of GDPR. The data subjects can also exercise the right to oppose the processing on ground relating to his or her particular situation.

If the processing is based on consent or on a contract and is carried out by automated means, the data subjects have the right to receive the personal data concerning them, which they provided to a controller, in a structured, commonly used and machine-readable format. The data subjects shall also have the right to transmit the data to another controller without hindrance, if this is technically feasible.

The data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State of their habitual residence place of work or place of the alleged infringement.