About us and what we do with your personal data
Sisma S.p.A., with registered office in Via Industria 1, (36013) Piovene Rocchette (VI) (hereinafter also the Data Controller), in its capacity as data controller, is concerned with the confidentiality of your personal data and guarantees that they will be protected against any event that may put them at risk of breach.
To this end, the Data Controller implements policies and practices regarding the collection and use of personal data and the exercise of the rights recognised by the applicable legislation. The Data Controller is responsible for updating the policies and practices adopted for the protection of personal data whenever necessary and in any case in the event of regulatory and organisational changes that could affect the processing of your personal data.

The Data Controller has appointed a Data Protection Officer (DPO) who you can contact if you have questions about the policies and practices adopted: dpo@sisma.com
How and why does the Data Controller collect and process your personal data?
The Data Controller collects and/or receives information about you, such as:

• name, surname
• tax code or VAT number
• place and date of birth
• address
• email
• telephone number
• identification code
• current account number
• data relating to criminal convictions and/or offences exclusively in the case of litigation

The personal data concerning you will be processed for the following purposes:

1) the management of the contractual supply relationship and the consequent obligations, including regulatory

Your data may also be collected from third parties such as, for example:

• • other data controllers, for example companies in the Group to which the Data Controller belongs;
  • IT service provider.

I dati che La riguardano possono essere ottenuti mediante la consultazione di:

• lists kept by public or equivalent bodies or under the control of the public authority on the basis of specific national legislation.

2) for communication to third parties and for dissemination

The Data Controller does not transfer your personal data abroad (non-EU countries). Your personal data may be disseminated and disclosed through the Data Controller’s websites, where lists of suppliers and consultants are published in accordance with the Code of Ethics and the obligations of transparency and economic-social reporting.
Disclosure and disclosure concern the categories of data whose transmission and/or disclosure are necessary for the performance of the activities and purposes pursued by the Data Controller in managing the established relationship. The relevant processing does not require the data subject’s consent if it is required by law or to fulfill obligations arising from the contractual relationship,
or if another exclusion applies (in particular, application of the provisions of the Code of Ethics and/or the Data Controller’s legitimate interest), expressly provided for or dependent on the laws and regulations applied by the Data Controller, or through third parties identified as data processors;

3) for IT security activities

How, where and for how long is your data stored?
How
Data processing is carried out using paper or computerized procedures by specifically authorized internal personnel. These personnel are granted access to your personal data to the extent and within the limits necessary to carry out the processing activities concerning you.
The Data Controller periodically verifies the tools used to process your data and the security measures implemented for them, which are constantly updated. It verifies, also through authorized personnel, that no personal data is collected, processed, archived, or retained that is unnecessary or whose processing purposes have been fulfilled. It verifies that the
data is stored with guarantees of integrity and authenticity and that it is used for the purposes of the processing actually performed.
The Data Controller guarantees that the data, even after verification, is found to be excessive or irrelevant and will not be used, except for the possible retention, in accordance with the law, of the deed or document containing it.
Where
The data is stored in paper, computer, and electronic archives located within the European Economic Area, and adequate security measures are ensured. Your personal data may be transferred to the following non-EU countries, fully complying with the guarantees required by European legislation:
• USA, existence of an adequacy decision, Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield [notified under document C(2016) 4176];

• MEXICO: existence of standard contractual clause no. 27 December 2004 no. 50071/2004;
• Türkiye: existence of standard contractual clause no. 27 December 2004 no. 50071/2004;
• RUSSIA: existence of standard contractual clause of 5 February 2010 n°2010/87;
• CHINA: existence of standard contractual clause dated 5 February 2010 n°2010/87.

How long
Your personal data is retained for the time necessary to complete the activities related to the management of the contract you have entered into with the Data Controller and for the related obligations, including legal obligations.
In particular:

Once all the purposes that justify the retention of your personal data have been exhausted, the Data Controller will take care to delete them or make them anonymous.
What are your rights?
Your rights allow you to always have control over your data.
Your rights are:

• access;
• rectification;
• cancellation;
• limitation of processing;
• opposition to processing;
• portability.

In essence, you can, at any time and free of charge and without any particular charges or formalities for your request:

• obtain confirmation of the processing carried out by the Data Controller;
• access your personal data and know their origin (when the data is not obtained directly from you), the purposes and aims of the processing, the data of the subjects to whom they are communicated, the period for which your data will be stored or the criteria used to determine it;
• update or rectify your personal data so that it is always accurate and up-to-date;
• Delete your personal data from databases and/or backup archives if, among other things, they are no longer necessary for the purposes of the processing or if the processing is deemed unlawful, provided that the legal requirements are met; and in any case, if the processing is not justified by another equally legitimate reason;
• Restrict the processing of your personal data in certain circumstances, for example, if you have contested its accuracy, for a period of time necessary for the Data Controller to verify its accuracy. You must also be informed, within an appropriate timeframe, when the suspension period has expired or the reason for the restriction of processing has ceased to exist, and the restriction has therefore been lifted;
• obtain your personal data, if their processing is carried out on the basis of a contract and with automated tools, in electronic format also for the purpose of transmitting them to another Data Controller.

The Data Controller shall proceed in this manner without delay and, in any case, no later than one month after receiving your request. This deadline may be extended by two months if necessary, taking into account the complexity and number of requests received. In such cases, the Data Controller will inform you and explain the reasons for the extension within one month of receiving your request.
For any further information and to submit your request, please contact the Data Controller at privacy@sisma.com.
How and when can you object to the processing of your personal data?
For reasons relating to your particular situation, you may object at any time to the processing of your personal data if it is based on legitimate interest by sending your request to privacy@sisma.com.
You have the right to have your personal data erased if there is no legitimate reason that prevails over the reason for your request.
Who can I complain to?
Fatta salva ogni altra azione in sede amministrativa o giudiziaria, può presentare un reclamo all’autorità garante per la protezione dei dati personali, a meno che Lei non risieda o non svolga la Sua attività lavorativa in altro Stato membro. In tale ultimo caso, o in quello in cui la violazione della normativa in materia di protezione dei dati personali avvenga in altro Paese dell’UE, la competenza a ricevere e conoscere il reclamo sarà delle autorità di controllo ivi stabilite.
Ogni aggiornamento della presente informativa Le sarà comunicato tempestivamente e mediante mezzi congrui e altrettanto Le sarà comunicato prima di procedervi e in tempo per prestare il Suo consenso se necessario.