INFORMATION NOTE REGARDING THE PROCESSING OF PERSONAL DATA IN THE MATTER OF CONTRACTS WITH SUPPLIERS IN COMPLIANCE WITH THE 2016/679 EU REGULATION (“GDPR”)

This Privacy Policy entered into force on 25 May 2018. Last modified: 17 December 2021

We reserve the right to amend this Privacy Policy in full or in part, or to update its content for example in case of changes in applicable law. We therefore invite you to regularly visit this page in order to be aware of the latest, updated version of this Privacy Policy.

person icon

Data Controller

The Cavagna Group companies that may process the Data (as defined hereinafter) in quality of Data Controllers are:

  • Cavagna Group S.p.A., with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01390980173 and Vat No. 00622330983;
  • Enne.Pi. S.r.l., with registered office in Via Risorgimento 1, 25080, Calvagese della Riviera (BS). Fiscal Code: 01127410171 and Vat No. 02100760988;
  • Cori Engineering S.p.A.,with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01 6067001 75 and Vat No. 00641840988;
  • Kosan International S.r.l., with registered office in Via Gavardina 46/A, 25081, Bedizzole (BS). Fiscal Code: 03576660173 and Vat No. 02152100984;
  • Cavagna Group Engineering S.r.l.,with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS). Fiscal Code: 01914030174 and Vat No. 00664470986;
  • Mesura Metering S.r.l., with registered office in Via Statale 11/13, 25011, Ponte San Marco di Calcinato (BS), Fiscal Code and Vat No.03996920983;
  • Bigas International Autogas Systems S.r.l., with registered office in Via L. Becchetti 4, 25081, Bedizzole (BS) – Italy. Fiscal Code and VAT number 05061900485.

Where the expression “Data Controller” is used in this Information Note, such expression will refer to any of the above-listed companies whose details are indicated in the purchase order received by the supplier. Consequently, it may occur that more than one of the companies of the Cavagna Group processes Data as autonomous Data Controllers.

personal data

Definition of “Data” and “Source of Data”

With “Data” we mean the information, regarding natural persons, which is processed by the Data Controller with the purpose of stipulating and executing a contractual relationship with its own suppliers. By way of example, Data may include the data of the supplier’s legal representative who signs the contract in the name and on behalf of the latter, as well as the data of the supplier’s employees/consultants who are involved in the activities described in the contract). In this latter case, the source of the Data is the supplier.

goal

Purposes of the processing

data sheet

Legal basis for the processing

clock

Data retention period

Creation and execution of a contractual relationship between the supplier and the Data Controller.

Execution of the contract as far as the Supplier’s legal representative Data are concerned.

Legitimate interest as far as the Data of Supplier’s employees/consultants involved in the activities described in the contract are concerned.

Duration of the contract and 10 years after its termination.

In case of judicial dispute, the Data will be retained for the entire duration of the same until the expiry of the time-limit for lodging an appeal.

Performance of administrative-accounting obligations– such as the accounts and treasury management, as well as invoicing (for example the verification and registration of invoices), in compliance with what requested by the current legislation.

Necessity to fulfil a legal obligation to which the Data Controller is subject.

Duration of the contract and 10 years after its termination.

In case of judicial dispute, the Data will be retained for the entire duration of the same until the expiry of the time-limit for lodging an appeal.

Yearly evaluation of the supplier’s performance.

Legitimate interest.

Duration of the contract and 10 years after its termination.

In case of judicial dispute, the Data will be retained for the entire duration of the same until the expiry of the time-limit for lodging an appeal.

If necessary, in order to verify, exercise and/or defend the Data Controller’s rights in court.

Legitimate interest.

Duration of the contract and 10 years after its termination.

In case of judicial dispute, the Data will be retained for the entire duration of the same until the expiry of the time-limit for lodging an appeal.

Management of business trips.

Execution of the contract

12 months from the booking.

When the data retention period expires, the Data will be destroyed or anonymized, in compliance with the procedures of erasure and backup.

paperplane

Provision of personal data

It is compulsory to provide the Data in order to conclude and/or execute the contract. Consequently, the refusal to provide the Data does not allow to establish a contractual relationship and/or fulfil the corresponding obligations.

As for the other categories of Data (for example the e-mail address and mobile phone belonging to the Supplier’s employee who takes care of selling), the provision is optional but the refusal to provide the Data will not allow a prompt and optimal execution of the contract.

data

Recipients of personal data

The Data may be communicated to external subjects operating as data controllers, by way of example, authorities and control/supervisory bodies and, in general, public or private parties legitimized to request the access to Data, auditors and legal departments.

On behalf of the Data Controller, the Data may be processed by other companies of the Group and by other external subjects appointed as data processors, who carry out specific activities on behalf of the Data Controller. By way of example these activities may be accounting, fiscal and insurance obligations, transport and postal shipping, payments and proceeds management, development, operation and maintenance of software, etc.

The list of the recipients of personal data is constantly updated and it can be easily and freely consulted by sending a written request to the Data Controller at the following e-mail address: privacy@cavagnagroup.com

people

Personnel authorized to process personal data

The employees of the deputed corporate functions may process the data in order to pursue the abovementioned scopes.

These employees have been expressly authorized to perform such processing and they have received adequate operative instructions.

data

Data transfer to extra EU countries

The Data may be transferred to extra EU Countries and, in particular, to:

1) Extra-EU countries whose data protection level has been considered adequate by the European Commission in compliance with art. 45 of GDPR”

or

2) Extra-EU countries different from those indicated at point 1) upon signing the Standard Contractual Clauses approved by the Europena Commission in compliance with art. 46, 2 letters c) and d)”

A copy of the Data may be obtained by contacting the Legal Department via e-mail at the following address: privacy@cavagnagroup.com, in accordance with the modalities described at the section “Rights of the Data Subject”.

balance

Rights of the data subject – complaint with the supervisory authority

By contacting Cavagna Group’s Legal Department via e-mail at the following address: privacy@cavagnagroup.com, the data subjects have the right to access the Data processed by the Data Controller; furthermore they have the right to rectification and or integration of incomplete data, to erasure and also to restriction of processing in cases envisaged by art. 18 of GDPR. The data subjects can also exercise the right to oppose the processing on ground relating to his or her particular situation.

If the processing is based on consent or on a contract and is carried out by automated means, the data subjects have the right to receive the personal data concerning them, which they provided to a controller, in a structured, commonly used and machine-readable format. The data subjects shall also have the right to transmit the data to another controller without hindrance, if this is technically feasible.

The data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State of their habitual residence place of work or place of the alleged infringement.