1. Identity and contact details of the Data Controller
The data controller is VINTALIA S.R.L., with registered office at Viale della Serenissima, 177, 00177 Roma (RM), Tax Code/VAT No. 18060971001.
The Data Controller may be contacted at the above address or by email at privacy@vintalia.it.
2. Personal data processed and categories of data subjects
The processing of personal data, carried out for the purposes set out below, will concern the following categories of personal data relating to the natural persons who, in the course of the performance of the business or consultancy relationship, will deal with VINTALIA:
● identification data, such as first name and surname;
● contact data, such as email address, telephone number and address;
● data concerning the role held and the company of affiliation;
● tax and banking data (VAT number, tax code, bank account details).
3. Purposes of the processing
Personal data are processed for the purpose of:
a) fulfilling contractual obligations or in any case for ordinary administrative and accounting purposes;
b) fulfilling obligations imposed by applicable laws, regulations or applicable EU legislation, or complying with decisions of the competent authorities; and
c) establishing or defending a right, against the data subject or third parties, in judicial or out-of-court proceedings, in the cases provided for by applicable laws, regulations or applicable EU legislation.
4. Legal basis for the processing
The legal basis for the processing of personal data for the purposes referred to in paragraph 1(a) of this notice is Art. 6(1)(b) of the Regulation, since “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
The legal basis for the processing carried out for the purposes referred to in paragraph 1(b) is Art. 6(1)(c) of the Regulation, since “processing is necessary for compliance with a legal obligation to which the controller is subject”.
The legal basis for the processing carried out for the purposes referred to in paragraph 1(c) is Art. 6(1)(f) of the Regulation, since “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”, as the interest pursued by the Data Controller is that of being able to defend itself should any dispute arise in relation to the business or consultancy relationship established.
5. Optional nature of the provision of data
The provision of personal data for the purposes referred to in paragraph 3(a) is not mandatory. However, it is essential for the performance of the supply or consultancy contract. Therefore, failure to provide the personal data may make it impossible for the Data Controller to carry out the activities provided for in the relevant contract. Once the personal data have been received for the purposes referred to in paragraph 3(a), processing for the purposes set out in paragraphs 3(b) and (c) may also be necessary in order for the Data Controller to fulfil the legal obligations to which it is subject or to protect itself in the appropriate forums.
6. Categories of recipients
In connection with the activities of the Data Controller, and exclusively for the purposes mentioned above and for the time strictly necessary, personal data may be shared with:
a) parties that typically act as data processors pursuant to Art. 28 of the Regulation, namely: i) individuals, companies or professional firms providing assistance and advice to VINTALIA S.R.L. in accounting, administrative, legal, tax and financial matters; ii) parties appointed to carry out technical maintenance; iii) credit institutions, insurance companies and insurance brokers;
b) parties, bodies or authorities to which personal data must be disclosed under provisions of law or orders of the authorities;
c) persons authorised by the Data Controller to carry out the processing of personal data necessary to perform activities strictly related to the purposes referred to in Art. 1 above, who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
7. Data retention
Personal data will be stored, pursuant to Art. 32 of the Regulation, in compliance with the security measures adopted by the Data Controller in the field of data protection, and access to such data will be permitted only to personnel involved in and duly authorised to process them.
Personal data processed for the purposes referred to in paragraphs 1(a) and 1(c) will be retained for the time strictly necessary to achieve those purposes. In any case, since the processing is carried out for the supply of products or services, the Data Controller will retain the personal data for the period provided for and permitted by Italian law to protect its own interests (Art. 2946 et seq. of the Italian Civil Code).
Personal data processed for the purposes referred to in paragraph 1(b) will be retained for the period required by the specific applicable legal obligation or provision of law.
8. Rights of the data subject
The data subject may at any time exercise, pursuant to Arts. 15-22 of the Regulation, the right to: obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed; request from the data controller access to the personal data; obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and the data retention period; obtain the rectification or erasure of the personal data or the restriction of the processing of the data; withdraw consent to the processing of the data; lodge a complaint with a supervisory authority pursuant to Art. 77 of the Regulation; obtain data portability, i.e. receive the data in a structured, commonly used and machine-readable format and transmit them to another data controller without hindrance.
The data subject may exercise his or her rights by means of a written request sent to the email address privacy@vintalia.it.