data protection information suppliers

Transparent relations also with our suppliers.

In Archiva, we believe that, above and beyond the norm, transparency and data protection are indispensable prerogatives for lasting relationships.

Data protection information

Suppliers

Version 16 October 2023 - MOD.INF.FOR.23-01

Introduction

Archiva Group, brand owned by Archiva S.r.l. that joins Archiva S.r.l. and Maxwell Consulting S.r.l., hereby informs you about the processing of personal data carried out within the relationship with its suppliers.

Archiva S.r.l. and Maxwell Consulting S.r.l., with registered offices in via Spagna 24, 37069, Villafranca di Verona (VR), with reference to the personal data processed as part of the relationship with their suppliers, take on the role of Data Controllers. They also take on the role of Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 when they process personal data, as part of their relationship with suppliers, on behalf of other Archivagroup companies.

This information is provided pursuant to Article 13 of Regulation (EU) 2016/679.

Purpose of the processing and legal basis

The personal data of the data subject (in this case in relation to the relationship with its suppliers: legal representative, internal contacts...) will be processed:

  1. for purposes connected to pre-contractual (e.g. offer management) and/or contractual Archivagroup-Supplier fulfilments. The processing may also involve the personal data of the Supplier's employees/collaborators involved in the activities.
    Legal basis of the processing: the execution of pre-contractual and/or contractual measures (ART. 6 .1. B GDPR);
  2. for the fulfilment of administrative-accounting requirements, such as the management of accounting and administration, in accordance with the requirements of the regulations in force, or for the fulfilment of other obligations provided for by laws, regulations and EU legislation.
    Legal basis of the processing: fulfilment of a legal obligation to which the Data Controller is subject (ART. 6 .1.C GDPR);  
  3. to assert and/or defend the rights of the Controller in extrajudicial, judicial proceedings, litigation management, breach of contract, warnings, settlements, debt collection, credit protection, arbitration.
    Legal basis of the processing: pursuit of the legitimate interest of the Data Controller (ART. 6.1.F GDPR);
  4. to carry out checks on the Supplier's compliance with the requirements of the selective policies and procedures.
    Legal basis of the processing: pursuit of the legitimate interest of the Data Controller (ART. 6.1.F GDPR).

Nature and methods of processing

All personal data processing activities will be carried out in compliance with Regulation (EU) 2016/679, the Privacy Code Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 and/or subsequent additions and based on the principles of correctness, lawfulness and transparency, protecting confidentiality and fundamental rights and freedoms. The provision of personal data for purposes 1 and 2 is mandatory. Therefore, their non-, partial or inaccurate conferment may result in the objective impossibility for the Data Controller to establish or regularly conduct the contractual relationship.
Personal data will be processed mainly at the registered office of the Data Controllers in Villafranca di Verona and/or in the locations of any Data Processors appointed pursuant to Article 28 of Regulation (EU) 2016/679 and will not be transferred to non-EU countries.

Categories of persons who may become aware of personal data

The personal data transmitted by the Supplier or acquired in the course of the contractual relationship may be brought to the attention of employees or collaborators of the Data Controller, for activities connected with the provision of the activities covered by the contract, and of any Data Processors appointed pursuant to Article 28 of Regulation (EU) 2016/679, who, operating under the direct authoritỳ of the Data Controller, shall process data and receive adequate instructions in this regard. The same will be done by any Data Processors in respect of their employees or collaborators.

Please note that personal data may be communicated, within the limits strictly pertinent to the above-mentioned purposes, to the subjects essentially included in the following categories and whose complete list may be requested from the Data Controllers for the processing within their competence, at the following addresses:

Public Bodies and Administrations

for audits and controls in compliance with fiscal and civil obligations.

Banks and Credit Institutions

for the execution of economic/financial movements (payments/collections).

Law firms, consulting firms, notaries, accountants

for consultancy activities in their respective areas of professional competence.

IT infrastructure maintenance companies, software suppliers

for normal HW/SW maintenance activities, software production and delivery or for any data restoration.

Companies for the elimination of paper documentation

for the destruction of paper documentation.

Certification bodies and accreditation bodies

for verification activities in order to obtain and/or maintain the certifications acquired by Archiva S.r.l. and Maxwell Consulting S.r.l. 

Duration of data processing and storage

The personal data processed will be kept for the time necessary to fulfil the purposes indicated and for any other legitimate purpose connected to the existing contractual relationship. In particular, the retention will extend to the entire duration of the contract and, after its conclusion, for a maximum of 10 years pursuant to article 2220 of the Italian Civil Code (Keeping of accounting records). In the event of extrajudicial and judicial litigation (purposes under point 3 of the section "Purposes of the processing and legal bases"), personal data will be kept for the entire duration of the litigation, until the lapse of the terms of prescription of the right and/or forfeiture of the action and/or the possibility of appeal. Once the aforementioned retention periods have elapsed (to be considered the last day of the corresponding month), the personal data will be destroyed or rendered anonymous, in compliance with the technical procedures of deletion and backup.

Data Protection Officer (dpo)

Archiva S.r.l., on a voluntary basis, has appointed a Data Protection Officer who can be contacted by e-mail This email address is being protected from spambots. You need JavaScript enabled to view it..

Rights of the interested party

At any time, the data subject may exercise his/her rights vis-à-vis the Data Controllers in accordance with Articles 15 to 21 of the GDPR, the provisions of which are recalled in full.

The data subject shall have the right to request from the Data Controllers, for the processing within their competence and at any time, access to his/her personal data, to rectify or erase them or to object to their processing; he/she shall also have the right to request the restriction of processing, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning him/her. Furthermore, the data subject will be able, at any time, to withdraw consent for processing based on this legal basis without prejudice to the lawfulness of the processing, based on consent, carried out before the revocation.

Finally, the data subject may lodge a complaint with the competent Supervisory Authority in the event that he/she considers that his/her rights have been violated, in violation of the principles of the GDPR, according to the modalities indicated on the website of the Garante, accessible at www.garanteprivacy.it.

The aforementioned rights may be exercised by filling in the form available on the website www.archivagroup.com.

Amendments to the information notice

This information notice may be subject to updates in compliance with national and European regulatory provisions as well as by virtue of operational choices made by the Data Controllers. Unless otherwise specified, it will continue to apply to personal data processed up to that point.