Dear Supplier/Costumer,

Subject: Circular ex article 13 legislative decree no. 196/2003 and articles 13-14 EU Regulation 2016/679.

As it could be necessary for MACH-TRADE s.r.l. to acquire some of your personal data in order to manage any commercial activity with our costumers and our suppliers, in accordance with article 13 legislative decree approved on the 30th of June 2003, no. 196, and articles 13-14 EU Regulation 2016/679, we would like to inform you that:

1. Controller of the personal data processing

The Controller of the processing of personal data is MACH-TRADE s.r.l., VAT number 03592760247, legal head office Via Largo Parolin,131 – 36061 BASSANO D.G. (VI) – contact information paragraph no. 11).

2. Processing Subject and Purpose

The processing of directly provided personal data aims to the pursuit of legal activities functional to the implementation of the in place contractual/pre-contractual intercourse with regard to goods, services/performances included in the contract, any possible instrumental or supplementary activity included.
If any concrete and actual situation occurs – for which the personal data used are part of a personal data special category – the processing will take place only if truly necessary for the fulfilment of the contractual obligations in accordance with art. 9 of GDPR and that the person concerned has given explicit consent to the processing of such personal data.
With regard to the contract that will be established by accepting the order on both sides, the processing aims to provide:
ø To the purposes connected to any legal obligation, to any regulations or to the EU legislation, as well as to any instruction by legitimate authorities and supervisory and inspection bodies;
ø To the related and instrumental purposes of the management of the intercourses with costumers/suppliers regarding, for example, quote proposals, contract stipulating, information conveyance, payment invoicing and collection;
ø To the defence of a right also on side of the Controller of personal data processing or of a third party in court, in administrative branch or in arbitration or conciliation procedures in cases provided for by the law, by the EU legislation, by regulations or by the collective agreement used in the enterprise.
The legitimate interests pursued by the Controller of personal data processing and linked to the processed personal data of the suppliers and of the costumers are exclusively matched into the legal and actual necessity to proceed with the execution of a sales/purchase contract (with the costumer/supplier) of which the person concerned is a party or with the execution of pre-contractual arrangements adopted upon request.

3. Processing Procedures

Processing of personal data will include all procedures or set of procedures provided for in art. 4, paragraph 1, letter a) of Legislative Decree 196/2003 and article 4, paragraph 2) of EU Reg. 2016/679 necessary to the processing at issue, on the understanding that the data you provide are not meant to be released.
For the above-mentioned purposes, the processing will occur through the use of both electronic systems and in paper form, and will be managed by the authorised personnel in our company and when necessary by contracted responsible for the processing of personal data.
The data retention both in electronic and paper mode will last for the time intended by the laws in force.

4. Obligation for Contribution of Personal Data

The contribution of personal data relating to the processing described on paragraph 2) is necessary since it is connected to the obligations intended laws or regulations in force and to provisions issued by relevant authorities/supervisory and monitoring bodies, in order to satisfy the sales/purchase contract or to meet any pre-contractual requirement of the costumer/supplier.

5. Consequences of the Absence of Consent to the Processing of Personal Data

In case of absence of the consent to the processing of personal data, it would be impossible to proceed with the above-mentioned activities, and consequently to fulfil the terms of contract.
At any rate, even when consent is given, in any moment processing interruption is possible by requiring the deletion of data through a message sent to the e-mail address on paragraph 11), on the understanding the accordance of the processing done before the annulment and the lawful interest of the Controller of personal data processing.
Such a requirement would also imply the inability to implement the contract.

6. Personal Data Transmission

It is possible that the personal data included in the above-mentioned process may be transmitted to a third party belonging to the following categories:
ø subjects performing bank, finance or insurance tasks;
ø authorities, control and supervisory bodies or, in general, public and private subjects performing public official tasks;
ø subjects providing IT and information system management;
ø subjects charged with IT security and maintenance;
ø subjects performing archiving tasks;
ø Consulting Firms or Certification Bodies.
With reference to the transmitted data, any subject belonging to the above-listed categories will be allowed to work as external responsible for the data processing according to EU Regulation 2016/679.

7. Data Retention

Data will be stored considering the following criteria:
ø at least for the period of time demanded by the legislation in force;
ø for the protection of the rights of the person concerned, who could request verification of the legitimacy of the activities of the company;
ø for the protection of the rights of the Controller of the processing (for example in order to demonstrate the fulfilment of healthcare, work safety or social security obligations etc.)

8. Entrust of Data to non-EU subjects

Although at the moment all subjects processing data for MACH-TRADE s.r.l. as contracted responsible are located within the EU, in the future it could be necessary to provide these data to non EU contracted responsible, located in countries which do not guarantee the same level of security provided by the Data Privacy Code/EU Regulation 2016/679 for Data Protection. MACH-TRADE s.r.l. will eventually transfer the data out of the EU only after having verified that the processing will take place in accordance with the Data Privacy Code and the EU Regulation and after obtaining the due warranties from the subject in charge.

9. Data Profiling

No data profiling is performed on the provided data.

10. Data Provider Rights

With regard to the concerned processing, we inform you that you can exercise the right as on article 7, legislative decree no. 196/2003 and articles 13-14 EU Regulation 2016/679, texts annex, and in particular:
ø access to your own personal data for any verification;
ø adjustment or deletion of personal data;
ø limitation of the processing of your own data;
ø objection to the processing of your personal data;
ø with reference to personal data processed in automated mode, the right to data portability;
ø lodge a complaint with a supervisory authority.

11. For Further Information

In case of doubts, requests for clarification or anything else regarding personal data processing, the concerned person can contact:
- via e-mail 


Controller of the Processing

Noted the notice above – especially of my on rights relating to article 7, legislative decree no. 196/2003 and article 15 EU Regulation 2016/679 text annex – I give my consent to the processing, data transmission included, by the Controller and/or the responsible for the processing for the aims and within the limits provided on the above mentioned notification.
I agree to the possible transfer of the data – also sensitive data – abroad, ex article 3, legislative decree 196/2003 and article 44 EU Regulation 2016/679, within the limits set in the notification and the processing following the direct communication of data to the Controller of the Processing as described on paragraph 5) of the given notification, only for the declared scopes.

Interested Party

The interested Party declares to have taken note that the consent to the legal processing of personal data concerning their person is optional for functional purposes of the activity at MACH-TRADE s.r.l. as seen on paragraph 2) of this paper, concerning marketing and advertisement, and that lack of consent to the legal processing of data connected to the above-mentioned purposes does not prevent the execution of the sales contract with the Interested Party, nor the execution of pre-contractual agreements required by the Interested Party. Therefore, the Interested Party


specifically, informed and unequivocal relating to article 7 of the General Data Protection Regulation (EU) 2016/679, to the legal processing of personal data also for the functional purposes of MACH-TRADE s.r.l. as seen on paragraph 3) point 3) of this paper.