GDPR Information Notice (Article 13) – Customers and Suppliers

1. Data collected

Contact details of business contacts; job title/position; commercial communications; orders; deliveries; contracts; invoices; bank details (RIB/IBAN); payment incidents.

2. Purposes and legal bases

Data are processed for the following purposes:

  • management of business opportunities, quotations, orders, deliveries and invoicing;

  • commercial relationship management and support;

  • compliance with legal and regulatory obligations;

  • proportionate B2B marketing activities.

The applicable legal bases are:

  • performance of a contract (Article 6(1)(b) GDPR);

  • legitimate interest (Article 6(1)(f) GDPR).

3. Recipients / access

Data are accessible to the Purchasing, Sales, Supply Chain, Quality and Accounting departments.
They may also be shared with group entities for centralized tasks, banks, IT service providers, and competent authorities where required by law.

4. Transfers outside the European Union

Where applicable, transfers outside the European Union are governed by an adequacy decision and/or by Standard Contractual Clauses, together with additional safeguards where necessary.

5. Data retention periods

  • Contractual records: 5 years after the end of the business relationship;

  • accounting records: retained in accordance with applicable legal requirements;

  • payment data: 13 months after the last payment, unless a dispute is ongoing.

6. Mandatory nature of data and consequences

Certain data are necessary to enter into and perform contracts.
Failure to provide such data means that the contractual relationship cannot be established or maintained.

7. Automated decision-making

No automated decision-making producing legal or similarly significant effects is implemented (in particular, no enforceable automated scoring).

8. Your GDPR rights and how to exercise them

You have the following rights:

  • right of access to your data (Article 15);

  • right to rectification (Article 16);

  • right to erasure (Article 17);

  • right to restriction of processing (Article 18);

  • right to object (Article 21), including to direct marketing;

  • right to data portability (Article 20, where applicable);

  • right to withdraw your consent at any time (without retroactive effect).

To exercise your rights, you may contact the Data Protection Officer (DPO) or the data controller.
The response time is one month and may be extended by two months in the event of a complex request.