INFORMATION ON THE PROCESSING OF PERSONAL DATA RELATED TO THE RELATIONSHIP WITH CUSTOMERS AND PROSPECTIVE CUSTOMERS
The following information is intended for natural persons, including professionals, sole proprietor businesses and representatives/liaison officers of companies, entities, associations and foundations, hereinafter referred to as the "Data Subjects".
Identity and contact details of the Data Controller
Coste Petrai s.r.l., hereinafter also referred to as “Coste Petrai” or the “Data Controller”, having its registered office in Via Montello n. 7 – 31030, Arcade (TV). Contact details: email address info@costepetrai.com, to the certified email address info@pec.costepetrai.com or at the phone number +39 0438/82535.
Purposes and legal bases
A. Prior to entering into a contract: personal data are processed for all needs related to the processing of enquiries and/or quotations.
B. Collection of business information – Personal data are processed to collect information for the purpose of verifying the economic and financial situation of the Data Subjects, as well as their stability, solvency and reliability. Personal data are processed to gather information for the purpose of verifying the economic, financial, and asset-related status of the data subjects, as well as their stability, solvency, and reliability.
C. Management of the contractual phaseAfter entering into a contract – Personal data are processed for all needs related to the management of the contractual relationship in all its phases (e.g. managing appointments, organising logistics, managing customer support activities and complying with regulatory obligations incumbent on the Data Controller).
D. Marketing: transmit commercial communications containing information on its products or services, as well as promotions or invitations to attend events in which the Data Controller will participate.
E. Defending legal claims : the Data Controller may need to process personal data to defend legal claims in out-of-court or court-based proceedings.
| Purpose | Legal basis (common data) | Legal basis (special data) |
|
A. |
Steps to be taken prior to entering into a contract. | / |
|
B. |
Legitimate interest of the Controller in connection with the analysis and definition of business strategies and policies, the identification of suitable parties with whom to start or continue of business relations, definition of the terms and conditions of payment, and the prevention of fraud. | / |
|
C. |
Contract performance; Compliance with legal obligations. |
/ |
|
D. |
Consent | / |
|
E. |
Legitimate interest of the Data Controller in establishing, exercising or defending a legal claim. | Establishing, exercising or defending a legal claim. |
Retention period
| Purpose | Retention time |
|
A. |
Time required to process the requests submitted and ensuing replies. |
|
B. |
Time required to carry out the checks. |
|
C. |
10 years after termination of the contract. |
|
D. |
24 months after collection. |
|
E. |
10 years after final resolution of a dispute. |
Nature of the data provided and consequences arising from denial to provide the data
| Purpose | Nature | Consequences | |
|
A. |
Required | Inability to receive the requested information. | |
|
B. |
Not applicable | / | |
|
C. |
Required | Inability to start or continue a business relationship. | |
|
D. |
Optional | Inability to receive commercial communications. | |
|
E. |
Required | Inability to handle litigation. | |
Disclosure scope
Data are processed by authorised internal staff for specific tasks and are disclosed to external parties according to the following rules
| Purpose | Groups of external recipients |
|
A. |
Agents, business consultants, business brokers. |
|
B. |
Business information companies, agents. |
|
C. |
Agents, business information companies, IT service companies, companies providing infrastructure hosting and cloud systems, auditing firms, carriers and forwarding agents, board of auditors, insurance brokers, companies providing document archiving systems, lending institutions, entities to whom disclosure is required by law, business partners (customers/suppliers). |
|
D. |
Marketing consultancy firms, companies offering hosting/management services for technology platforms. |
|
E. |
Law firms; debt collection or factoring companies; judicial authorities |
Since the data are also processed using IT equipment, they may also be viewed by individuals servicing/maintaining such systems.
Data transfer to a third country or an international organisation
The Data Controller will not transfer personal data outside the European Economic Area.
Data subject rights
The data subjects have the following rights:
Access: Data subjects can find out whether their personal data are being processed and if so, to obtain access to such data and request a copy thereof.
Rectification: Data subjects may request that their personal data be updated, rectified (if inaccurate) and amended if incomplete.
Deletion: Data subjects may obtain the deletion of their personal data under certain conditions (for more information, please reach out to the Data Controller).
Limitation: Data subjects may request that data be flagged – so as to limit their processing in the future – if certain conditions are met (for more information, please reach out to the Data Controller).
Objection: Data subjects may object to the processing of their personal data – on grounds relating to their particular situation – where such processing is based on a legitimate interest or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller. They may also object to the processing of their personal data for direct marketing purposes.
Portability: The personal data provided to the Data Controller may be received in a structured format and transmitted to another controller if the processing is based on consent or contract and is carried out by automated means.
Withdrawal of consent: Data subjects may withdraw their consent for the purposes for which it was requested, without prejudice to the lawfulness of the processing carried out until then.
Below are the actual rights that can be exercised with respect to the processing operations performed:
| Purpose | Right that can be exercised | ||||||
| Access | Rectification | Deletion | Limitation | Objection | Portability | Withdrawal of consent | |
|
A. |
X | X | X | X | |||
|
B. |
X | X | X | X | X | ||
|
C. |
X | X | X | X | X | ||
|
D. |
X | X | X | X | X | X | |
|
E. |
X | X | X | X | X | ||
To exercise the aforementioned rights, the Data Subjects may use the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 Once completed, the form must be sent to the following email address: privacy@costepetrai.com. Data Subjects may use the same address to obtain further details in relation to the above information (e.g. legitimate interest balancing test or list of data controllers).
Complaints may be filed with a supervisory authority (in Italy: Autorità Garante per la protezione dei dati personaliwww.garanteprivacy.it).
____________________________________________________________
INFORMATION ON THE PROCESSING OF PERSONAL DATA RELATED TO THE RELATIONSHIP WITH CUSTOMERS AND PROSPECTIVE CUSTOMERS
The following information is intended for natural persons, including professionals, sole proprietor businesses and representatives/liaison officers of companies, entities, associations and foundations, hereinafter referred to as the "Data Subjects".
Identity and contact details of the Data Controller
Coste Petrai s.r.l., hereinafter also referred to as “Coste Petrai” or the “Data Controller”, having its registered office in Via Montello n. 7 – 31030, Arcade (TV). Contact details: email address info@costepetrai.com, to the certified email address info@pec.costepetrai.com or at the phone number +39 0438/82535.
Categories of data and their source
Coste Petrai processes personal data of a general nature (e.g., personal details, contact information, data regarding identification documents, and employment-related data, including professional certificates and qualifications) as well as data of a special nature (e.g., data regarding fitness for work); such information may be collected from the data subject themselves and/or from third parties (e.g., other company employees and collaborators).
Purposes and legal bases
A. Prior to entering into a contract: i dati personali vengono trattati per tutte le necessità correlate all’ottenimento di informazioni e/o preventivi.
B. Management of the contractual phase: i dati personali vengono trattati per tutte le necessità correlate alla gestione del rapporto contrattuale in tutte le sue fasi (es. gestione degli appuntamenti, organizzazione della logistica e adempimento di obblighi normativi che gravano sul Titolare).
C. Defending legal claims : the Data Controller may need to process personal data to defend legal claims in out-of-court or court-based proceedings.
| Purpose | Legal basis (common data) | Legal basis (special data) |
|
A. |
Legitimate interest of the Data Controller related to searching for potential suppliers and collecting information and/or price quotes. | / |
|
B. |
Legitimate interest of the Data Controller in properly conducting business relationships in compliance with applicable regulations; Contract performance; Compliance with legal obligations. |
Fulfillment of labor law obligations. |
|
C. |
Legitimate interest of the Data Controller in establishing, exercising or defending a legal claim. | Establishing, exercising or defending a legal claim. |
Retention period
| Purpose | Retention time |
|
A. |
Time required to process the requests submitted and ensuing replies. |
|
B. |
10 years after termination of the contract. |
|
C. |
10 years after final resolution of a dispute. |
Nature of the data provided and consequences arising from denial to provide the data
| Purpose | Nature | Consequences | |
|
A. |
Required | Inability to receive the requested information. | |
|
B. |
Required | Inability to start or continue a business relationship. | |
|
C. |
Required | Inability to handle litigation. | |
Disclosure scope
Data are processed by authorised internal staff for specific tasks and are disclosed to external parties according to the following rules
| Purpose | Groups of external recipients |
|
A. |
Companies belonging to the same corporate group, external consultants. |
|
B. |
Agents, business information companies, IT service companies, companies providing infrastructure hosting and cloud systems, auditing firms, carriers and forwarding agents, board of auditors, insurance brokers, companies providing document archiving systems, lending institutions, entities to whom disclosure is required by law, business partners (customers/suppliers). |
|
C. |
Law firms; debt collection or factoring companies; judicial authorities |
Since the data are also processed using IT equipment, they may also be viewed by individuals servicing/maintaining such systems.
Data transfer to a third country or an international organisation
The Data Controller will not transfer personal data outside the European Economic Area.
Data subject rights
The data subjects have the following rights:
Access: Data subjects can find out whether their personal data are being processed and if so, to obtain access to such data and request a copy thereof.
Rectification: Data subjects may request that their personal data be updated, rectified (if inaccurate) and amended if incomplete.
Deletion: Data subjects may obtain the deletion of their personal data under certain conditions (for more information, please reach out to the Data Controller).
Limitation: Data subjects may request that data be flagged – so as to limit their processing in the future – if certain conditions are met (for more information, please reach out to the Data Controller).
Objection: Data subjects may object to the processing of their personal data – on grounds relating to their particular situation – where such processing is based on a legitimate interest or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller. They may also object to the processing of their personal data for direct marketing purposes.
Portability: The personal data provided to the Data Controller may be received in a structured format and transmitted to another controller if the processing is based on consent or contract and is carried out by automated means.
Withdrawal of consent: Data subjects may withdraw their consent for the purposes for which it was requested, without prejudice to the lawfulness of the processing carried out until then.
Below are the actual rights that can be exercised with respect to the processing operations performed:
| Purpose | Right that can be exercised | ||||||
| Access | Rectification | Deletion | Limitation | Objection | Portability | Withdrawal of consent | |
|
A. |
X | X | X | X | X | ||
|
B. |
X | X | X | X | X | X | |
|
C. |
X | X | X | X | X | ||
To exercise the aforementioned rights, the Data Subjects may use the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 Once completed, the form must be sent to the following email address: privacy@costepetrai.com. Data Subjects may use the same address to obtain further details in relation to the above information (e.g. legitimate interest balancing test or list of data controllers).
Complaints may be filed with a supervisory authority (in Italy: Autorità Garante per la protezione dei dati personaliwww.garanteprivacy.it).