CUSTOMERS AND SUPPLIERS PRIVACY NOTICE

The company Landoil Technology s.r.l., with registered office in Via Caduti del Nazifascismo, 4 – 40013 – Castel Maggiore (BO), VAT number and tax code: 02448090965 (hereinafter “Data Controller”), in its capacity as Data Controller, informs you pursuant to art. 13 EU Regulation no. 2016/679 (“GDPR”) that your personal data and/or those of your persons in charge will be processed in the following ways and for the following purposes:

1. Subject of the Processing
The Data Controller processes personal data, to be understood as common identification data of commercial contact (name, surname, company name, address, telephone contacts, e-mail addresses, any bank and payment references) communicated by you on the occasion of the definition and/or conclusion of contracts as Customers or Suppliers of Landoil Technology srl, or, again, communicated and collected during the contractual relationship.
The Customer or Supplier receiving this information undertakes to view it to its data subjects whose data are being processed.

2.Purpose of the processing
2.1. Purposes of establishing, managing the commercial relationship and/or providing services:
Legal basis:
2.1.1 the processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the same,
2.1.2 the processing is necessary to comply with the obligations provided for by law, by a regulation, by EU legislation or by an order of the Authority
2.1.3 the processing is necessary to exercise a legitimate interest of the Data Controller, for example the right to legal defence.
2.2. Customers: any communication and marketing purposes: to send you (by e-mail) communications relating to the Data Controller’s products or services
Legal basis:
2.2.1 on the basis of the legitimate interest of the Data Controller (so-called Soft Spam) if you have already purchased our products or used our services and for products/services similar to those you have already used, unless you disagree,
2.2.2 on the basis of your express and specific consent or that of your Representatives given to us.

3. Processing methods and data retention
Your personal data may be processed by means of the operations stated in art. 4 no. 2) GDPR, and more specifically: collection, recording, organization, storage, consultation, processing, modification, selection, retrieval, alignment, use, interconnection, blocking, communication, erasure and destruction of the data.
Processing of your personal data may be carried out by electronic means and on paper.
The Controller will process your personal data for the time necessary to fulfil the aforementioned purposes and, however, for no longer than 10 years from the end of the contractual relationship. For the purposes of communication and commercial promotion, the Data Controller will process personal data for the time strictly necessary to carry out the purposes for which they were collected, for the period provided for by law or within the scope of provisions of the authority. If you wish to revoke your consent or express decision to unsubscribe from our commercial mailing list, your data will be promptly deactivated from our marketing databases so that you do not receive further communications. In any case, the personal data contained in previous communications will be kept for a period not exceeding 24 months from their registration, without prejudice to the transformation of said data into anonymous form.

4. Scope of Data Communication
For the purposes referred to in paragraph 2, to the extent necessary and relevant, the Data Controller may communicate – in whole or in part – the personal data processed to the following categories of subjects:
a) employees or collaborators of the Data Controller as authorised persons or data processors within the scope of their respective duties and within the limits established by law;
b) public or private entities, such as banks, insurance companies, public bodies and administrations, as data processors or independent data controllers;
c) service providers, as data controllers or data processors, that carry out, on behalf of the Data Controller, certain technical and organisational activities, such as – by way of example but not limited to – administrative, legal, accounting and tax or ICT service companies, web agencies,.
d) please note that for business needs, some of your personal data may be communicated to companies belonging to the same corporate group as the Data Controller, this in line with Recital no. 48 GDPR;
e) In accordance with art. 6 letters b) and c) GDPR, therefore without the need for express consent, the Data Controller may communicate your data for purposes arising from the contractual relationship to judicial authorities as well as any entities to whom communication is obligatory by law to fulfil the stated purposes. These entities will process the data in their capacity as independent data controllers..
f) The personal data subject to processing will not be disseminated, unless explicit consent.

5. Data transfer
Your personal data may be transferred, for the purposes stated in this privacy notice, as well as for storage and retention purposes, to countries within the European Union and countries outside the European Union.
In any case, the Controller gives its assurance that the transfer of data outside the EU will take place in compliance with applicable legal provisions, pursuant to articles 44 et seq. of the GDPR.

6. Nature of the provision
The conferral of data for the contractual purposes stated in the first part of art. 2.1. is mandatory. In the event such data are not conferred, we may not be able to guarantee execution of the contractual relationship.
The conferral of data for marketing purposes pursuant to the second part of art. 2.2. is instead optional; you may therefore decide not to confer any data or subsequently refuse the processing of data already provided. In this case you will not receive the aforementioned commercial communications and advertising material regarding the product and services offered by the Data Controller.

7. Rights of the data subject
As data subject, you may exercise your rights pursuant to art. 15 GDPR and in particular the right:
• to obtain confirmation as to whether or not personal data concerning you exist, regardless of their being already recorded, and communication of such data in intelligible form;
• to be informed: a) of the source of the personal data; b) of the purposes and methods of processing; c) of the logic applied in the case of processing carried out with the aid of electronic devices; d) of the identification data of the Controller, Processors and Representative appointed in accordance with art. 3 paragraph 1 GDPR; e) the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative in the territory of the State, data processors of persons in charge of processing.
• to obtain: a) the updating, rectification or, where interested therein, integration of the data; b) the erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed; c) certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
• to object in whole or in part: a) on legitimate grounds, to the processing of personal data concerning you, even though they are relevant to the purpose of the collection; b) to the processing of personal data concerning you, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys using automated calling systems without human intervention by email and/ or using traditional marketing methods by telephone and/or post. It should be noted that the right of the data subject to oppose, stated in the previous point b), for direct marketing purposes by automated means shall extend to traditional methods, and, however, without prejudice to the possibility of the data subject exercising his/her right of opposition, even if in part. Therefore, the data subject may decide to receive communications only by traditional methods or only by automated methods or neither of the two types of communication.
• Where applicable, you shall also have the rights pursuant to articles 16-21 GDPR (right to rectification, right to erasure (right to be forgotten), right to restriction of processing, right to data portability, right to object), as well as the right to make a claim to the Data Protection Authority.
• Finally, where the conditions are met, the data subjects will have the right to compensation for any damage suffered as provided for by art. 82 of the GDPR.

8. Procedures for exercising rights
The data subjects may exercise their rights at any time by sending a registered letter with return receipt to the company Landoil Technology srl, Via Caduti del Nazifascismo, 4 – 40013 – Castel Maggiore (BO), or an e-mail to the address info@land-oil.it.

9. Data Controller and Data Processors
The Data Controller is the company Landoil Technology srl, with registered office in Via Caduti del Nazifascismo, 4 – 40013 – Castel Maggiore (BO). The updated list of data processors is kept at the registered office of the Data Controller.

LANDOIL TECHNOLOGY S.R.L