Eustema S.p.A. is aware of the fundamental importance of protecting the Personal Data of its Suppliers, thereby providing that the processing of Personal Data is carried out in full compliance with the protections and rights recognized by the EU Regulation 2016/679 (hereinafter “GDPR”). This policy explains in detail who we are and and the purposes of the use your data, which you submitted for the establishment and execution of contractual relationships with us.

Who will process my data?

The Data Controller of the personal data provided through the website www.eustema.it is Eustema S.p.A. (hereinafter referred to as “Eustema” or the “Company”) with registered office in Rome at via Carlo Mirabello nr. 7, TAX CODE and VAT NUMBER no. 05982771007 contactable at the e-mail address: “privacy@eustema.it”. The Data Controller has appointed a Data privacy Officer (DPO) available at the following e-mail address: “dpo_privacy@eustema.it”.

The Data Controller, for some treatments, will be supported by the company Eustema S.p.A. with registered office in Rome at Via Carlo Mirabello nr. 7, CF and P. IVA 15957891003, which will act as Joint Data Controller. The Joint Data Controllers EUforLEGAL S.r.l. and Eustema S.p.A. have indeed stipulated a co-ownership agreement concerning the data processing according to art. 26 of the GDPR. An extract of the agreement of co-ownership for the treatment of personal data is made available upon request by sending an e-mail to the address privacy@eustema.it.

What data will you process?

The Company, during and for the purpose of the correct performance of the contractual relationship with the Customer, may collect, use, consult and more generally process Personal Data of the Customer such as:

personal data, tax code, VAT number and personal data of the Legal Representative or of the Agents

data of operational and administrative contacts (e.g. names, professional classification, telephone number, fax number, e-mail address, CVs).

Why do you need my data?

Your Personal Data will be used to:

• accomplish the obligations and operations closely related and necessary to the beginning of contractual relationships including the acquisition of information preliminary to the conclusion of the contract
• communications between the parties within the existing contract
• fulfilment of legal obligations and response to requests by the competent authorities
• fulfilment of accounting and fiscal obligations
• management of eventual litigation.

Should Eustema intend to further process Personal Data for purposes other than those for which they were collected, it will provide you with information regarding the different purposes and any other relevant information required by the GDPR prior to such processing.

The aforementioned processing has a legal basis related to the fulfillment of an existing contract between the parties in accordance with Art. 6.1, letter b) or to comply with the law.

Nature of data conferment

The transfer of Personal Data is compulsory for the opening and management of contractual relationships and necessary to meet any demands of the interested party (technical information, commercial, etc.). Any refusal on your part to submit these data could result in the non-execution or partial execution of the contract and / or the continuation of the relationship.

How do you treat my data?

Eustema aims to protect your data by treating them according to the principles of correctness, lawfulness and transparency. The data will be treated with appropriate procedures to protect confidentiality and the treatment consists in their collection, recording, organization, storage, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation, destruction of the same including the combination of two or more of the above activities. The processing of Personal Data for the abovementioned purposes will take place mainly through automated and computerized procedures, or manually.

Data will be stored on computer and/or in paper archives. Physical, electronic and procedural security measures appropriate to the sensitivity of the information in our possession will be adopted.

Who will you share my data with?

Your data will not be disclosed, they will not be communicated to unspecified subjects, in any way. They will not being made available nor consulted.

They may be communicated to certain subjects such as:

• employees and/or collaborators of the Owner or of the Co-owner, adequately instructed, who have been entrusted with specific and/or more data processing activities within the limits of their competence and in accordance with the instructions given to them;
• employees and/or collaborators of Softjam S.p.A., a wholly-owned subsidiary of the Joint-owner Eustema S.p.A;
• third parties who perform part of the processing activities or activities related and instrumental to such activities on behalf of the Owner or the Co-owner, such as professionals and companies responsible for carrying out technical, managerial and administrative-accounting activities or, in general, consultancy on the basis of a contractual relationship or professional assignment. These subjects act, where appropriate, as Data Processors, pursuant to Article 28 of the GDPR;
• third parties who carry out processing activities and/or activities connected with and related to the same as independent data controllers, including but not limited to credit institutions, insurance companies, debt collection companies
• subjects legitimated to access the data by virtue of provisions of law, regulations, community norms such as, for example, public bodies or judicial authorities.

Will my data be transferred abroad?

The data are processed within the European Union. In case it is necessary to transfer the data outside the European Union, the Data Controllers commit to comply with the provisions of Chapter V of the GDPR and to do what is necessary to ensure adequate levels of protection and safeguarding of Personal Data.

How long will my data be stored?

Your Data will be processed for the entire duration of the contractual relationship established and beyond, for the performance of all legal obligations. Data will be kept for a period of time no longer than the period necessary for the purposes for which they were collected or subsequently processed (management of the contractual relationship and fulfillment of tax obligations, also with reference to any litigation) in accordance with the current regulations, unless a longer storage period is imposed or authorized by law.

What are my rights?

You can exercise your rights in any moment and, among these, in particular:

Right of Access: you have the right to access your Personal Data held in order to verify whether the Personal Data is processed in accordance with the law.

Right to Rectification: You have the right to obtain the rectification of any inaccurate or incomplete information in order to ensure the accuracy of such information in accordance with the purposes of the processing.

Right to Erasure: you have the right to request that the Data Controller and/or Co-Processor erase Your information and no longer process such data in the cases provided for by the GDPR.

Right to Restriction of Processing: you have the right to request that the Data Controller and/or the Joint Data Controller limits the processing of the Data.

Right to Data Portability: you have the right to receive in a structured, commonly used and machine-readable format Your Personal Data and to transmit such Data to another Data Controller.

Right to object to processing: you have the right to object to the processing of Your Data in the cases provided for by the GDPR, at any time and without having to justify your decision.

Right not to be subjected to automated decision-making processes: you have the right not to be subjected to a decision based solely on automated processing of your Data, including profiling, which produces legal effects against you or significantly affects you in a similar way.

You may exercise Your rights at any time by writing to the following e-mail address: privacy@eustema.it and we will take care of your request to ensure with the utmost effort the exercise of your rights.

Finally, you will have the right to lodge a complaint with the Italian Data Protection Authority or any other competent supervisory authority.