Supplier disclosure under Articles 13 ff. of Regulation EU 679/2016 (GDPR)

Dear Supplier,

We would like to inform you that Regulation EU 679/2016 (GDPR) applicable as of 25 May 2018 sets out provisions for the protection of natural persons with regard to the processing of their personal data as well as the free movement of such data. Pursuant to the aforementioned Regulation, such processing will be based on the principles of fairness, lawfulness, transparency and protection of your personal data and your rights, in full compliance with the general principles set out in the Privacy Code and Article 5 of the aforementioned GDPR Regulation.
In this respect, we provide you with the following information:

1. Data controller
   The Data Processor of your personal data is GLAMOUR GROUP SRL, having its registered office in Viale dell’Artigianato 67, Santa Giustina in Colle (Padua, Italy) in the person of the Proprietor.

2. Purpose of processing
   Your personal data, collected through market research or direct contact, will be processed exclusively for the following purposes, which are strictly connected and incidental to the execution of the contract, the fulfilment of the obligations thereunder, and the delivery of the goods/services supplied. More specifically, the collection of your data is required to:
   • ensure effective management of our business relationship;
   • enter your personal details in computer databases;
   • include your firm in our supplier register;
   • ensure appropriate book-keeping
   • fulfil obligations under statutory and tax laws, regulations, and EU legislation;
   • establish, exercise or defend legal claims.

3. Means of processing
   Data processing is carried out using electronic tools and/or paper media by authorised and qualified individuals, committed to confidentiality, relying on criteria related to the Purposes and in any case in such a way as to guarantee the security and confidentiality of your data.

4. Nature of data collection and consequences of failure to provide data
   In the conduct of its business, our company requires suppliers to provide:
   – General/common data:
   • personal details, company name, tax identification number and/or VAT registration number, when the legal entity of the Supplier is a natural person;
   • personal, identification and contact data of the legal representative;
   • personal, identification and contact details of internal contact persons

   – Special data are those data from which “discriminatory” information about the data subject can be inferred (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as processing genetic data, biometric data intended to uniquely identify a natural person, data concerning a person’s health or sex life or sexual orientation). Our company requests and collects such data only with specific reference to certain operations that may be necessary and with the specific written approval of the data subject.

   – Judicial data: these include personal data relating to criminal convictions and offences or to related security measures processed on the basis of Article 6(1), which requires that processing is lawful on the basis of the express consent of the data subject, when the processing is necessary for the performance of a contract to which the data subject is a party, the discharge of pre-contractual measures adopted at the data subject’s request, when the processing is necessary for compliance with a legal obligation to which the data controller is subject. In compliance with legal provisions or the provisions of the Supervisory Authority, our company requests and collects such data only with specific reference to registration in the supplier register.
   The provision of the aforementioned data, when requested, is mandatory in order to fulfil the obligations arising under the contract and, in general, legal obligations. Failure to provide such data may make it impossible for us to fulfil the Purposes pertaining to the data subject.
   Any changes in your personal data or in the person giving consent will be promptly notified to us by you.

5. Data recipients and disclosure
   Your personal data, correctly collected and processed, may be disclosed and transmitted to third parties entrusted with the delivery or supply of specific services strictly related to the performance of the contract and for the purposes stated above, including by means of continuous processing.
   By way of illustration and not limitation, such parties may include:
   • Natural and legal persons, in their capacity as independent data controllers, (legal, administrative and tax consultancy firms, banking institutions for the management of receipts and payments, factoring or debt collection companies, couriers and forwarding agents, etc.) in cases where disclosure is necessary for the purposes described above;
   • Specially authorised collaborators and employees within the scope of their duties;
   • External suppliers, appointed as data processors, relied upon to provide services to the company’s information systems and/or consultancy services;
   • Soggetti verso i quali sia obbligatoria la comunicazione ai sensi di specifiche disposizioni di legge nazionale e/o comunitaria;
   • Individuals/entities to whom disclosure is mandatory under specific provisions of national and/or Community law.

   A full list of the data processors and third parties to whom your data may be disclosed is available at our head office.
   You may request a copy of such list by ending an email to info@glamour-textiles.it.

   Personal data are not subject to disclosure.

6. Data retention
   Your personal data will be retained for the time strictly necessary for the proper fulfilment of the purposes under (2) above and in compliance with legal obligations regarding document retention (e.g. 10 years for invoices and contracts).

7. Right of access, rectification, deletion, objection and portability of data. Revocation, complaint, profiling
   It is your right to obtain from the Data Controller access to your personal data, their rectification, their deletion (i.e. Right to be forgotten), the restriction of their processing or to object to their processing. You also have the right to:
   • Request data portability
   • Withraw your consent at any time without affecting the lawfulness of the processing based on the consent given prior to any such withdrawal
   • Lodge a complaint with the Supervisory Authority.

   Please be informed you that no automated decision-making process is used in the processing of your data.

   With regard to the aforesaid data, the data subject may exercise his or her rights under Articles 15 – 21 of Regulation 679/2016 at any time by contacting the Data Processor.