Privacy Policy

Orvat, as Data Controller, pursuant to Article 13 of EU Regulation 679/2016 (hereinafter, the "Privacy Regulation"), as amended and supplemented, collects and subsequently processes personal data of its Customers and Suppliers (hereinafter, the "Data Subject"). 

1. Purpose and methods of processing. 

The data subject's personal data are processed as part of the Controller's normal business activities, for the following purposes: 

1. proper and complete performance of the obligations of the contractual relationship entered into (hereinafter, the "Contract"); 
2. administrative and accounting tasks strictly related to the Contract;
3. compliance with specific obligations laid down by law, regulation or Community legislation (e.g. those relating to "anti-money laundering"); 
4. updating the data subject on promotional and marketing initiatives, also by sending advertising and/or promotional material (e.g. newsletters), by means of automated tools and/or traditional contact methods. 

Personal data is processed under the authority of the Data Controller by persons specifically appointed, authorised and trained for such processing pursuant to article 29 of the Privacy Regulations, using manual, computerised or telematic tools, with logic strictly related to the purposes and in any case in such a way as to guarantee the confidentiality and security of personal data. Personal data may also be processed on behalf of the Data Controller by specially appointed data processors pursuant to Article 28 of the Privacy Regulation. 

Personal data will be stored for a period determined according to criteria based on the nature and duration of the Contract and the need to protect the interests of the Data Subject. 

2. Legal basis of the processing, nature of the provision and consequences of refusal, consent of the data subject. 

2.1)  Purposes referred to in points 1., 2. and 3. above.

 With reference to the purposes referred to in paragraph 1, points 1., 2. and 3. above, the provision of personal data is compulsory and constitutes a necessary requirement for the performance of the Contract; in fact, failure to provide such data makes it impossible to receive the service covered by the Contract itself and, therefore, the legal basis of its processing is the proper execution and management of the Contract. 

2.2)  Purposes referred to in paragraph 1, point 4 above. With reference to the purpose referred to in paragraph 1, point 4. above, the provision of data is optional and failure to provide consent only determines the impossibility of receiving updates on promotional and marketing initiatives, also by sending advertising and/or promotional material (e.g. newsletters). 

3. Persons or categories of persons to whom personal data may be communicated and scope of communication. 

In relation to the purposes of the processing indicated above, and within the limits strictly pertinent to the same, the personal data of the interested party will or may be communicated to the following categories of subjects: 

(i)  to the tax authorities and other public authorities, where required by law or at their request; 

(ii)   to credit institutions for payment instructions or other financial activities instrumental to the performance of the Contract; 

(iii)  external structures and/or companies used by the Controller to carry out activities connected with, instrumental to or consequent upon the performance of the Contract;

(iv)   external consultants (e.g. for the management of tax obligations), unless they are designated in writing as Data Processors; 

(v)  to external parties carrying out control activities, such as auditing firms, boards of auditors, supervisory bodies; 

(vi)  factoring companies and/or specialised companies or law firms to recover debts and/or protect their interests/rights; 

The subjects indicated above, to whom the personal data of the interested party will or may be communicated (insofar as they have not been designated in writing as Data Processors), will process the personal data in their capacity as Data Controllers pursuant to the Privacy Regulations, in full autonomy, being unrelated to the original processing carried out by the Data Controller. 

An up-to-date list of the persons indicated and of the persons responsible for processing may be provided on request by the data subject. 

 The data of the interested party will not be disseminated. 

Should this be necessary for the performance of the Contract, the personal data of the Data Subject may be transferred to EU and/or non-EU countries, in full compliance with the provisions of the Privacy Regulation, the measures and decisions of the Privacy Guarantor on the subject, as well as EU legislation. In particular, the Data Controller undertakes to comply with the provisions set out in Decisions 2001/497/EC, 2004/915/EC and 2010/87/EU (depending on the case in question), which require the signing of so-called "standard contractual clauses" between the legal entities involved in the processing of non-EU data. 

4. Rights of the data subject. 

Articles 15 et seq. of the Privacy Regulation give the interested party the right to obtain: 

• confirmation as to whether or not personal data relating to him exist, even if they have not yet been recorded, and communication of such data in intelligible form; 
• indication of the origin of the personal data, the purposes and methods of processing, the logic applied in the event of processing carried out with the aid of electronic instruments, the identification details of the data controller; 
• the updating, rectification, integration, cancellation, transformation into anonymous form or blocking of data processed in breach of the law (including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed). Certification that these operations have been brought to the attention of those to whom the data have been communicated or disseminated (including their content), unless this requirement proves impossible or involves the use of means manifestly disproportionate to the protected right. 

The data subject also has the right: 

• to withdraw at any time the consent given to the processing of personal data, where applicable, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal);
• to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of collection;
• to object, in whole or in part, to the processing of personal data concerning him/her for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication;
• to lodge a complaint with the Garante for the protection of personal data in the cases provided for by the Privacy Regulation;
• the portability of personal data within the limits of Article 20 of the Privacy Regulation. 

For a detailed and constantly updated list of the entities to whom your personal data

The data subject may be communicated, and in order to exercise his or her rights under Articles 15 et seq. of the Privacy Regulation, he or she may contact the Data Controller: 

Orvat Via Carlo Urbani,8 – Cerea (VR) – 37053  Tel: +39 0442 30377 E.mail: info@orvat.com