Data protection information

Contracts and commercial offers

Version of 16 October 2023 - MOD.INF.CTR.23-01

Introduction

Archiva Group, a brand owned by Archiva S.r.l. that brings together Archiva S.r.l. and Maxwell Consulting S.r.l., hereby informs you about the processing of personal data carried out in the context of the relationship with its customers.

Archiva S.r.l. and Maxwell Consulting S.r.l., with registered offices in via Spagna 24, 37069, Villafranca di Verona (VR), with reference to the personal data processed in the context of the relationship with their customers, take on the role of Data Controllers. They also take on the role of Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 when they process personal data, as part of the relationship with their customers, on behalf of other Archiva Group companies.

This information is provided pursuant to Article 13 of Regulation (EU) 2016/679.

Purposes of the processing and legal bases

The personal data of the data subject (in this case in relation to the relationship with its customers: legal representative, internal contacts...) will be processed:

• for purposes connected with the execution of pre-contractual or contractual measures, activities connected with and/or instrumental to the provision of such service, for purposes connected with the reprocessing of the same data.
  Legal basis of the processing: execution of the contract (ART. 6.1.B GDPR).
• for administrative-accounting fulfilments, such as accounting and treasury management, as well as invoicing, in compliance with what is required by current legislation or for the fulfilment of other obligations provided for by laws, regulations and national and EU legislation.
  Legal basis of the processing: fulfilment of a legal obligation to which the Data Controller is subject (ART. 6 .1.C GDPR). 
• to assert and/or defend the rights of the Controller in extrajudicial, judicial proceedings, litigation management, breach of contract, warnings, settlements, debt collection, credit protection, arbitration;
  Legal basis of the processing: pursuit of the legitimate interest of the Data Controller (ART. 6.1.F GDPR).

Nature and modalities of processing

All Personal Data Processing activities will be carried out in compliance with Regulation (EU) 2016/679, the Privacy Code Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 and/or subsequent additions and will be based on the principles of correctness, lawfulness and transparency, protecting confidentiality and fundamental rights and freedoms.The provision of personal data for purposes 1 and 2 is mandatory for the achievement of the purposes listed above. Therefore, their non-, partial or inaccurate conferment may result in the objective impossibility for the Data Controller to establish or regularly conduct the contractual relationship.

Personal data will be processed mainly at the registered office of the Data Controllers in Villafranca di Verona and/or in the locations of any Data Processors appointed pursuant to Article 28 of Regulation (EU) 2016/679 and will not be transferred to non-EU countries.

Categories of persons to whom personal data may be communicated

The personal data transmitted by the Customer or acquired in the course of the contractual relationship may be brought to the attention of employees or collaborators of the Data Controller, for activities connected with the provision of the activities covered by the contract, and of any Data Processors appointed pursuant to Article 28 of Regulation (EU) 2016/679, who, operating under the direct authoritỳ of the Data Controller, shall process data and receive adequate instructions in this regard. The same will be done by any Data Processors in respect of their employees or collaborators.

Please note that personal data may be communicated, within the limits strictly pertinent to the above-mentioned purposes, to the subjects essentially included in the following categories and whose complete list may be requested from the Data Controllers for the processing within their competence, at the following addresses:

• for Archiva S.r.l. This email address is being protected from spambots. You need JavaScript enabled to view it.;
• for Maxwell Consulting S.r.l. This email address is being protected from spambots. You need JavaScript enabled to view it.

Public Bodies and Administrations

for audits and controls in compliance with fiscal and civil obligations.

Banks and Credit Institutions

for the execution of economic/financial movements (payments/collections).

Law firms, consulting firms, notaries, accountants

for consultancy activities in their respective areas of professional competence.

IT infrastructure maintenance companies, software suppliers and manufacturers, cloud service providers

software production and delivery, for normal HW/SW maintenance activities, for any data restoration and for delivery of multimedia content

companies for the elimination of paper documentation and its storage

for the destruction of paper documentation and for its storage

Certification bodies and accreditation bodies

for verification activities in order to obtain and/or maintain the certifications acquired by Archiva S.r.l., Maxwell Consulting S.r.l.

Communication and event organisation agencies

for activities falling within their sphere of competence

Duration of data processing and storage

The personal data processed shall be kept for the time necessary to fulfil the purposes indicated and for any other legitimate purpose connected with the existing contractual relationship, in particular, the retention shall extend to the entire duration of the contract and, after its conclusion, for a maximum of 10 years pursuant to Article 2220 of the Italian Civil Code (Keeping of accounting records). In the case of out-of-court and judicial litigation (purposes referred to in point 3 of the "Purposes of the processing and legal bases" section), personal data will be retained for the entire duration of the litigation, until the lapse of the terms of prescription of the right and/or forfeiture of the action and/or the possibility of appeal. Once the aforementioned retention periods have elapsed (to be considered the last day of the corresponding month), the personal data will be destroyed or rendered anonymous, in compliance with the technical procedures of deletion and backup.

Data Protection Officer (dpo)

Archiva S.r.l., on a voluntary basis, has appointed a Data Protection Officer who can be contacted by e-mail This email address is being protected from spambots. You need JavaScript enabled to view it..

Rights of the interested party

At any time, the data subject may exercise his/her rights vis-à-vis the Data Controllers in accordance with Articles 15 to 21 of the GDPR, the provisions of which are recalled in full.

The data subject shall have the right to request from the Data Controllers, for the processing operations falling within the competence of each of them and at any time, access to his/her personal data, to rectify or erase them or to object to their processing; he/she shall also have the right to request the restriction of processing, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning him/her. Furthermore, the data subject will be able, at any time, to withdraw consent for the processing based on this legal basis without prejudice to the lawfulness of the processing, based on consent, carried out before the revocation.

Finally, the data subject may lodge a complaint with the competent Supervisory Authority in the event that he/she considers that his/her rights have been violated, in violation of the principles of the GDPR, according to the modalities indicated on the website of the Garante, accessible at www.garanteprivacy.it.

The aforementioned rights may be exercised by filling in the form available on the website www.archivagroup.com.

Amendments to the information notice

This information notice may be subject to updates in compliance with national and European regulatory provisions as well as by virtue of operational choices made by the Data Controllers. Unless otherwise specified, it will continue to apply to personal data processed up to that point.