Privacy Policy for Customers and Suppliers

Information for Suppliers on the Processing of Personal Data

Pursuant to Legislative Decree No. 196/2003 and EU Regulation No. 679/2016 (GDPR), and in relation to the personal data concerning You that will be processed, We inform You of the following.

1. Purpose of Data Processing

EVOLOOP SRL, as the data controller, will process the supplier's data for the following purposes:

a) supplier census and registration in the supplier list;
b) evaluation of supplier reliability (financial soundness, economic and organizational capacity, references, professional qualifications, contribution regularity, insurance coverage, conflicts of interest, anti-corruption and anti-money laundering compliance, potential reputational implications of the relationship);
c) management of contracts entered into with suppliers relating to work or service performance, including accounting records and registrations, compliance with obligations under laws, regulations, EU legislation or orders issued by legally authorized Authorities and Supervisory Bodies;
d) evaluation of the supplier in relation to services performed for EVOLOOP SRL;
e) compliance with legal obligations relating to civil, tax, accounting rules; fulfillment of obligations arising from entered contracts; administrative management of relationships.

2. Legal Basis for Data Processing

The supplier's personal data will be processed on the following legal bases:

a) processing is necessary for the performance of a contract to which You are a party, or for the implementation of pre-contractual measures taken at Your request;
b) processing is necessary to comply with a legal obligation to which EVOLOOP SRL is subject.

3. Data Collected from Third Parties

We inform You that the personal data subject to processing, particularly in relation to the purposes referred to in point 1, letter b), may be acquired not from the data subject but from third parties, through access to public databases, dedicated inspection services, or by requesting references from the supplier's previous clients.

The categories of data acquired from third parties are those indicated in point 1, letter b), i.e. data concerning supplier reliability, financial soundness, economic and organizational capacity, references, professional qualifications, contribution regularity, insurance coverage, conflicts of interest, anti-corruption, and potential reputational implications of the relationship.

4. Data Processing Methods

Personal data may be processed using both analog and electronic or automated means, with methods and procedures strictly necessary to achieve the purposes described above.

The Company processes data directly through persons belonging to its own organization or by availing itself of external parties. Such parties will process the data:

a) in accordance with the instructions received from the Company, as data processors or authorized persons, including employees or collaborators of the Company assigned to company structures within the scope of their functions and exclusively for achieving the specific purposes indicated in this notice.
b) independently, as separate data controllers.

5. Provision of Data

Without prejudice to the data subject's autonomy, the provision of personal data may be:

a) mandatory under law, regulation, EU legislation or provisions issued by legally authorized Authorities or Supervisory Bodies;
b) strictly necessary for entering into new relationships between the supplier and EVOLOOP SRL or for the management and execution of existing relationships.

6. Refusal to Provide Data

Any objection to data processing and/or refusal by the data subject to provide personal data may result in the impossibility or refusal, in whole or in part, to include or maintain the supplier in the supplier list, to enter into new contracts or to execute existing ones, or to comply with obligations under laws, regulations, EU legislation or provisions issued by legally authorized Authorities and Supervisory Bodies.

7. Communication of Data

Personal data, for the exclusive purposes referred to in point 1, may be communicated to:

a) employees or collaborators of EVOLOOP SRL authorized by the company itself to process the data;
b) credit institutions, service companies for registration, enveloping, transport and sorting of documents, contracting companies for works and services, notaries, lawyers, consultants and specialized companies for debt collection, auditing firms;
c) subjects to whom communication is due in compliance with collective agreements (e.g. trade unions) or specific regulatory obligations (e.g. Public Security Authorities or other public authorities).

Any dissemination of data is excluded.

8. Rights of the Data Subject

The privacy legislation (Articles 12-22 of EU Regulation 679/2016) guarantees You the right to be informed about the processing of data concerning You, the right to access the data at any time and to request its update, integration, and rectification. Where the conditions provided by law are met, the data subject may also exercise the right to erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to decisions based solely on automated processing.

Where the processing of personal data is based on the data subject's consent, the data subject has the right to withdraw such consent.

To exercise Your rights, or for more detailed information about the subjects or categories of subjects to whom the data are communicated or who become aware of them as data processors or authorized persons, You may contact EVOLOOP SRL, with registered office at Via Enrico Forlanini 23, 20134 Milan (MI), email: dpo@evoloop.it.

If You believe Your rights have been violated, You may lodge a complaint with the Data Protection Authority.

9. Data Retention Period

Your personal data will be retained for the period necessary to achieve the purposes referred to in point 1, and after the fulfillment of such purposes, until the expiry of the limitation period for rights arising in Your favor and in favor of EVOLOOP SRL as a result of the legal and factual relationships between the parties and directly or indirectly connected to such purposes.

In any case, with reference to processing carried out for the purposes referred to in point 1, letter a), the supplier's data will be retained for a period not exceeding 10 years from the date of the last service performed for EVOLOOP SRL, or from the date of inclusion in the list, or from the renewal of consent for inclusion in the list.

10. Processing of Third Party Data

The supplier is informed that, should it avail itself of its own employees or collaborators (including any subcontractors) in the performance of services for EVOLOOP SRL, the personal data of the latter may be processed by the Company for the management of contacts with the supplier's representatives and appointees.

Such processing has the same purposes, methods and retention periods as described in this notice; in relation to such processing, the data subjects have the same rights identified in point 8.

The supplier undertakes to properly inform its employees and collaborators about the aforementioned processing, also by providing them with this notice and by recording their signature for acknowledgment.

Information for Customers on the Processing of Personal Data

Pursuant to Legislative Decree No. 196/2003 and EU Regulation No. 679/2016 (GDPR), and in relation to the personal data concerning You that will be processed, We inform You of the following.

1. Purpose of Data Processing

EVOLOOP SRL, as the data controller, will process the customer's data for the following purposes:

a) evaluations regarding the advisability of entering into the contract (customer's economic capacity and potential reputational implications of the relationship, anti-corruption and anti-money laundering compliance);
b) conclusion, management and execution of contracts entered into with the customer;
c) compliance with legal obligations relating to civil, tax, accounting rules; fulfillment of obligations arising from entered contracts; technical assistance and support regarding products and services purchased by You, including after-sales and post-warranty period if expressly provided; administrative management of relationships.

2. Legal Basis for Data Processing

The customer's personal data will be processed on the following legal bases:

a) processing is necessary for the performance of a contract to which You are a party, or for the implementation of pre-contractual measures taken at Your request;
b) processing is necessary to comply with a legal obligation to which EVOLOOP SRL is subject.

3. Provision of Data

Without prejudice to the data subject's autonomy, the provision of directly acquired personal data may be:

a) mandatory under law, regulation, EU legislation or provisions issued by legally authorized Authorities or Supervisory Bodies;
b) strictly necessary for entering into new relationships between the customer and EVOLOOP SRL or for the management and execution of existing relationships.

Any objection to data processing and/or refusal by the data subject to provide personal data may result in the impossibility or refusal, in whole or in part, to enter into new contracts or to execute existing ones, or to comply with obligations under laws, regulations, EU legislation or provisions issued by legally authorized Authorities and Supervisory Bodies.

4. Data Collected from Third Parties

We inform You that the personal data subject to processing, particularly in relation to the purposes referred to in point 1, letter a), may be acquired not from the data subject but from third parties, through access to public databases or through dedicated inspection services.

5. Data Processing Methods

Personal data may be processed using both analog and electronic or automated means, with methods and procedures strictly necessary to achieve the purposes described above.

EVOLOOP SRL processes data directly through persons belonging to its own organization or by availing itself of external parties. Such parties will process the data:

a) in accordance with the instructions received from the data controller, as authorized persons or data processors, and exclusively for achieving the specific purposes indicated in this notice.
b) independently, as autonomous data controllers.

6. Communication and Dissemination of Data

Personal data, for the exclusive purposes referred to in point 1, may be communicated to:

a) employees or collaborators of EVOLOOP SRL authorized by the company itself to process the data;
b) credit institutions, service companies for registration, enveloping, transport and sorting of documents, contracting companies for works and services, notaries, lawyers, experts, consultants and specialized companies for debt collection, auditing firms;
c) subjects to whom communication is due in compliance with collective agreements (e.g. trade unions) or specific regulatory obligations (e.g. Public Security Authorities or other public authorities).

Any dissemination of data is excluded.

7. Rights of the Data Subject

The data protection legislation (Articles 12-22 of EU Regulation 679/2016) guarantees the right to be informed about data processing, the right to access the data at any time and to request its update, integration, and rectification. Where the conditions provided by law are met, the data subject may also exercise the right to erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to decisions based solely on automated processing.

Where the processing of personal data is based on the data subject's consent, the data subject has the right to withdraw such consent.

If You believe Your rights have been violated, You may lodge a complaint with the Data Protection Authority.

8. Data Retention Period

Personal data will be retained for the period necessary to achieve the purposes referred to in point 1, and after the fulfillment of such purposes, until the expiry of the limitation period for rights arising in Your favor and in favor of EVOLOOP SRL as a result of the legal and factual relationships between the parties and directly or indirectly connected to such purposes (10 years).

9. Processing of Third Party Data

The customer is informed that, should it involve third parties (e.g. representatives, employees, collaborators) in the execution of contracts entered into with EVOLOOP SRL, the personal data of the latter may be processed by EVOLOOP SRL, as data controller, for the purposes referred to in point 1, and in particular for managing contacts with the customer's representatives and appointees.

Such processing has the same purposes, methods and retention periods as described in this notice; in relation to such processing, the data subjects have the same rights identified in point 7.

The customer undertakes to properly inform the data subjects involved by it about the aforementioned processing, also by providing them with this notice and by recording their signature for acknowledgment.