REIRE S.R.L. (hereinafter, the “Data Controller”), as the Data Controller, in accordance with Article 13 of EU Regulation 679/2016 (hereinafter, the “Privacy Regulation”), and subsequent amendments and integrations, collects and subsequently processes personal data of its Clients and Suppliers (hereinafter, the “Data Subject”).
Pursuant to Article 4 of the Privacy Regulation, “personal data” refers to: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, particularly with reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.”
The personal data of the Data Subject are processed in the course of the normal activities of the Data Controller, for the pursuit of the following purposes:
- Correct and complete execution of contractual obligations arising from the established relationship (hereinafter, the “Contract”);
- Fulfillment of administrative and accounting obligations strictly related to the Contract;
- Compliance with specific legal obligations, regulations, or EU legislation (e.g., anti-money laundering regulations);
- Updating the Data Subject on promotional and marketing initiatives, including through the sending of advertising and/or promotional materials (e.g., newsletters), using automated and/or traditional contact methods.
The processing of personal data is carried out, under the authority of the Data Controller, by specifically designated, authorized, and trained persons in accordance with Article 29 of the Privacy Regulation, using manual, computer, or telematic tools, with logic strictly related to the purposes and in any case in a manner that ensures the confidentiality and security of personal data. The processing of personal data may also be carried out on behalf of the Data Controller by Data Processors specifically appointed in accordance with Article 28 of the Privacy Regulation.
Personal data will be stored for a period determined by criteria based on the nature and duration of the Contract and the need to protect the interests of the Data Subject.
2.1) Purposes referred to in paragraph 1, points 1., 2., and 3.
For the purposes referred to in paragraph 1, points 1., 2., and 3., the provision of personal data is mandatory and constitutes a necessary requirement for the execution of the Contract; indeed, failure to provide such data makes it impossible to receive the performance subject to the Contract, and therefore, the legal basis for the related processing is the proper execution and management of the Contract.
2.2) Purpose referred to in paragraph 1, point 4.
For the purpose referred to in paragraph 1, point 4., the provision is optional, and failure to consent only prevents the Data Subject from receiving updates on promotional and marketing initiatives, including the sending of advertising and/or promotional materials (e.g., newsletters).
In relation to the purposes of processing indicated above, and to the strictly relevant extent, the personal data of the Data Subject will or may be communicated to the following categories of subjects:
- The Tax Authority and other public authorities, where required by law or at their request;
- Credit institutions for payment instructions or other financial activities necessary for the execution of the Contract;
- External structures and/or companies used by the Data Controller for activities related to or instrumental to the execution of the Contract;
- External consultants (e.g., for managing fiscal obligations), if not appointed in writing as Data Processors;
- External subjects exercising control activities, such as auditing firms, supervisory boards, compliance bodies;
- Factoring companies and/or specialized companies or law firms for debt recovery and/or the protection of rights/interests.
The above-mentioned subjects, to whom the Data Subject’s personal data will or may be disclosed (as they are not appointed in writing as Data Processors), will process personal data as independent Data Controllers under the Privacy Regulation.
The updated list of the above-mentioned subjects and the Data Processors can be provided upon request by the Data Subject.
The Data Subject’s personal data will not be subject to dissemination.
If necessary for the execution of the Contract, the Data Subject’s personal data may be transferred to countries within the EU and/or non-EU countries, in full compliance with the provisions of the Privacy Regulation, the decisions of the Privacy Authority, and applicable EU legislation. In particular, the Data Controller undertakes to comply with the provisions of the decisions 2001/497/EC, 2004/915/EC, and 2010/87/EU (depending on the specific case), which require the signing of “standard contractual clauses” between the legal entities involved in processing non-EU data.
Articles 15 et seq. of the Privacy Regulation grant the Data Subject the right to obtain:
- Confirmation of the existence or non-existence of personal data concerning them, even if not yet recorded, and their communication in intelligible form;
- Information on the source of personal data, the purposes and methods of processing, the logic applied in the case of processing carried out with electronic tools, and the identity of the Data Controller;
- Update, correction, integration, deletion, anonymization, or blocking of data processed in violation of the law (including data no longer necessary for the purposes for which it was collected or subsequently processed). The confirmation that such operations have been made known to those to whom the data have been communicated or disseminated (unless this proves impossible or involves a clearly disproportionate effort in relation to the protected right).
The Data Subject also has the right:
- To withdraw consent at any time for the processing of personal data, where applicable (without prejudice to the lawfulness of processing based on consent before its withdrawal);
- To object, in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if relevant to the purpose of the collection;
- To object, in whole or in part, to the processing of personal data for the purpose of sending advertising material, direct sales, or conducting market research or commercial communications;
- To file a complaint with the Data Protection Authority in the cases provided by the Privacy Regulation;
- To request the portability of personal data, as provided by Article 20 of the Privacy Regulation.
To obtain the updated and detailed list of subjects to whom the Data Subject’s personal data may be communicated and to exercise the rights set out in Articles 15 et seq. of the Privacy Regulation, the Data Subject may contact the Data Controller:
REIRE S.R.L.
VIA GIOVANNI RINALDI, 95
42100 – REGGIO EMILIA (RE)
Tel: +39 0522935511
E-mail: reire@reire.com
