Treatment of personal data

This INFORMATION is pursuant to art. 13 and 14 of EU Reg. 679/2016

To the kind attention of the Customer / Supplier,

Hereby MODEL P SRL (Tax Code and VAT No. 04811800269, with registered office in 31100 Treviso, Via Postumia 10, Phone number +39 0422 397805, email address amministrazione@modelp.it) informs the Customer that, pursuant to EU Regulation n. 679 of 2016 on the protection of personal data, with particular reference to art. 13 and 14 of the same, the aforementioned Company holds the role of Data Controller of the personal data that the Customer shall provide, in relation to the collaboration that the Company and the Customer have undertaken to initiate and manage. In accordance with the relevant regulations currently in force, the processing of personal data by the Company shall be based on the principles of lawfulness, correctness, transparency and on further principles referred to in art. 5 EU Reg. 679/2016. The undersigned Company also provides the Customer with the pertaining information described below.

A) Processing of personal data
Pursuant to no. 2 of Article 4 of EU Reg 679/2016, the term "processing" refers to any procedure performed and applied to personal data (with or without the assistance of automated processes), such as collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission or circulation (or any other act aimed at making data available), comparison or interconnection, limitation, cancellation or destruction. Personal data shall be processed in such a way as to guarantee its security and confidentiality and in full compliance with the provisions of EU Reg. 679/2016. Data collection shall be based on both paper and computerized / online material, also making use of automated tools to store, manage or transmit the data itself. Should any IT and / or online tools (PC, Notebook, Tablet, mobile phone, SIM, internet dongle / USB modem, email, internet access) be used for data collection, such data may also be accessed by the IT companies supplying hardware and / or software systems, duly appointed by the Controller as Data Processors of the Customer’s personal data. In order to fully implement the service requested by the Customer, only essential personal data shall be collected, such as first/last name and vital statistics, tax code, address, ID card, other personal identification elements such as telephone number and email.

B) Purpose of data processing.
The Data Controller shall process personal data exclusively in order to implement the requested and / or provided service, as well as in order to allow the undersigned Company to performed all the administrative, commercial, accounting and tax procedures deriving from the regulations in force and connected to the service requested by the Customer.

C) Authorized data processors (Designated).
All subjects specifically appointed by the Data Controller as "Designated Data Processors" shall be entitled to access the Customer’s personal data. The Designated Data Processors, each of whom shall be assigned a specific scope and profile, shall act exclusively with the authorization of the Data Controller and, in accordance with the provisions of art. 29 EU Reg. 679/2016, shall process the Customer’s data only after having been duly instructed by the Data Controller and acting under the latter’s direct control.

D) With whom personal data are shared (Recipients)
For the execution of any procedures relating to the processing of the Customer’s personal data, the undersigned Company, here as Data Controller, shall be entitled to transmit such data to subjects who carry out professional activities deemed strictly related, useful or necessary for the implementation of the services / procedures requested by the Customer, and therefore necessary to properly fulfill the contractual obligations that the Company has undertaken with the Customer. For example, such subjects may include (among others):
- transport and forwarding companies;
- professionals who provide specific processing or consultancy services for corporate, legal or tax administration and management, operating on behalf of this Company;
- professionals who provide services for the processing or maintenance of information systems;
- the company who supplies the IT security system;
- credit institutions;
- credit recovery institutes;
- associated or controlled companies;
- other public or private bodies dealing with the fulfillment of legislative obligations.
The Company, as legitimate Data Controller, shall provide an updated list of these subjects, also indicating which of them are "Designated Data Processors" (i.e. Data Processors appointed by the Data Controller). The Designated Processors appointed by this Company have undertaken to implement technical and organizational measures suitable for the fulfillment of the requirements described by EU Reg 679/2016 and to guarantee the protection of the Customer’s personal data. The Designated Processors have also undertaken, by means of a signed letter of appointment, to fulfill all the specific obligations referred to in art. 28 EU Reg 679/2016 and to act, pursuant to Article 29 of the same Regulation, under the authority (and as per the instructions) of the Data Controller, as well as to communicate to the same any violations of the Customer’s personal data, pursuant to the second paragraph of Article 33 of EU Reg 679 / 2016.

E) Transfer of data abroad
If the Data Controller deems it necessary to transfer the Customer’s (collected and processed) personal data outside the EU territory (N.B. the phrasing "to transfer outside the EU territory" also implies the use of services – for instance – of hosting, cloud and storage, based on collecting data in systems located in non-EU countries) in order to provide the service requested by the Customer, the Controller himself/herself undertakes to arrange and ensure that the transfer is carried out safely and in full compliance with the provisions of the relevant Regulation, despite the transfer is carried out outside the EU (adequacy decisions, contractual clauses, consent…).

F) Rights exercisable by the Customer; complaint to the Supervisory Authority and judicial appeal The Customer is always entitled to exercise the rights referred to in Articles 15 ss of EU Regulation 679/2016 (access to personal data, modification or cancellation of the same, limitation of data processing, opposition to processing, data portability) towards the Data Controller. Moreover, if the Customer believes that their rights have been violated during the processing of their personal data, he/she is entitled to lodge a complaint with the competent supervisory authority (pursuant to art.77 EU Reg 679/2016) or to present a judicial appeal (pursuant to art.79 EU Reg 679/2016).

G) Data retention period The Customer's personal data shall be stored for a period of time necessary for the full implementation of the services requested by him/her and also for the fulfillment of any additional purposes, as per point B.

H) Obligation to provide personal data and legal bases
The undersigned Company informs the Customer that the provision of personal data is a contractual obligation, as well as a mandatory requirement for the fulfillment of the contract and for the implementation of the services requested or provided by the Customer. Any refusal to provide personal data would make it impossible for the Company to implement the services requested or provided by the Customer.

The legal bases underlying the processing of the Customer’s data by this Company are:
- the need to implement a contractual act in which the Customer is an interested party (point B art.6 EU Reg. 679/2016);
- the need to fulfill any legal obligations to which the Company is subject (legal basis referred to in point C, paragraph 1, Article 6 of EU Reg. 679/2016);
- the legitimate interest of the Company in properly carrying out the collaboration with the Customer and in sending commercial material (legal basis referred to in point F, paragraph 1, art. 6 EU Reg. 679/2016)

Model P Srl
Via Callalta, 31, 31100
Treviso (TV) - Italy
P.IVA 04811800269
R.E.A. TV-379855