CUSTOMER and SUPPLIER PRIVACY POLICY

Information pursuant to article 13 of Regulation (EU) 2016/679 (“GDPR”)

Dear Sirs, we wish to inform you that Regulation (EU) 2016/679 (the GDPR) provides for the protection of individuals with regard to the processing of personal data. In compliance with the indicated law, this treatment will be based on principles of correctness, lawfulness and transparency, protecting your privacy and your rights. Pursuant to Article 13 of the aforementioned Regulation, we therefore provide you with the following information.

  1. Personal data processed, source of data, purpose of data processing, legal basis of processing and retention period

“Data” means those relating to natural persons processed by MPE Srl for the stipulation and execution of the contractual relationship with its customers / suppliers, such as for example those of the legal representative of the customer / supplier who signs the contract in the name and on behalf of the latter, of the employees / consultants of the customer / supplier involved in the activities referred to in the contract, the Data of the companies of the customer / supplier group for which the latter signs the contract with the necessary powers of representation, as well as any other information necessary for the execution of the contract and / or the provision of the service (s) (also indicated below).

The source from which the Data comes is the customer / supplier.

In particular, these Data will be processed for the purposes indicated below.

  1. Management of the contractual / commercial relationship, such as: satisfaction of specific requests of the interested party before the conclusion of the contract; conclusion, modifications, execution of the contract; provision and management of related services (installation, activation, migration, maintenance and / or assistance activities); claims management.

The legal basis of the processing is:

– the execution of the contract, for the data of the legal representative of the supplier / customer;

– the legitimate interest, for the data of the employees / consultants of the supplier / customer involved in the activities referred to in the contract.

Retention periodfrom the Data: contractual duration and, after termination, for a further 10 years. In the event of a judicial dispute, for the entire duration of the same, until the end of the terms of enforceability of the appeals.

 

  1. Administrative – accounting, such as: billing; management of payments, delays and non-payments;

communication of the same data between group companies, for internal organizational, administrative, financial and accounting purposes functional to the aforementioned activities.

The legal basis of the processing is the need to fulfill a legal obligation to which MPE Srl is subject

Retention periodfrom the Data: contractual duration and, after termination, for a further 10 years. In the event of a judicial dispute, for the entire duration of the same, until the end of the terms of enforceability of the appeals.

  1. Fulfillment of obligations or exercise of rightsprovided for by national or European Union law or by collective agreements in accordance with national law, such as: fulfillment of obligations under Community and national regulations, in particular by laws, regulations, including contingent and urgent measures for the protection of public order, the detection and repression of crimes.

The legal basis of the processing is the need to fulfill a legal obligation to which the data controller is subject.

Retention periodfrom the Data: contractual duration and, after termination, for a further 10 years. In the event of a judicial dispute, for the entire duration of the same, until the end of the terms of enforceability of the appeals.

  1. Out-of-court debt collection (in the case of clients), such as: protection and possible recovery of credit, directly or through third parties (agencies / credit recovery companies) to whom they will be communicated, only for this purpose.

The legal basis of the processing is legitimate interest.

Retention periodfrom the Data: contractual duration and, after termination, for a further 10 years. In the event of a judicial dispute, for the entire duration of the same, until the end of the terms of enforceability of the appeals.

  1. If necessary, to ascertain, exercise and / or defend rights in court

The legal basis of the processing is legitimate interest.

Retention periodfrom the Data: contractual duration and, after termination, for a further 10 years. In the event of a judicial dispute, for the entire duration of the same, until the end of the terms of enforceability of the appeals.

  1. Security, pursuant to Legislative Decree 81/2008

With particular reference to the identification data freely provided by the guest / visitor at our offices (name, surname, institution or company to which they belong), the processing has the sole purpose of ensuring compliance with the formally applied corporate security procedures, also in force of the regulations in force (e.g. notation in the visitor register / database, assignment of temporary identification badges, application of legal obligations regarding safety in the workplace).

The legal basis of the processing: the need to fulfill legal obligations to which the owner is subject.

Retention periodof the Data: the Data will be kept for the period of time required by law.

Once the retention terms indicated above have elapsed, the Data will be destroyed or made anonymous, compatibly with the technical cancellation and backup procedures.

  1. Scope of communication, subjects authorized to process & transfer data to countries outside the European Union

The Data may be communicated to external subjects operating as data controllers, by way of example, supervisory and control authorities and bodies and in general public or private subjects, entitled to request the Data (e.g. banks and credit institutions; Public administrations and other public authorities).

The Data may be processed, on behalf of the owner, by external subjects designated as data processors, who carry out specific activities on behalf of the owner, by way of example, its distribution network, companies and agents that carry out the activity of credit recovery for the owner, legal, tax and administrative consultants.

The Data may be processed by employees of the corporate functions responsible for pursuing the aforementioned purposes, who have been expressly authorized to process and who have received adequate operating instructions.

As a rule, no personal data of the interested party will be transferred to a third country outside the European Union or to international organizations. If this becomes necessary for the realization of the object of the contract stipulating or already in place with the owner and, more generally, of the purposes referred to in this information, the owner undertakes to ensure that any transfer takes place in compliance of the provisions referred to in Articles 45 (based on an adequacy decision of the Commission) and 46 (based on the existence of adequate guarantees), if applicable, or in any case pursuant to art. 49 of the Regulation.

  1. Provision of Data.

The provision of data by the customer / supplier is optional, however any refusal to provide such data could lead to failure or partial execution of the contract / service.

  1. Data Controller and Data Protection Officer

The Data Controller is MPE Srl, with headquarters in via dell’Industria 15, Villanova Canavese (TO), fax number 0119269737, telephone number 0119261811, mailprivacy@mpeplastics.com.

  1. Rights of the interested party.

By contacting the Privacy Office via e-mail at the addressprivacy@mpeplastics.com, the interested party may ask MPE Srl to access the data concerning him, their cancellation, the correction of inaccurate data, the integration of incomplete data, the cancellation of data, the limitation of processing in the cases provided for by art . 18 GDPR, as well as to oppose, for reasons connected to one’s particular situation, to the processing carried out for the legitimate interest of the owner.

Furthermore, in the event that the processing is based on consent or on the contract and is carried out with automated tools, the interested party has the right to receive the Data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments.

The interested party has the right to lodge a complaint with the competent Supervisory Authority in the Member State in which he habitually resides or works or in the State in which the alleged violation has occurred.

The interested party has the right to revoke the consent given at any time for marketing purposes and to oppose the processing of the data processed for the same purposes. The possibility remains for the interested party who prefers to be contacted for the aforementioned purpose exclusively through traditional methods to express his opposition only to the receipt of communications through automated methods.

  1. Changes to the privacy policy

The Owner reserves the right to make changes, at any time, to this information, giving appropriate notice to users of the site. In order to view any changes made, the user is invited to regularly consult this information, which in any case indicates the date of the last update.

Last updated: 06/29/2022