Data protection policy for customers and suppliers

Dear Customer, Dear Supplier,

in compliance with Article 13 of EU Regulation 679/2016, hereinafter referred to as the "GDPR", Certego provides you with this information notice regarding the processing of your personal data and of the data concerning the data subjects belonging to your organization.

The Data Controller is Certego S.r.l. ("Certego"), with registered office in Modena, Via Ferruccio Lamborghini 81 - 41121 - Modena

The Data Controller has appointed, pursuant to Articles 37 and following, a Data Protection Officer (DPO), who can be contacted at the following email address:

Purpose and Legal Basis of Processing

Certego will process the collected personal data (e.g., identification and contact details of legal representatives and/or personnel of your organization) for purposes strictly related to the execution of the contract entered into or to be entered into, and in particular for:

1. the management of established commercial, contractual, and financial relationships;
2. compliance with legal obligations;
3. handling any requests made by the data subject;
4. technical support, after-sales assistance, customer satisfaction assessment, market analysis, and internal statistics.

The data will therefore be processed primarily on the basis of the necessity to fulfill the contract and/or legal obligations in tax/accounting matters (Article 6, paragraph 1, letters b) and c) of the GDPR).

Nature of Personal Data

In light of the above-mentioned purposes of processing, we inform you that providing your personal data is optional, but necessary to establish and maintain commercial and/or contractual relationships between the data subject and Certego. Failure to provide such data will make it impossible, to the extent that the data is necessary for the performance of the relationship, to establish and/or continue said relationship.

Processing Methods and Retention Period

Processing will be carried out using paper-based, computer-based, and telematic tools in accordance with the principles set out in Article 5 of the GDPR, and in particular those of lawfulness, fairness, transparency, relevance, data minimization, and in such a way as to ensure adequate security of personal data. The data being processed will be made available to individuals specifically authorized and/or expressly appointed as data processors by the Data Controller, according to their respective authorization profiles. The data will be retained for the entire duration of the contractual relationship and, thereafter, only for the time necessary to comply with legal obligations. Once such obligations have been fulfilled, the Data Controller will proceed with their deletion.

Disclosure and Dissemination of Personal Data

The personal data processed may be disclosed to companies within the group, to consultants insofar as necessary for the performance of their duties for the Company, to manufacturers, distributors, and suppliers of the Data Controller to the extent necessary for the execution of the activities covered by contractual relationships and/or data subject requests, to shipping companies for goods delivery and customs procedures, to banking institutions for the management of receipts and payments, to tax authorities and public bodies in compliance with legal obligations, and to legal firms for the protection of contractual rights, as well as to competent judicial and investigative authorities upon explicit request by said Authorities. The data will not be disseminated and, at present, there are no plans to transfer them to countries outside the European Economic Area.

Data Subject Rights

The data subject may exercise, at any time and under the conditions provided by the applicable legislation, the rights set out in Articles 15-22 of the GDPR. In particular, the data subject may exercise the following rights:

• Art. 15: Right of access to the processed personal data;
• Art. 16: Right to rectification of personal data;
• Art. 17: Right to erasure of personal data;
• Art. 18: Right to restriction of processing;
• Art. 20: Right to data portability;
• Arts. 21 and 22: Right to object and right not to be subject to automated decision-making, including profiling.

To verify the conditions and methods for exercising the above rights, please refer to the full text of the GDPR available at www.garanteprivacy.it.

To exercise these rights, the data subject may contact the Data Controller directly using the contact details provided above, or the Data Protection Officer by writing to:

The data subject also has the right to lodge a complaint with the supervisory authority of the EU country where they reside, work, or where the violation occurred. In Italy, the national supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11 - 00187 Rome (RM), Tel. +39 06 696771, Fax +39 06 69677 3785, email: garante@gpdp.it, PEC: protocollo@pec.gpdp.it.