Subject: Notice pursuant to Art. 13 of Legislative Decree no. 196/2003 and Arts. 13 and 14 of Regulation (EU) 2016/679
Pursuant to and by effect of Article 13 of Legislative Decree no. 196 of 30 June, 2003, and Articles 13 and 14 of Regulation (EU) 2016/679, and in relation to your personal data processed by O.M.A.F. S.r.l., we would like to inform you of the following:
1. Data Controller
The Data Controller of your personal data is Mr. Adriano Grotto, Legal Representative of O.M.A.F. S.r.l., with registered office on Via Luigi Cazzola, 22, 36015 Schio (VI)
2. Scope and Purpose of Processing
▪ purposes connected to a requirement established by law, regulations or EU legislation, as well as provisions of authorities having jurisdiction on the matter at hand, and supervisory and control bodies;
▪ related and instrumental purposes for the management of relations with customers/suppliers, including, for example, proposing an estimate, stipulating a contract, transmitting information, invoicing and collecting payments;
▪ to defend a right, including of the Data Controller or a third party in court, as well as in administrative or arbitration and conciliation procedures where allowed by the law, EU legislation, regulations or the collective agreement adopted by the Company.
▪ purposes of marketing and promotion of new products or initiatives.
Your personal data will be processed to pursue statutory activities deemed functional to the performance of the contractual/pre-contractual relationship in relation to goods, services/supplies under the applicable agreement, including any instrumental or complementary activities.
Where concrete and objective situations require the use of personal data, processing will occur only where strictly necessary to fulfill the contract obligations, always provided that the conditions of lawful processing set forth in Art. 9 of the GDPR are met and that the interested party has given his/her explicit consent to the processing of such personal data.
In relation to the agreement to be entered into by the parties, personal data processing has the purpose of providing:
The legitimate interests pursued by the Data Controller related to the processing of personal data of customers and suppliers are exclusively reflected in the lawful and objective need of entering into a sale/purchase agreement (with customer/supplier) of which the latter is a party or to implement pre-contractual measures requested by the customer/supplier.
3. Method of processing
Processing will include all the operations or set of operations envisaged in Art. 4, paragraph 1, lett. a) of Decree 196/2003 and Art. 4 point 2) of Regulation (EU) 2016/679, always ensuring that any data you have provided will not be disseminated.
Within the aforementioned purposes, processing may be carried out either through computer systems or in paper form, and managed by authorized personnel of our Company and, when necessary, by external processors specifically appointed.
Data retention will be computer- and paper-based for the period of time required by applicable laws.
4. Obligation to provide personal data
The provision of personal data relating to the processing described in point 2 is deemed necessary, since it is connected to the obligations provided for by applicable laws or regulations, as well as by instructions issued by the competent authorities/supervisory and control bodies, or to fulfill the sale/purchase agreement or pre-contractual conditions of the customer/supplier.
5. Consequences of failure to consent to the processing of personal data
Any failure to consent to processing will not allow the completion of the aforementioned activities, with the resulting impossibility of fulfilling the agreement.
In any case, even if you give your consent, you have the right to suspend processing at any time, including by requesting to delete data sent to the e-mail address provided in point 11 below, without prejudice to the lawfulness of any processing completed prior to your request of suspension and the legitimate interests of the Data Controller. This request would also imply the impossibility of executing the agreement.
6. Provision of personal data
Personal data relating to the processing in question may be shared with third parties belonging to the following categories:
▪ subjects that provide banking, financial and insurance services;
▪ supervisory and control authorities and bodies and, in general, public or private subjects, having the status of Public Officials or persons in charge of public services;
▪ subjects providing services for the management of IT and information systems;
▪ subjects responsible for IT security and maintenance;
▪ subjects responsible for archival documentation activities;
▪ consulting companies or certification bodies.
With reference to Data provided to them, the subjects belonging to the above categories may operate, as appropriate, as managers or persons in charge of processing or as separate data controllers. In the latter case, Data will be communicated only with the express consent of the users, except in cases where communication is mandatory or necessary by law, or for the pursuit of purposes for which the consent of the concerned party is not required by the law.
7. Data retention
Data will be stored on the basis of the following criteria:
- at least for the period required by the regulations in force
- for the protection of the rights of the concerned party that may require verification of compliance with the Company’s obligations
- for the protection of the Data Controller’s rights (for example, for the purpose of showing the fulfillment of obligations regarding health and safety at work, social security, etc.)
8. Provision of data to subjects outside the European Union
Although at present all the subjects who process data on behalf of O.M.A.F. S.r.l. as external processors are located within the European Union, in the future it may be necessary to provide data to subjects who may be located outside the European Union, in countries that do not provide an adequate level of data protection, pursuant to the Privacy Code/European Regulation 679/2016 for data protection. If warranted by circumstances, O.M.A.F. S.r.l. will transfer data outside the European Union only after adopting the precautions established by the Privacy Code and the EU Regulations and after obtaining the necessary guarantees from the interested subjects.
9. Data profiling
No profiling activity is foreseen on personal data provided.
10. Rights of the concerned party
We inform you that with regard to data processing, you may exercise the rights referred to in Article 7, Legislative Decree 196/2003 and Arts. 13 and 14 of Regulation (EU) 2016/679, whose texts are attached herewith, and in particular:
▪ Access to personal data for verification;
▪ Amendment to or deletion of personal data;
▪ Limit to the processing of the party’s personal data;
▪ Objection to the processing of personal data;
▪ With reference to personal data processed using automated methods, right to data portability;
▪ File a complaint with a supervisory authority
11.For more information
In case of doubts, requests for clarification or anything else that may concern the processing of personal data, the concerned party can contact:
Via email: amministrazione@omaf.it
By certified mail with return receipt: O.M.A.F. Srl, Via Luigi Cazzola, 22, 36015 Schio (VI)
Upon reviewing the above information, I give my consent to data processing and communication by Data Controller and/or Data Processor for the purposes and within the parameters of the aforementioned information.
I also give my consent to the possible transfer of sensitive data abroad, pursuant to Art. 43 of Legislative Decree 196/2003 and Art. 44 of Regulation (EU) 2016/679, within the parameters set forth in the disclosure, as well as any processing resulting from the verbal provision of data to the Data Controller(s), pursuant to point 5 of the information provided to me, limited for the purpose referred to therein.
The concerned party fully acknowledges that consent to the lawful processing of his/her personal data is optional for the functional purposes of O.M.A.F. Srl’s activity, pursuant to paragraph 3) concerning marketing and advertising, and that failure to give consent to the lawful processing of data connected to said functional purposes prevents the fulfillment of the sales agreement the party entered into. Therefore, pursuant to Art. 7 of the General Regulation on Data Protection (EU) 2016/679, the concerned party provides his/her specific, informed and unequivocal consent to the lawful processing of his/her personal data, including for the functional purposes of O.M.A.F. Srl, as set forth in paragraph 3), point 3) herein.