Suppliers Policy

This information is provided to suppliers who are legal persons and to natural persons who operate in the name and on behalf of suppliers who are legal entities of this company, OFFICINE AMBROGIO MELESI & C. S.r.l., pursuant to and for the purposes of Legislative Decree 196/2003 "Code regarding the protection of personal data" and subsequent amendments and additions and art. 13 - 14 of EU Regulation 2016/679 "European Regulation on the protection of personal data", to inform you of the essential elements of the processing carried out.

1. Data Controller and Data Protection Officer (DPO)
The Data Controller is the company OFFICINE AMBROGIO MELESI & C. S.r.l., with registered office in Cortenova (LC) Largo De Vecchi N. 11, in the person of its pro tempore legal representative. The company has appointed the "Data Protection Officer" provided for by the Regulation (so-called DPO). For all questions relating to the processing of your Personal Data and/or to exercise the rights provided for by the Regulation itself, you can contact the DPO at the following e-mail address: gdpr@melesi.it.

2. Data Processors and Persons in Charge of the processing
The updated list of Data Processors and Data Processors is kept at the headquarters of the Data Controller.

3. Brief description of the treatments
Type of data collected
The data collected are: - personal data - tax data - bank data.

Data source
The personal data processed are those provided by the Data Subject on the occasion of:

• requests for information and quotes;
• completion or fulfilment of a contract.

Purpose of the processing
1. To comply with all operations imposed by regulatory obligations;
2. conduct the operations strictly connected and instrumental to the initiation of contractual relationships, including the acquisition of preliminary information at the conclusion of the contract;
3. exchange information aimed at the execution of the contractual relationship, including post-contractual activities and the management of any dispute;
4. manage relations with the supplier for administration, accounting, orders, shipments, invoicing, services;
5. to forward communications of various kinds and by different means of communication and to formulate requests.
The personal data collected will be processed in accordance with the principles of correctness, lawfulness, transparency, protection of confidentiality and rights of the Data Subject, as established by art. 5 of EU Regulation 2016/679.

Legal basis
Legal provisions that allow the Data Controller to process data for the execution of the contract / provision of the requested service and related activities. (Legislative Decree 196/2003 and subsequent amendments – GDPR 679/2016).

Period and place of storage
The data provided will be stored in our archives, processed and stored, in general, for as long as the purposes of the processing persist: for example, they will be kept for the entire duration of the contractual relationship and, after its conclusion, until the end of the legal limitation period (10 years) unless the relationship is renewed again. The data are currently processed and archived at the undersigned operations office. They are also processed on behalf of the undersigned by professionals and/or companies in charge of carrying out technical, managerial, development, administrative, accounting, tax, legal activities, etc

4. Processing methods
The processing of data for the purposes set out above takes place both by automated means, on electronic or magnetic support, and by non-automated methods on paper, in compliance with the rules of confidentiality and security provided for by European and national legislation.

5. Mandatory or optional nature of the provision of data
Some data are essential for the establishment of the contractual relationship or for its execution, while others can be defined as ancillary to these purposes. Unless expressly specified, all the data requested are to be considered mandatory.

6. Refusal to provide data
The Data Subject may refuse to provide the Data Controller with personal data or revoke consent. If, however, the provision of data is required by a regulatory or contractual obligation, the refusal or revocation of the provision of data puts the undersigned in the condition of not being able to execute or continue the contract, for reasons not attributable to it.

7. Recipients of the data
The personal data processed by the Data Controller will not be disseminated, i.e. will not be disclosed to unspecified subjects, in any possible form, including that of making them available or simple consultation. Instead, they may be communicated to the Data Controller's employees and to some external parties who collaborate with them. They may also be communicated, within the limits strictly necessary, to persons who, for the purpose of issuing orders or requests for information or quotes, must supply goods and/or perform services or services. Finally, they may be communicated to persons entitled to access them by virtue of legal provisions, regulations, EU legislation. In particular, on the basis of the roles and work tasks performed, some workers have been legitimized to process personal data, within the limits of their competences and in accordance with the instructions given to them by the Data Controller.

8. Rights of the Data Subject
At any time, the Data Subject may exercise his/her rights pursuant to Legislative Decree 196/2003 and subsequent amendments and additions and articles 15 to 22 of EU Regulation 2016/679 by contacting the Data Controller, sending an e-mail to info@melesi.it or writing to the Data Protection Officer (DPO) at gdpr@melesi.it. By way of example, you have the right, at any time, to ask where applicable to: 1. Access your data. 2. Verify and rectify your data. 3. Obtain erasure (Right to be forgotten). 4. Obtain the restriction of processing. 5. Achieve data portability. 6. Object to the processing of data. 7. Oppose automated decision-making. 8. Withdraw consent at any time. The Data Subject may revoke consent to the processing of data at any time. The withdrawal of consent does NOT, however, affect the lawfulness of the processing based on the consent given before the withdrawal. There is no automated decision-making process. Without prejudice to any other administrative and judicial remedy, if you believe that the processing of data concerning you violates the provisions of EU Reg. 2016/679, pursuant to art. 15 letter f) of the aforementioned EU Reg. 2016/679, you have the right to lodge a complaint with the Guarantor for the protection of personal data. In the cases envisaged, you have the right to the portability of your data and in this case the Data Controller will provide you with the personal data concerning you in a structured, commonly used and machine-readable format.

9. Data transfer
For all the purposes indicated in this policy, the personal data of a common nature of the Data Subject will not be transferred or communicated to others, outside the recipients indicated in this policy or if present they may be communicated to companies belonging to the group, subsidiaries, associates, etc. also located abroad, inside and outside the European Union, in compliance with the rights and guarantees provided for by current legislation, subject to verification that the country in question guarantees an "adequate" level of protection. The undersigned also reserves the right to use cloud services, ensuring that the service providers will be selected from those who provide adequate guarantees, as provided for by art. 46 of EU Regulation 2016/679 "European Regulation on the protection of personal data".

10. Automated decision-making
The Data Controller does not carry out processing on the data of natural persons operating in the name and on behalf of suppliers that consists of automated decision-making processes.

11. Modification of the Privacy Policy
The owner reserves the right to modify, update, add or remove parts of this privacy policy at its discretion and at any time, by giving notice to it.

OFFICINE AMBROGIO MELESI S.r.l. recommends that you inform the Data Subjects (e.g. directors, employees and collaborators whose data the Company comes into possession of for the purposes of executing the contract) about the content of this Policy.