Supplier policy

Dear Supplier,
as required by applicable laws, we hereby provide you with the following information regarding the processing of the data provided by you and/or otherwise collected by us or by other companies within the Serioplast Group.

Identity and contact details of the Data Controller

The Data Controller is Serioplast Global Services S.p.A., with registered office in Seriate (BG), at Via Comonte No. 15, Tax Code and VAT No. 04256350168, represented by its legal representative pro tempore, and belonging to the Serioplast Group (hereinafter also referred to as the “Group”).

An up-to-date list of the companies belonging to the Group is available at the following web address: “https://www.serioplast.com/it/contatti/”. These companies may, where applicable, process the data as Joint Controllers, as provided for in the Joint Controllership Agreement drawn up pursuant to Article 26 of the EU Regulation, which is available at the registered office of Serioplast Global Services S.p.A.

To contact the Data Controller and/or the individual Joint Controllers, you may also write to the following email address: privacy@serioplast.com.

Types of data: personal and ordinary data

The Data Controller and the other companies within the Group undertake to process the data provided by you, with particular reference to the data of personnel responsible for the performance and management of contracts in place with the Data Controller and/or other companies within the Group – including first name, surname, contact details, email addresses and professional qualifications, where relevant, for the personnel employed; any data relating to salaries and contributions paid, as well as compliance with social security contribution obligations in respect of personnel used to provide services at the Data Controller’s premises or at those of another company within the Group, where such data are necessary to carry out checks on compliance with regulations protecting workers, as specified in procurement contracts – any data relating to legal representatives, including any judicial data required by law, as well as data provided at the premises of the Data Controller and/or other companies within the Group by your personnel (hereinafter collectively referred to, for the sake of brevity, as the “Data Subjects” or, individually, as the “Data Subject”), as well as data otherwise collected by the Data Controller (e.g. for video surveillance purposes), for the purposes set out below and in compliance with the applicable privacy legislation, both EU legislation (e.g. EC Regulation 679/16) and national legislation (e.g. Legislative Decree 196/03 in Italy).

The Data Controller and the other companies within the Group may also process, exclusively for the purposes set out below and always in compliance with the aforementioned legislation, ordinary data such as, for example, personal details, electronic and telephone contact details, position/responsibilities held within the supplier company/entity, together with economic and financial data, company name, registered offices and bank details.

Any personal data relating to the Data Subjects may also be collected through video surveillance systems installed in the access and/or exit areas of the Data Controller’s premises or, where applicable, those of other companies within the Group, as well as inside the premises themselves where the Data Subjects are present, in accordance with the information provided in the privacy notice relating to the processing of data for video surveillance purposes, available at the sites where a video surveillance system is installed.

Relationship between the Data Controller and the Group companies in the processing of ordinary data

The Data Controller has a legitimate interest in sharing the aforementioned data with the other companies within the Group (and vice versa), including by incorporating them into centralised databases. In particular, ordinary data may therefore be made accessible to all companies within the Group and to persons authorised by them to process the data, in accordance with the respective data processing agreements.

Purposes and legal basis for processing

The collection and processing of data are carried out for:

  • the performance and management of the contractual or pre-contractual relationship;
  • the fulfilment of the related management, administrative and accounting obligations;
  • the possible protection of the rights of the Data Controller and/or the other companies within the Group.

Personal data and ordinary data will be processed in accordance with the principles of fairness, lawfulness and transparency, for the purposes set out above, as well as to respond to requests submitted by you, including on behalf of and for the account of the Data Subjects.

The provision of data is optional, but necessary for the performance of the contractual relationship and, in particular, for the fulfilment of the related obligations, especially those of an administrative and accounting nature.

Possible recipients and categories of recipients of the data

The data, both personal and ordinary, may be disclosed to the following recipients:

  • customers and suppliers of products or services, for the performance of the contractual relationship or for related obligations;
  • public administrations or public bodies, for the fulfilment of legal obligations;
  • insurance companies and credit institutions;
  • internal personnel of the Data Controller or the Joint Controllers who have received specific instructions;
  • external parties appointed as Data Processors (for example, IT consultants and companies specialising in software);
  • professionals and companies providing corporate administration and management services.

The data processed will not be disseminated, i.e. they will not be made available to persons who have not been previously identified. However, they may be disclosed to identified parties involved in the fulfilment of contractual and/or pre-contractual obligations, including, by way of example and without limitation, companies within the Group, whether located in Italy or abroad.

Methods of processing

All data collected by the Data Controller, as well as data shared with and/or collected by other companies within the Group, will be processed using paper-based, electronic and IT systems, in a lawful manner and with the utmost confidentiality and in compliance with applicable legal requirements.

Neither the Data Controller nor the other companies within the Group use automated decision-making processes in any way in relation to the data covered by this Privacy Notice.

Data retention period

The data will be processed for the period permitted or required by applicable legislation in connection with the management of the employment or collaboration relationship and for as long as necessary to ensure legal protection for you, the Data Subjects, the Data Controller and the other companies within the Group, in contractual and non-contractual matters.

Unless there are substantiated requirements to the contrary, this period may not exceed 10 years from the termination of the business relationship.

Rights of the Supplier and each Data Subject

At any time, you and/or each individual Data Subject have the right to request from the Data Controller and/or each of the Joint Controllers:

  • access to their personal data;
  • the updating, rectification and completion of such data;
  • the erasure and/or anonymisation of the data collected, where technically possible;
  • confirmation that the operations referred to above have been brought to the attention of those to whom the data have been disclosed or disseminated, except where such fulfilment proves impossible or entails the use of means that are manifestly disproportionate to the protected right;
  • restriction of processing or to object to such processing.

You and/or the individual Data Subjects also have the right to lodge a complaint with the competent Supervisory Authority responsible for the protection of personal data if you believe that your rights have been violated.

Please ensure that the Data Subjects (e.g. directors, employees and collaborators whose data the Data Controller and/or other companies within the Group may obtain for the purposes set out above in connection with the performance of a contract) are made aware of the contents of this Privacy Notice.

Privacy Preference Center

Privacy Preferences