Privacy notice on the processing of suppliers’ personal data
Informativa/FOR.Rev. 00 of 07/04/26

Privacy notice for suppliers

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Pursuant to Articles 13 and 14 of the GDPR (Regulation (EU) 2016/679) and in order to protect your right to the protection of personal data, GIFRAB Italia SpA wishes to provide you with the following information.

Data Controller

GIFRAB Italia SpA, with registered office at Via Marco D’Agrate 41, 20139 Milan (MI), Italy, VAT No. 04836890824, is the Data Controller.

Email: info@gifrab.it – Certified email (PEC): gifrabitalia@legalmail.it

Data Protection Officer: rpd@gifrab.it

Purposes of processing

Your personal data may be processed, jointly or separately, for purposes connected with: carrying out pre-contractual checks prior to the possible conclusion of a contract with the supplier; entering into and performing the contractual relationship (such as drawing up contracts, paying invoices, etc.); and complying with legal obligations, including accounting and tax obligations.

Types of data processed

In managing contractual and/or pre-contractual relationships with suppliers, GIFRAB Italia SpA processes the following categories of personal data:

  • identification data (first name, surname, company name, tax code, etc.);
  • contact details (registered/operational office address, telephone number, email address, etc.);
  • bank and payment details;
  • data relating to the performance of the contract (names and contact details of company representatives, delivery and invoicing details, etc.).

Legal basis for processing

The processing of personal data does not require the Data Subject’s consent, as it is necessary to take pre-contractual steps and to perform the contractual relationship between GIFRAB Italia SpA and the Data Subject, enabling both parties to fulfil the obligations arising from it.

Processing methods

Your personal data will be processed manually and by computer, including with the aid of electronic or otherwise automated means, in the manner and to the extent necessary to pursue the above purposes, and with the technical measures required by Article 32 of the GDPR (Regulation (EU) 2016/679).

Processing will be carried out directly by the Controller’s organisation, with the assistance of staff specifically authorised for this purpose and of any external processors appointed, where necessary, for specific operations.

Your personal data is protected by security measures designed to limit access to authorised professionals and the Controller’s authorised staff only, and only for the functions within their remit. Further security measures are applied to all your personal data to ensure data integrity, daily backups and recovery in the event of incidents or failures of the processing systems.

Recipients of personal data

Within the scope of their respective duties, your personal data will be accessible to the Controller’s employees and staff who have been duly designated to perform specific tasks and/or functions as authorised persons.

The data collected and processed may be disclosed, solely for the purposes specified above, to:

  • postal services or other carriers for the delivery of correspondence;
  • transport companies for the shipment of goods;
  • banks/financial institutions for the management of collections and payments;
  • business consultants and self-employed professionals, including those working in partnership, who work with the Controller (e.g. accountants, auditors and administrative, tax and contract advisers);
  • insurance companies;
  • public bodies, in fulfilment of legal obligations.

Place of processing and data transfers

Processing takes place at the Controller’s registered office stated above and at the premises of the third parties identified.

Personal data is not transferred outside the European Union. In any case, should it become necessary, the Controller may also transfer personal data to non-EU countries, and undertakes that any such transfer will take place in compliance with the law and in particular with the provisions of Article 46 of the GDPR.

Retention period

Personal data is kept for as long as strictly necessary to achieve the purposes for which it was collected and processed; as a general rule, therefore, personal data will be kept for the time needed to perform the contract. After the contractual relationship has ended, the data will be kept for 10 years; this period is set in order to comply with legal obligations in tax, administrative and accounting matters (Article 2220 of the Italian Civil Code) and to allow the Controller to protect its rights in or out of court (ordinary limitation periods). After that period, the data will be permanently deleted or anonymised.

What are your rights?

As a Data Subject, you have the rights provided for by Articles 15 to 22 of Regulation (EU) 2016/679. In particular, you have the right to obtain at any time:

  • access and confirmation: confirmation as to whether or not personal data concerning you exists and its communication in an intelligible form, together with information on its source, the purposes and methods of processing and the logic applied where electronic means are used;
  • identity of the Controller: the identification details of the Controller, the Processors and the persons or categories of persons to whom the data may be disclosed;
  • rectification and completion: the updating, rectification or, where you have an interest, completion of your data;
  • erasure and right to be forgotten: the erasure (right to be forgotten), anonymisation or blocking of data processed unlawfully or no longer necessary for the purposes for which it was collected;
  • restriction of processing: the right to restrict the processing of data in the event of a dispute or in the cases provided for by Article 18 of Regulation (EU) 2016/679;
  • data portability: the right to receive your data in a structured, commonly used and machine-readable format in order to transmit it to another Controller;
  • objection: the right to object, in whole or in part, on legitimate grounds to the processing of data concerning you;
  • complaint: the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe that the processing infringes the legislation in force.