Name and contact details of the controller
article 4, paragraph 7, GDPR
Esto srl
Rebecca Stolzlechner
Via Gisse, 109
I-39030 Valle Aurina/San Giovanni
T +39 0474 671 496
info@esto-innovation.eu
PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
Pursuant to Articles 12 et seq. of Regulation (EU) 2016/679 (“GDPR” or the “Regulation”), and in general in compliance with the principle of transparency set out therein, the following information is provided regarding the processing of personal data (i.e., any information relating to an identified or identifiable natural person – the “Data Subject”) in connection with relationships with customers and suppliers.
1. DATA CONTROLLER
The “Data Controller” (i.e., the entity that determines the purposes and means of the processing of personal data) is:
ESTO S.r.l./GmbH, with registered office at 39030 St. Johann (BZ), Gisse 109, Tax Code and VAT No. 02836030219.
2. PURPOSES OF PROCESSING
Personal data will be processed for the following purposes:
evaluation of offers and, where applicable, conclusion of contracts and fulfillment of contractual obligations (both on behalf of and in favor of the Controller), and therefore for purposes strictly connected to the management of the pre-contractual and contractual relationship with the customer or supplier, as well as the related legal obligations, including administrative, accounting and tax requirements (for example: collection of information prior to the conclusion of the contract; performance of activities based on obligations arising from the concluded contract), and the protection of rights (contractual purpose).
3. TYPES OF DATA PROCESSED, COLLECTION METHODS AND DATA SUBJECTS
The data processed fall within the category of ordinary personal data, such as:
- surname, name, date and place of birth, residence;
- tax code and/or VAT number and other tax-related data, including the “recipient code” (SdI) for electronic invoicing;
- telephone number / email address / certified email (PEC) address;
- data relating to the supply;
- (where applicable, e.g. in cases of joint liability) data relating to compliance with salary and social security obligations.
Please note that, in addition to the data of the customer or supplier, data relating to associated persons may also be processed, always belonging to the category of ordinary data, such as directors, employees and collaborators, particularly with regard to their names and contact details (telephone and email).
Such data are provided by the customer or supplier, by the Data Subject, or are obtained from public registers (such as the Chamber of Commerce or civil registry) or collected from competent authorities in relation to necessary checks (e.g. regarding social security compliance).
4. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION AND LEGAL BASIS
With regard to the contractual purpose, there is no obligation to provide data in the pre-contractual phase; however, failure to provide the requested data may make it impossible to conclude the contract.
Once the contract has been concluded, the provision of additional necessary data, or the updating of those already provided, is mandatory for all purposes required by legal and contractual obligations. Therefore, refusal to provide such data, in whole or in part, may result in the Controller being unable to perform the contract and may also constitute a contractual breach or violation of law (where such data are required to comply with legal obligations or authority provisions, as will be specified at the time of the request).
The legal basis for processing for the “contractual purpose” is that it is necessary:
- for the performance of a contract to which the Data Subject is party or for pre-contractual measures taken at the request of the Data Subject;
- for compliance with a legal obligation to which the Controller is subject.
The protection of rights is based on the legitimate interest of the Controller. Likewise, within the scope of the Controller’s legitimate interest in carrying out its business activities, there are processing activities (such as entering data into management systems or contact lists, turnover analysis, internal service quality checks, etc.) which, although not mandatory, are closely connected to the execution of the contractual relationship.
5. METHODS OF PROCESSING AND DATA RETENTION
Processing will be carried out:
- using manual and automated systems;
- by authorized persons or categories of persons assigned to perform related tasks;
- with appropriate measures to ensure data confidentiality and to prevent unauthorized access.
Data will be retained for the entire duration of the contractual relationship and, after its termination – limited to the data necessary at that stage – for the fulfillment of contractual obligations and all legal requirements, as well as for the protection of rights related to or arising from the relationship.
If the offer made is not accepted, the data will be deleted as soon as it is clear that no contractual relationship will be established.
There are no automated decision-making processes.
6. DATA DISCLOSURE
The collected and processed data may be disclosed, exclusively for the purposes specified above, to:
- all parties entitled to access such data under legal provisions;
- employees, collaborators and service providers of the Controller, within the scope of their duties and/or contractual obligations related to the execution of the relationship with the Data Subjects; such service providers may include, by way of example, banks and financial institutions, insurance companies, legal advisors, software providers and support services; the list of data processors may be requested using the contact details provided above;
- tax authorities and other bodies where disclosure is required by law.
The data are not subject to public dissemination.
7. PLACE OF PROCESSING
The processing of personal data takes place within the territory of the European Union.
There is no intention to transfer data outside the European Union or to an international organization.
8. RIGHTS OF THE DATA SUBJECT
The GDPR grants the Data Subject the following rights with regard to their personal data (a summary description is provided; for full details and limitations, please refer to the Regulation, in particular Articles 15–22):
- right of access (the Data Subject has the right to obtain, free of charge, information regarding their personal data held by the Controller and the related processing, as well as to receive a copy in an accessible format);
- right to rectification (correction or completion of inaccurate or outdated personal data, upon request of the Data Subject);
- right to erasure (“right to be forgotten”) (e.g. where data are no longer necessary, have been unlawfully processed, must be deleted to comply with legal obligations, or where consent has been withdrawn and no other legal basis applies);
- right to restriction of processing (in certain cases, such as when accuracy is contested, processing is unlawful but deletion is opposed, or data are needed for legal claims);
- right to object, in whole or in part, on grounds relating to the particular situation of the Data Subject, to processing based on legitimate interest;
- right to data portability (where processing is based on consent or a contract and carried out by automated means, the Data Subject may receive their data in a structured, commonly used, machine-readable format and transmit them to another controller).
The Data Subject also has the right to lodge a complaint with the Data Protection Authority if they believe that the processing of their data violates applicable data protection laws. The authority can be contacted via the website www.garanteprivacy.it.
In any case, the Controller would appreciate the opportunity to address any concerns in advance. Data Subjects may contact the Controller via the email address info@esto-innovation.com or the other contact details provided above for any clarification regarding the processing of their personal data or to exercise their rights.