INFORMATION NOTICE FOR
CUSTOMERS AND SUPPLIERS

T.O. Delta s.p.a. a sole shareholder informs You that Regulation (EU) 2016/679 (“GDPR”) provides for the new regulation for the protection of individuals and other subjects with respect to the Processing of personal data. According to the aforementioned legislation, this Processing will be based on the principles of lawfulness, fairness and transparency and protection of confidentiality and rights, according to the principles contained in art. 5 of the GDPR.
Pursuant to art. 13 GDPR we therefore provide the following information:

DATA CONTROLLER

The Data Controller is T.O. Delta s.p.a. a sole shareholder with registered office in Via della Rampa, snc – Trieste (TS) 34123 which can be contacted by writing to the following e-mail address: privacy@todelta.it.

PERSONAL DATA PROTECTION OFFICER (DPO)

The designated Data Protection Officer is Pratika S.r.l., (contact person Alex Stellini) who can be contacted by writing to the following e-mail address: dpo@gruppopk.com, or by calling +39 0432807545.

PERSONAL DATA PROCESSED

“Data” means those relating to natural persons processed by the Company for the stipulation and execution of the contractual relationship with its customers/suppliers, such as those of the legal representative of the company that signs the contract in the name and on behalf of the latter, as well as the employees/consultants of the customer/supplier, involved in the activities referred to in the contract.
Data relating to special categories of data may also be processed in accordance with the provisions of the legislation relating to health and safety in the workplace. The Data may
also include any judicial data reported in public databases.

PURPOSE OF THE PROCESSING

  • Purposes related to the establishment and execution of the contractual relationship between our Company and its customer/supplier;
  • Carrying out administrative-accounting obligations;
  • Fulfilment of obligations provided for by law, regulation, EU legislation or an order of the Authority;
  • Ascertain, exercise and/or defend the Company’s rights in court.
  • Sending by e-mail, post and/or text message and/or telephone contacts, newsletters, commercial communications and/or advertising material on products or services offered by the Data Controller and survey of the degree of satisfaction with the quality of services.

DATA RETENTION PERIOD

Duration of the contract, and the termination of the contractual relationship for a period of 10 years or as otherwise established by the pro tempore legislation in force. In any case, this is without prejudice to longer or specific retention periods provided for by applicable laws and regulations in the sector, or useful for any legal defence of the
Company. In the case of judicial litigation, for the entire duration of the same, until the exhaustion of the terms of appeal actions.
For commercial communications, the data will be kept for a period of two years from the termination of the contractual relationship or until any expression of dissent by you.
After the expiry of the storage terms indicated above, the data will be destroyed, deleted or made anonymous, compatibly with the technical procedures of deletion and backup.

LEGAL BASIS OF THE PROCESSING

The processing activities are necessary for the performance of a contract, i.e. they are necessary to comply with a legal obligation to which the controller is subject. However, it is always possible to request the Data Controller to clarify the concrete legal basis of each processing.
Any commercial communications, in an already existing B2B relationship, according to the guidelines of the Data Protection Authority and the provisions of the recitals of the GDPR, fall within the legitimate interest of the Data Controller, such as soft spam.

PROVISION OF DATA

The provision of Data is mandatory as it is strictly essential to be able to execute the purposes specified; therefore, failure to provide it will make it impossible to carry out and achieve the aforementioned purposes.

DATA RECIPIENTS

The Data may be communicated to external parties operating as independent Data Controllers or Data Processors appointed by the Data Controller pursuant to Article 28 of the GDPR. These include, but are not limited to, public bodies; Public authorities; Consultants and service providers in various capacities.
The complete list of Recipients and Data Processors appointed by the Data Controller is always available at the registered office of the Data Controller.

PERSONS AUTHORISED TO PROCESS

The Data may be processed by employees of the company departments responsible for pursuing the purposes indicated above, who have been expressly authorised to process the data and who have received adequate operating instructions.

TRANSFER OF PERSONAL DATA

Pursuant to art. 44 et seq. of the GDPR 2016/679, some of your personal data may be communicated to recipients and Data Processors (the latter duly appointed by the Data Controller), based in non-European third countries, always according to the principles of lawfulness, fairness, transparency and protection of your privacy.

RIGHTS OF THE DATA SUBJECT AND COMPLAINT

With regard to personal data, the interested party may exercise the rights provided for in art. 15 et seq. GDPR and precisely:
Right of access (art. 15) – consists in obtaining confirmation from the Data Controller as to whether or not personal data concerning him or her is being processed and, if so, obtaining access to the same data and to certain information (explained in the aforementioned article) regarding the data in question.
Right to rectification (art. 16) – This consists in giving the interested party the opportunity to modify their data if they are inaccurate.
Right to erasure (art. 17) – Possibility for the data subject to delete his/her data in the possession of the data controller when, for example, consent to the processing is revoked or the purpose pursued is achieved or when it is unlawful. Obviously, it will not always be possible to fulfill the cancellation request. This is the case, for example, if the data is used to comply with a legal obligation or is necessary for the defence of legal claims.
Right to Object (art. 21) – The possibility of objecting to processing must be guaranteed when the legal basis is the legitimate interest or the performance of a task of public interest. This right also has its limits as there may be cases in which the legitimate interest of the data controller prevails over that of the data subject, it will be essential to carry out the right balance, or the processing is necessary for a task of public interest or the ascertainment, defense or exercise of a right before a judge.
Right to portability (art. 20) – provides that, in the event that processing is based on contract or consent, in the event of a request, the data subject is provided with his/her personal data in a structured and machine-readable format (json, xml, csv), this right applies only to data provided voluntarily and not to inferred or derived data.
Right of revocation (art. 7) – In the event of signing any form of consent to the processing requested by the Data Controller, please note that the data subject may revoke it at any time, without prejudice to the mandatory obligations provided for by the legislation in force at the time of the request for revocation.
The data subject has the right to lodge a complaint with the competent supervisory authority in the Member State in which he or she habitually resides or works or in the State in which the alleged violation occurred.
All the aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in this policy.