Privacy Notice for Customers and Suppliers

Privacy Notice for the Processing of Personal Data of Customers and Suppliers

pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR)

Data Controller

The Data Controller is: D’Andrea S.p.A., Via Garbagnate, 71 – 20045 Lainate (MI), Italy, privacy@dandrea.com, Company phone: +39 02 937532.1.

Purpose and Legal Basis of Processing

The personal data provided are collected for the performance of the activities defined by the contractual agreements relating to the following business activity: Design, manufacture and repair of tooling and accessories for machine tools (manual, automatic and CNC boring and facing heads, integral and modular tool-holder systems), including ancillary and supporting activities (i.e. accounting, administrative, organizational and management activities), as well as for compliance with legal obligations.

Categories of Personal Data Processed

The personal data processed consist of ordinary personal data obtained from the customer for the management of the contractual relationship (identification data, address, telephone number, email address, technical data included in contractual documentation, etc.), as well as data relating to suppliers and any collaborators or subcontractors, for the purpose of organizing interventions and activities at our company. Direct contact details (telephone numbers, email addresses and other contact information) relating to employees and collaborators may be collected and stored. Company-specific information relating to the contractual relationship between the parties may also be collected and processed in order to improve and maintain business contact references. No processing of special categories of personal data (Article 9 of Regulation (EU) 2016/679) is envisaged.

Categories of Recipients of Personal Data

The processed data may be disclosed to the following categories of recipients: System Administrator; Personnel responsible for the maintenance of the company’s IT systems; Administrative personnel and other authorized persons appointed to process personal data; External companies providing IT support services; External companies and professionals providing tax, accounting and administrative assistance. To the extent necessary and within their respective areas of responsibility, the data may also be disclosed to third-party companies and professionals involved in managing the contractual relationship.

Please note that D’Andrea S.p.A. makes use of cloud computing application services located within EU countries, web platforms, and email service providers whose data centers are located within the European Economic Area (EEA). Except where required to comply with specific legal obligations, personal data are not transferred to additional companies or third countries, particularly to countries that do not provide adequate safeguards regarding personal data protection.

Data Retention Period

The collected data will be processed by means of electronic or automated tools, IT and telecommunication systems, or through manual processing methods strictly related to the purposes for which the personal data were collected and, in any case, in a manner ensuring their security at all times. Personal data will be processed from the commencement of the contractual relationship until the termination of the contract, plus an additional period of ten (10) years, in order to comply with legal, accounting and tax obligations.

The fundamental rights of the data subject are set out in Articles 15 (Right of Access), 16 (Right to Rectification), 17 (Right to Erasure, also known as the “Right to be Forgotten”), and 18 (Right to Restriction of Processing) of Regulation (EU) 2016/679. To exercise these rights, the data subject may submit a written request to the following contact details:privacy@dandrea.com, Company phone: +39 02 937532.1. The Data Controller will acknowledge receipt of the request and will take appropriate action within 72 working hours. Pursuant to Article 19 of Regulation (EU) 2016/679, requests concerning the rights referred to in Articles 16, 17 and 18 shall be communicated by the Data Controller and/or the Internal Data Protection Manager.

Right to Lodge a Complaint with a Supervisory Authority

The data subject also has the right to lodge a complaint with the competent supervisory authority.

Requirement to Provide Personal Data and Consequences of Failure to Do So

Failure to provide the personal data required for the purposes described above will prevent the Data Controller from managing the contractual relationship and from providing the requested information.