PRIVACY POLICY FOR SUPPLIERS

Dear Sir/Madame,

we need to process information concerning you, your personal data, for the preparation and execution of the supply contract of which you are a party, or intervene as a representative of the supplier, or participate as a worker; to this end, as required by the European legislation for the protection of personal data (European Regulation 679/2016), we provide you with the following information.

1. Data Controller and Data Protection Officer.

The Data Controller, i.e. the person responsible for decisions regarding the purposes, methods and security of personal data, is the company F.lli Pisa Srl with headquarters in Milan, via Montenapoleone n.9, 20121 Milan, tel 0276021998, email compliance@pisa1940.com, PEC f.llipisa@legalmail.it.

The person responsible for personal data protection (DPO) can be reached both at the contact points of the owner and at the email address dpo@pisa1940.com. 

2. Purposes and legal bases of the processing.

The personal data that you provide to us and that will be collected during the provision of the services covered by the supply contract will be processed for the purposes according to the legal bases indicated below:

Purpose   (Why we process your data)	Legal basis   (Based on which legal provision we treat them.)	Consequences in case of refusal to treatment   (What happens if you refuse to provide personal data and/or authorize processing)
Fulfillment of the supply contract of which you are a party, or in which you represent the legal person that is a party to it, or in which you participate as a worker.	Art. 6, Para. 1, Letter b) GDPR - the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the interested party.	Consent is not required, however, if you refuse to provide personal data, the contract cannot be executed.
Fulfillment of legal obligations in accounting and tax matters linked to the aforementioned contract.	Art. 6, Par. 1, Letter c) GDPR - the processing is necessary to fulfill a legal obligation to which the data controller is subject.	Consent is not required, however, if you refuse to provide personal data, the contract cannot be executed.
Selection, training and maintenance of a list of the Company's suppliers	Art. 6, Par. 1, Letter f) GDPR – legitimate interest of the Company in forming and maintaining a list of its suppliers, including selection activities.	Consent is not required. An objection can be made at any time. The treatments prior to the opposition remain valid.

3. Recipients and categories of data processed.

The personal data provided by you or acquired during the service will be processed exclusively by personnel authorized for this purpose or by data controllers designated for this purpose.

In addition to the subjects for whom communication is mandatory by law, your data may be communicated exclusively to:

Purpose	Data category	Recipients
Accounting, administrative and fiscal obligations. Fulfillments relating to legal and statutory obligations.	Identifiers of representatives or contract contacts.	Professionals and/or companies that carry out accounting/tax data processing activities, auditing companies, control bodies.

4. Moving abroad

Your personal data is not transferred outside the European Union.

5. Personal data retention period and criteria used.

The personal data being processed are collected in documents whose storage is established consistently with the processing purposes as summarized below.

Document	Shelf life
Contract documentation	Ten years from the termination of the contractual relationship unless there are legitimate reasons for suspension.
Administrative, accounting, fiscal documentation.	Ten years from the termination of the contractual relationship unless there are legitimate reasons for suspension.

6. Rights of the interested party.

Interested parties have the right to obtain from the Data Controller, in the cases provided for, access to their personal data and the rectification or cancellation of the same or the limitation of the processing that concerns them or to oppose the processing (articles 15 et seq. of the Regulation). The specific request to the Company is submitted to the owner's contact details indicated above.

7. Right to complain

Interested parties who believe that the processing of personal data relating to them carried out through the search and selection of personnel occurs in violation of the provisions of the Regulation have the right to lodge a complaint with the Guarantor, as provided for by the art. 77 of the Regulation itself, or to take action in the appropriate judicial offices (art. 79 of the Regulation).

8. Collaboration

The protection of data concerning you and compliance with the principles established by law, with particular reference to the principle of transparency, are values ​​of primary importance for us, we will be grateful if you would like to help us by reporting any misunderstandings of this document or suggesting improvements at the references of the owner as indicated above.