PRIVACY NOTICE

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
(General Data Protection Regulation – “GDPR”)

Customers

Pursuant to Regulation (EU) 2016/679 on the protection of personal data (“GDPR”) and any other applicable national and/or EU legislation on the protection of personal data (including Legislative Decree no. 196/2003 – the “Privacy Code”), Sada Partecipazioni Srl, with registered office in Pontecagnano Faiano (SA), Via Pacinotti, snc, CAP 84098
(E-mail: info@sadaspa.it – PEC: sada.partecipazioni@telecompost.it), hereby informs you of the purposes and methods of processing of the personal data collected, the scope of their communication and dissemination, as well as the nature of their provision.

Purposes and legal basis of processing

The Company collects and processes personal data, including through electronic and telematic means, for the following purposes:

a) Management of the pre-contractual relationship, including the management of initial contact and related information exchanges, negotiation activities and quotation processes.
The legal basis for this processing is the performance of pre-contractual measures.

b) Management of the contractual relationship, including customer account setup, administrative contract management, invoicing, responding to information requests and debt collection activities.
The legal basis for this processing is the performance of a contract.

c) Compliance with legal obligations related to the contract.
The legal basis for this processing is compliance with legal or EU regulatory obligations.

d) Protection of the Company’s rights before the competent authorities in the event of disputes or complaints.
The legal basis for this processing is the legitimate interest of the Company in protecting its rights.

e) Sending electronic communications, market research and customer satisfaction surveys related to services similar to those purchased (so-called “soft spam”):
Pursuant to Article 130, paragraph 4 of Legislative Decree 196/2003, as amended, the Company may use – without requiring prior consent – the contact details provided by you in order to promote services similar to those previously purchased or requested.
In any case, you may object to such processing at any time upon receipt of any promotional communication by sending an email to info@sadaspa.it with the subject “unsubscribe mail marketing”.

f) The Company may also use your contact details to pursue legitimate risk management or stakeholder engagement activities (e.g. sending questionnaires necessary for drafting the sustainability report, market risk analysis, management of internal or third-party audits, sales analysis, preparation of aggregated statistics, tests and models aimed at improving existing products and services).
The legal basis for this processing is the Company’s legitimate interest.
For specific initiatives (e.g. questionnaires) and where additional personal data are required, the Data Controller may base the lawfulness of the processing on your consent.

Categories of personal data

The personal data processed, collected during the pre-contractual phase (including business development contacts), at the time of contract execution and during the contractual relationship, fall within the category of so-called “common” personal data.

In particular:

for commercial purposes: identification and contact data (e.g. first name, last name, company name, email address, phone number);
for purposes related to the management of the pre-contractual and contractual relationship: identification and contact data, VAT number, tax code, billing data, registration with professional registers, payment and invoicing data.

In the case of legal entities, the above data may refer to legal representatives, employees or collaborators. In such cases, the customer company (or potential customer) undertakes to ensure that the data subjects (legal representatives, employees or collaborators) are fully informed of the essential elements of this privacy notice.

Nature of data provision

The provision of personal data for the purposes referred to in points a), b), c) and d) of paragraph 1 is necessary for the conclusion and proper performance of the contract. Failure to provide such data will make it impossible to establish any contractual relationship or correctly fulfil the related obligations.

With regard to the purposes referred to in points e) and f), you may object to the processing at any time in the manner described in the following sections.

Processing methods and data retention period

Your personal data will be processed, for each of the purposes described above, using automated and/or traditional methods, in any case ensuring their security and confidentiality.

The data will be retained by the Data Controller for the period necessary to perform the contract and/or the pre-contractual measures for which they were collected. In particular:

If no contract is concluded between the parties, your personal data will be deleted from the Company’s records after one year.
For contractual purposes, data will be retained in compliance with applicable civil, tax and accounting obligations (generally ten years). After these periods, once the need to retain the data for potential tax audits ceases, the data will be destroyed, deleted or anonymised, unless further retention is required (e.g. ongoing legal disputes).
For the purposes referred to in points e) and f), data will be processed for as long as the legitimate interest persists (generally until the end of the contractual relationship), without prejudice to the right to object.

Personal data will not be disclosed. The Company does not adopt decision-making processes based solely on automated processing.

Scope of data communication

Personal data may be processed by Company personnel specifically authorised and instructed, as well as by third-party companies providing instrumental services on behalf of the Company (e.g. communication agencies, email marketing platforms).
Such parties act as Data Processors under Article 28 of the GDPR, on the basis of specific Data Processing Agreements (DPA).
An updated list of Data Processors is available upon request at: privacy.grupposada@sadaspa.it.

Personal data may also be communicated to independent third-party data controllers such as lawyers, consultants, competent authorities and law enforcement agencies, where necessary (e.g. in the event of complaints regarding purchased products, fraud prevention or protection of rights, or where required by applicable laws).

Data may be transferred abroad for the performance of instrumental activities on behalf of the Company and processed by entities located within the European Union.

Where, for technical and/or operational reasons, it is necessary to involve entities located outside the European Union, or to transfer data to cloud-based systems located outside the EU, such processing will be carried out in compliance with Chapter V of the GDPR. Appropriate safeguards will be adopted, including:
a) adequacy decisions issued by the European Commission;
b) appropriate safeguards pursuant to Article 46 of the GDPR;
c) adoption of Binding Corporate Rules.

Data subjects’ rights

Pursuant to Articles 15–21 of the GDPR, data subjects (you, if a natural person, or the legal representatives / personnel of a corporate customer) have the right to:

obtain confirmation as to whether personal data exist and access their content, obtaining a copy (right of access);
update, amend and/or correct personal data (right to rectification);
request deletion where data are no longer necessary, where processing is opposed for purposes referred to in points e) and f), where required by law, or where data are unlawfully processed (right to erasure);
request restriction of processing in the event of disputes regarding accuracy, unlawful processing or opposition, or in the exercise of defence rights (right to restriction);
where applicable, receive personal data in electronic format and request their transmission to another data controller (right to data portability).

Data subjects also have the right to object at any time to the processing of their data (right to object), providing reasons for the objection, and to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR (Italian Data Protection Authority), or to bring proceedings before the judicial authority pursuant to Article 79 of the GDPR.

You may exercise your rights at any time by writing to privacy.grupposada@sadaspa.it or by sending a registered letter with return receipt to:
Via Pacinotti, snc – Pontecagnano Faiano (SA), CAP 84098.

You may also object to processing at any time by using the opt-out mechanism included at the bottom of each commercial communication.