Privacy Policy

Pursuant to art. 13 of the General Data Protection Regulation n. 2016/679 (“Regulation”), Tecma S.r.l. (“Company”), provides the following information to its business partners who undertake to transfer such information to data subjects.

1. Data controller

Tecma S.r.l., P.IVA 01237490154, with registered office in Milan, Via A. Milesi 5/7, 20133.

2. Categories of processed data

The processing will involve personal data provided by the other party to the agreement at the time of conclusion of the relevant agreement with the Company (the “Agreement”), such as the personal information, place of birth, residence details, tax code and/or VAT number , telephone number/e-mail address, bank account details and any subsequent variations, as well as the additional information provided by the other party to the Agreement or acquired by the Company during the contractual relationship (“Personal Data” or “Data”). All these information are considered Personal Data in accordance with applicable laws as long as such Data relate directly or indirectly to identified or identifiable individuals (for example, directors, employees, managers, consultants of the other party to the agreement), or to the other party of the Agreement as individual.

3. Purposes of Data processing, legal basis and consequences of missed provision of the same

Personal Data are processed by the Company for the following purposes:

a) legal and administrative obligations governing the Company;

b) entering into and manage the Agreement with the Company. To that end, your Personal Data will be processed in the context of the activities of: administration, accounting, contract management, services, invoicing/payments, auditing and certification of financial statements required/optional, assignment or advance loans and to fulfill specific requests and to fulfil the other obligations arising from the Agreement.

A refusal to provide Personal Data for the above mentioned purposes, will result in the impossibility to start and continue the contractual relationship with the Company.

The processing of Personal Data may take place also within a legal action or in any corporate event (acquisition or transfer of going concern) and while carrying out a due diligence activity. Any such processing might be carried out on the basis of a legitimate interest of the Company, which intends to protect its interests and its rights pursuant to applicable laws and to conduct business activities deemed to be the most appropriate.

Always on the basis of the legitimate interest of the Company, individuals authorized by the latter may contact the data subjects within the Agreement, for purposes related to the Agreement and in order to assess further business opportunities, also in relation to specific aspects of the contractual party and of its personnel.

4. Processing modalities

Personal Data listed in paragraph 2 above, are mainly processed in physical form as well as with hardcopy and with electronic and IT tools which guarantee security and confidentiality of the Data, and the processing will always be carried out by authorized individuals.

5. Disclosure and transfer of Data

Personal Data may be disclosed by the Company, solely and exclusively for the purposes mentioned above, as well as where necessary, to the following categories:

• – banks and credit institutions;

2 Last Update: June 01, 2018

• – legal counsels, auditors and accountants;
• – debt collection companies;
• – companies which assess financial risks and carry out activities to prevent fraud;
• – public administrations and Supervisory Authorities, Judicial Authorities;
• – companies that provide IT services;

Personal Data will not be disseminated.

With reference to the communicated Personal Data, the subjects belonging to the above mentioned categories will operate, depending on the case, as processors of the Company (in which case they will receive appropriate instructions from the Company) or as distinct data controllers. In this case, Personal Data will be communicated only with the express consent of the individuals concerned, except in cases where such communication is mandatory or required by applicable laws or for purposes for which the consent of the data subject is required by applicable law.

In some cases it could be necessary for the achievement of the purposes referred to in paragraph 3 above, that the Data may also be transferred abroad to companies established both within and outside the European Union. Some of these jurisdictions may not offer the same level of data protection guaranteed by the country in which the person concerned is resident. In such case, the Company undertakes that Data is treated confidentially by obtaining, if necessary, agreements that ensure an adequate level of protection and/or by adopting the standard contractual terms envisaged by the European Commission.

6. Data retention period

Personal Data may be retained for a period pursuant to the applicable law, for a period of time no longer than necessary to the above mentioned purposes of processing. The criteria to determine such retention period of the Data take into account the allowed retention period and the applicable laws on tax, prescription rights and the nature of the legitimate interests if these constitute the legal basis of the processing.

Pursuant to applicable law, Personal data may be retained for a longer period than the one originally set, in case of any dispute or request of the competent authorities.

In any case, at the end of the retention period, data will be deleted or aggregated or anonymized.

7. Your rights

In any moment, the data subject shall have the right to:

• obtain confirmation from the Company on whether or not there is an ongoing processing of his/her Personal Data and, if so, to obtain access to the Data according to section 15 of the Regulation;
• obtain rectification of his/her Personal Data which are inaccurate, as well as obtain the completion of the same Data;
• obtain the erasure of the Data, according to art. 17 of the Regulation, where applicable;
• withdraw in any moment the consent already given. The withdrawal does not compromise the lawfulness of the processing based on the given consent.
• restrict the processing of his/her Personal Data according to art. 18 of the Regulation;
• object to the processing of his/her Personal Data for particular reasons, where applicable;
• receive the Personal Data in a structured, commonly used and machine-readable format and have the right to transmit those Data to another controller, according to art. 20 of the Regulation.

The Company may ask further information before answering the requests, if the Company should need to verify the identity of the individual causing the same request.

Pursuant to the Regulation, the Company is not authorized to charge costs for fulfilling one of the requests set out in this paragraph, unless they are manifestly unfounded or excessive, and particularly repetitive. In cases where a data subject requires more than one copy of his/her Personal Data or in cases of excessive or unreasonable requests, the Company may (i) charge a reasonable fee, taking 3 Last Update: June 01, 2018

into account the administrative costs incurred to process the request or (ii) refuse to meet the request. In these cases the Company will inform the data subjects of the costs before processing the request.

Such rights may be exercised by submitting a request by e-mail to privacy@tecma.it.

Without prejudice to any other administrative or judicial appeal, you will also have the right to claim to the competent authority (for Italy: the authority for the protection of personal data), if you believe that any processing is carried out in breach of the Regulation. More information are available on the website http://www.garanteprivacy.it.

In any case, the Company invites the data subjects to contact directly through the channels indicated above, before contacting the competent authority, so as to resolve amicably and in the shortest time possible any dispute regarding the protection of personal data.

8. Publicity

This information policy is also published on the website of the Company www.tecma.it with express indication of its last update.