Skip to main content

Supplier privacy policy

INFORMATION ON THE PROCESSING OF SUPPLIERS' PERSONAL DATA
PURSUANT TO ARTICLES 13 AND 14 OF THE GDPR


This privacy notice is provided by PIN-CRAFT S.r.l. (hereinafter the "Company" or the "Data Controller") to natural person suppliers and their employees/collaborators (e.g., sole proprietorships, professionals) entering into a contractual relationship with the Company, as well as to natural persons (e.g., employees/collaborators/representatives) acting as contact persons for legal entity suppliers (hereinafter collectively the "Suppliers" or "Data Subjects"). In accordance with Articles 12 et seq. of EU Regulation 2016/679 ("GDPR"), the Company informs Suppliers of the methods, legality, and rights regarding the processing of their personal data collected and processed for the establishment, management, and execution of the contractual relationship.

DATA CONTROLLER

The Data Controller of your personal data is the company PIN-CRAFT S.r.l., with registered office at via dei Comparini n. 85, 55049 Viareggio (LU) – Italy, registered with the Companies Register of Lucca, VAT no. 01965100462; contacts: tel. +39 0584-383930, e-mail: info@pin-craft.com.

DATA PROTECTION OFFICER

Pursuant to Art. 37 GDPR, PIN-CRAFT S.r.l. has appointed a Group Data Protection Officer (DPO) clickable via email at dpo@opacmare.it.

SOURCES AND CATEGORIES OF DATA PROCESSED

For the processing activities indicated in section 4 below, the Company processes the following categories of Suppliers' personal data obtained directly from them (in the case of sole proprietorships) or from their employer company (in the case of legal entities):

  • Personal identification data
  • Tax data: fiscal code, VAT number
  • Contact details: e.g., address, telephone, email
  • Payment data: e.g., bank details, IBAN
  • Professional data: e.g., job title
  • Company/Organization name
  • Special categories of data: we do not process any data qualifying as "special categories" under Art. 9 GDPR, except as required by law

PURPOSES AND LEGAL BASES FOR PROCESSING

The Data Controller processes personal data of Suppliers who have contractual relationships with the company. The purposes of data processing for managing relations with Suppliers are as follows:

  1. Management of pre-contractual and contractual relationships, including obtaining preliminary information prior to contract conclusion, supplier search/selection/validation, document verification, master data creation, offer/order management, database management, and communications with Suppliers. The legal basis is the performance of pre-contractual and contractual obligations with Suppliers (Art. 6.1(b) GDPR).
  2. Compliance with accounting, tax, and statutory obligations, such as tax/social security filings, accounting records, invoice management/archiving (including electronic format), and salary/social security compliance verification for contractors. The legal basis is compliance with legal, regulatory, EU obligations, or authority orders (Art. 6.1(c) GDPR).
  3. Legitimate interest purposes, such as defending the Controller's rights in legal disputes and safeguarding corporate IT security and assets. The legal basis is the Controller's legitimate interest (Art. 6.1(f) GDPR). Suppliers who believe their rights/freedoms override these interests may object at any time as outlined in §9.

NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL

Providing data is mandatory for proper management of the pre-contractual and contractual relationship and compliance with legal and contractual duties. Refusal to provide data in whole or in part, or providing incorrect

mandatory details, may result in the Controller's inability to establish or properly execute the contract and related accounting/tax obligations.

PROCESSING METHODS AND TRANSFER OF DATA ABROAD

Personal data is processed via paper and electronic means. The Controller has established specific security measures to prevent unauthorized access, improper use, disclosure, loss, or destruction. Only authorized personnel may access data during work duties.
For cloud services, the Controller may use service providers located outside the EU/EEA. The Company guarantees that such transfers comply with applicable law and Chapter V GDPR safeguards (adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, etc.).

RECIPIENTS OF PROCESSED DATA

Suppliers' personal data may be shared with:

  1. Internal personnel authorized by the Controller;
  2. Commercial contacts helping manage services/contracts (e.g., clients, transport companies);
  3. Public administrations, bodies, or authorities where mandatory by law/orders;
  4. Insurance companies for policy issuance related to the contract;
  5. Professional firms and freelancers handling legal, accounting, or tax matters;
  6. IT services and maintenance companies;
  7. Commercial information companies;
  8. Certification bodies;
  9. Invoicing and electronic archiving service providers.

The updated list of recipients is available upon request by emailing privacy@pincraft.com.

DATA RETENTION PERIODS

  • Contract management data: Retained for the duration of the contractual relationship.
  • Legal/Accounting obligations data: Retained for 10 years after termination of the contractual relationship (pursuant to Art. 2220 Civ. Code and Art. 22 DPR 600/1973).

RIGHTS OF THE DATA SUBJECT

Data Subjects have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), object (Art. 21), request data portability (Art. 20), withdraw consent (Art. 7), and lodge a complaint with a supervisory authority (Art. 77). Requests can be sent to privacy@pincraft.com or to the DPO at dpo@opacmare.it.

REVISION OF THIS PRIVACY NOTICE

The Controller reserves the right to modify or update this document at any time.

THE DATA CONTROLLER
PIN-CRAFT SRL