PRIVACY NOTICE FOR CUSTOMERS AND SUPPLIERS ON THE PROCESSING OF PERSONAL DATA

This English version is provided for convenience only. In case of any discrepancy, the Italian version shall prevail.

Pursuant to Italian Legislative Decree no. 196/2003 and EU Regulation no. 679/2016 (GDPR), and with regard to the personal data concerning you that will be processed, we inform you as follows.


1. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASIS OF PROCESSING
“Data” means data relating to natural persons processed by CIBER SRL for the conclusion and performance of the contractual relationship with its customers/suppliers, such as data directly relating to the customer/supplier who is a natural person, or to the legal representative of a customer/supplier that is a legal entity, to its employees/consultants involved in the activities covered by the contract, as well as any other information necessary for the performance of the contract and/or the provision of the service(s). In particular, such Data will be processed for the purposes set out below.
A. Management of the contractual/business relationship, such as: meeting specific requests of the customer/supplier before the contract is concluded; conclusion, amendment and performance of the contract; provision and management of related services; complaint handling.
The legal bases for processing for these purposes are:
- the fulfilment of contractual obligations and/or the performance of pre-contractual measures taken at the data subject’s request, for contracts entered into directly with the data subject;
- legitimate interest (in managing and performing the contract) for the processing of data of the supplier’s/customer’s employees/consultants involved in the activities covered by the contract.

B. Administration and accounting, such as: invoicing; management of payments, late payments and non-payments; communication of the Data among group companies for internal organisational, administrative, financial and accounting purposes related to the above activities.
The legal bases for processing for these purposes are:
- the need to comply with the legal obligation to keep accounting records;
- legitimate interest in the administrative management of the contractual relationship.

C. Compliance with legal obligations under national or European Union law or collective agreements in accordance with national law, such as: compliance with obligations under EU and national legislation, in particular on health and safety at work and crime prevention (anti-mafia and anti-corruption legislation, Italian Legislative Decree 231/2001).
The legal basis for processing is the need to comply with a legal obligation to which the data controller is subject.

D. Exercise and/or defence of rights in court and debt collection, such as: management of any litigation, protection and recovery of receivables, directly or through third parties (lawyers/agencies/debt collection companies).
The legal basis for processing is legitimate interest.



2. RETENTION PERIOD
Data will be processed for the duration of the contractual relationship and, after it ends, until the limitation period for the rights arising between the parties has expired. In the event of litigation, for its entire duration and until the final decision becomes res judicata.


3. METHODS OF PROCESSING
Personal data may be processed using both paper-based and electronic or otherwise automated means, with methods and procedures strictly necessary to pursue the purposes described above.


4. SCOPE OF COMMUNICATION, PERSONS AUTHORISED TO PROCESS DATA
Data may be communicated to external parties acting as independent data controllers, such as public or private entities entitled to process the Data (e.g. public administrations, banks and credit institutions, accountants, notaries, lawyers and other professionals).
Data may be processed on behalf of the controller by external parties appointed as data processors, who carry out specific activities on behalf of the controller, for example its distribution network, companies and agents handling debt collection for the controller, and legal, tax and administrative advisers.
Data may be processed by employees of the company departments responsible for pursuing the purposes stated above, who have been expressly authorised to process the data and have received appropriate operating instructions.
Data are not disseminated.



5. PROVISION OF DATA
Any refusal by the data subject to provide personal data may make it (partly or entirely) impossible to fulfil legal obligations, or to enter into or correctly perform the contract or service. In such a case, without prejudice to the data subject’s right not to provide their data, the Controller reserves the right to suspend, terminate or not establish the contractual relationship.



6. DATA CONTROLLER
The data controller is CIBER SRL, with registered office at Corso Sempione 41 - 20145 Milan (MI), Italy, Tax Code and VAT No. 00387800030, contact: info@cibergt.com.
The controller may process data directly, through its own authorised employees, or through external collaborators, who in that case act as Data Processors.
The updated list of Data Processors is made available by the Controller upon request.



7. RIGHTS OF THE DATA SUBJECT
Data protection legislation (Articles 12-22 of EU Regulation 679/2016) gives data subjects the right to be informed about the processing of their Data and the right to access the Data at any time and to request that it be updated, supplemented and corrected. Where the conditions laid down by law are met, data subjects also have the right to erasure of the Data, restriction of processing, data portability, to object to processing, and not to be subject to decisions based solely on automated processing.
Where the processing of personal Data is based on the data subject’s consent, the data subject has the right to withdraw that consent.
To exercise these rights, and for more detailed information about the processing of Data, the data subject may contact CIBER SRL by e-mail at: info@cibergt.com.
If the data subject considers that their rights have been infringed, they may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).



8. PROCESSING OF THIRD-PARTY DATA
The customer/supplier is informed that, if it uses its own employees or collaborators (including any subcontractors) to perform the contractual relationship, their personal data may be processed by CIBER SRL, again as data controller, for the purposes set out in point 1. Such processing has the same purposes, methods and retention periods described in this notice; in relation to such processing, the data subjects also have the same rights set out in point 7.
The customer/supplier is responsible for properly informing its employees and collaborators about the above processing, including by providing them with a copy of this notice.