SUPPLIERS PRIVACY information

―

Privacy Notice pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR)

This privacy notice is issued in accordance with Articles 12 and 13 of Regulation (EU) 2016/679 for the benefit of data subjects (suppliers) who enter into supply contracts with the Data Controller or engage in pre-contractual communications.

The Data Controller is Teclumen Srl, with registered office at Via Castel Goffredo, 35/1 - 46040 Casaloldo (MN) – Italy.
Contact details: +39 0376 778670 | Email: info@teclumen.it

The Data Controller has appointed a Data Protection Officer (DPO), identified as Dr. A.R., who can be contacted via email at: dpo@teclumen.it or by writing to the Data Controller, attention: DPO.

Categories of data subjects: Suppliers and potential suppliers.

Categories of personal data processed:
Teclumen Srl will process your general identification and contact data, such as full name, home and business address, email/PEC address, phone/mobile number, as well as accounting, tax, postal, and banking information, in accordance with the purposes and methods described below.

The personal data mentioned are exclusively those you have provided during negotiations and/or the potential conclusion of a supply contract.

Your personal data will be processed for the following specific purposes:
a) performance and execution of the contract for the supply of goods/services;
b) responding to your requests prior to the conclusion of a contract;
c) supplier management (selection, contract administration, orders, shipments, etc.);
d) compliance with tax, administrative, technical and/or accounting obligations and exercising your data protection rights;
e) internal control services (security, productivity, quality of services);
f) management of disputes (contractual breaches, warnings, settlements, debt collection, arbitration, litigation, and legal proceedings).

Legal basis for processing:

• For purposes a) to c): Article 6(1)(b) GDPR – "performance of a contract or pre-contractual measures".
• For purpose d): Article 6(1)(c) GDPR – "compliance with a legal obligation to which the controller is subject".
• For purposes e) and f): Article 6(1)(f) GDPR – "legitimate interest pursued by the controller".

Nature of data provision:
Providing your personal data is always optional; however, for the purposes outlined from a) to f), it is necessary for entering into and executing the contract and fulfilling related obligations. Failure to provide the data will result in our inability to provide our services. Subscription to our newsletter
remains entirely optional.

Data processing methods:
Your personal data will be processed in paper, electronic, and digital formats using technical and organizational measures that ensure an appropriate level of security. Processing will be carried out by authorized personnel in compliance with legal requirements, ensuring confidentiality, data
security, accuracy, timeliness, and relevance of the data in accordance with the declared purposes and methods.

We also inform you that the Data Controller does not make use of automated decision-making processes nor does it carry out profiling activities.

Data recipients:
Without prejudice to disclosures required by law, your personal data may be accessed, in addition to the Data Controller and its authorized personnel, by:

• service providers necessary for the proper execution of the contract and company operations (e.g., IT maintenance, independent professionals);
• public authorities, for any matters relating to the protection of individual rights and freedoms.

These recipients act as independent data controllers or data processors. Your personal data will not be transferred to third parties and will not be subject to dissemination.

Extra-EU data transfers:
The Data Controller informs you that your data will be processed exclusively within the European Union.

Data retention periods:
In accordance with the principles of necessity and proportionality, the Data Controller has defined the following retention periods based on the purpose of processing:

• Contract performance and execution: 10 years
• Responding to pre-contractual requests: 6 months
• Compliance with tax, administrative, technical and/or accounting obligations and exercising data protection rights:
  • 10 years for legal obligations
  • 2 years from the date of response for data protection rights
• supplier management: 10 years
• Internal control services: until the end of the contract, including warranty periods
• Dispute management: until expiration of the statute of limitations

After the end of the retention period, your data will be deleted from all databases, applications, and archives, both electronic and paper-based, in which they were stored.

Data Subject Rights
You may exercise your rights under Articles 15 to 22 of the GDPR, including:

• Right of access: confirm whether your personal data are being processed and access details on origin, purpose, categories of data processed, recipients, etc.;
• Right to rectification: correct inaccurate or incomplete personal data, including by submitting a supplementary statement;
• Right to erasure: request deletion of your data when no longer necessary for the purposes, if consent has been withdrawn, if data are unlawfully processed, or if required by law;
• Right to object: object at any time to processing based on the legitimate interest of Teclumen Srl;
• Right to restriction of processing: request limitation of processing when the accuracy of the data is contested (for the time necessary for verification), if the processing is unlawful, if data are needed for legal defense, or while evaluating the objection;
• Right to data portability: where applicable, receive your data in a structured, commonly used, machine-readable format and transmit them to another controller, when processing is based on consent or a contract and performed by automated means;
• Right to lodge a complaint: if you believe the processing of your data violates the GDPR, you have the right to file a complaint with a Supervisory Authority.

How to exercise your rights:
Send your request to Teclumen Srl by email to: privacy@teclumen.it
Or by post to:
Teclumen Srl – Privacy Office – Via Castel Goffredo, 35/1 – 46040 Casaloldo (MN) – Italy

The Data Controller will acknowledge receipt and provide information on the action taken within one (1) month of receiving your request.