1. Purposes of data processing

COCCE SRL, as data controller, will process the customer's data for the following purposes:

1. assessments regarding the opportunity to enter into the contract (customer's financial capacity and potential reputational implications of the relationship, anti-corruption and anti-money laundering obligations);
2. conclusion, management and performance of contracts entered into with the customer;
3. legal obligations related to civil, tax and accounting rules; fulfilment of obligations arising from concluded contracts; technical assistance and support regarding the products and services purchased by you, including after-sales and after any warranty period if expressly provided; administrative management of relationships.

2. Legal bases for data processing

The customer's personal data will be processed on the basis of the consent expressed by signing this notice.
We inform you that, even in the event of failure to provide consent or withdrawal of the same, your personal data may still be processed in the following cases and on the following legal bases:

1. where processing is necessary for the performance of a contract to which you are a party, or for the implementation of pre-contractual measures adopted at your request;
2. where processing is necessary for compliance with a legal obligation to which COCCE SRL is subject;
3. where processing is necessary to protect the vital interests of a natural person;
4. where processing is necessary for the performance of a task carried out in the public interest or connected with the exercise of official authority vested in COCCE SRL;
5. where processing is necessary for the purposes of a legitimate interest of COCCE SRL; in particular, legitimate interests may include:
   • the interest in entering into, managing and performing the contracts referred to in point 1(b);
   • the interest in protecting its rights arising, directly or indirectly, in relation to such contracts;
   • the interest in protecting the security and assets of the company;
   provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail.

3. Provision of data

Without prejudice to the data subject's autonomy, the provision of directly acquired personal data may be:

1. mandatory under law, regulation or EU legislation, or under provisions issued by legally authorised authorities or supervisory and control bodies;
2. strictly necessary for entering into new relationships between the customer and COCCE SRL, or for managing and performing existing relationships.

Any objection to data processing and/or refusal by the data subject to provide personal data may result in the impossibility or refusal, in whole or in part, to enter into new contracts with them or to perform existing ones, to comply with obligations provided for by laws, regulations or EU legislation, or by provisions issued by legally authorised authorities and supervisory and control bodies.

4. Data collected from third parties

We inform you that the personal data subject to processing, in particular with reference to the purposes referred to in point 1(a), may be acquired not from the data subject but from third parties, through access to public databases or through dedicated inspection services.

5. Methods of data processing

Personal data may be processed with the aid of analog and electronic or otherwise automated means, using methods and procedures strictly necessary for pursuing the purposes described above.
COCCE SRL carries out processing directly through individuals belonging to its organisation or by using parties external to the company. Such parties will process the data:

1. in accordance with the instructions received from the Data Controller, respectively as authorised persons or processors, and exclusively for the specific purposes indicated in this notice.
2. in total autonomy, as independent controllers.

6. Communication and dissemination of data

Personal data, for the sole purposes referred to in point 1, may be communicated to:

1. employees or collaborators of COCCE SRL authorised by the company to process data;
2. credit institutions, service companies for recording, enveloping, transport and sorting of documents, contractors for works and services or service providers, notaries, lawyers, experts, consultants and specialised debt collection companies, audit firms;
3. parties to whom communication is due in fulfilment of any collective agreements (e.g. trade unions) or specific regulatory obligations (e.g. law enforcement or other public authorities).

Any operation of dissemination of data is excluded.

7. Data subject's rights

Data protection legislation (Arts. 7-10 of Legislative Decree 196/2003 and Arts. 12-22 of EU Regulation 679/2016) guarantees the right to be informed about data processing, and the right to access the data at any time and to request its updating, integration and rectification. Where the conditions provided for by the legislation apply, the data subject may also claim the right to erasure of data, restriction of their processing, data portability, objection to processing, and not to be subject to decisions based solely on automated processing.
Where the processing of personal data is based on the data subject's consent, they have the right to withdraw the consent given.
To exercise your rights, as well as for more detailed information about the parties or categories of parties to whom the data is communicated or who become aware of it as processors or authorised persons, you may contact the personal data protection officer at COCCE SRL, with registered office at Borgo Pietro Wuhrer, 89 – 25123 Brescia (BS), email: dpo@cocce.it
If you believe your rights have been infringed, you may protect yourself by lodging a complaint with the Italian Data Protection Authority.

8. Data retention period

Personal data will be retained for the period necessary to achieve the purposes referred to in point 1 and, following the exhaustion of such purposes, until the expiry of the limitation period of the rights arising for you and COCCE SRL as a consequence of the legal and factual relationships between the parties and directly or indirectly connected to those purposes (10 years).

With exclusive reference to marketing purposes, data will be retained for 4 years.

9. Processing of third-party data

The customer is informed that, where they involve third parties (e.g. representatives, employees, collaborators) in the performance of contracts entered into with COCCE SRL, the personal data of such third parties may be processed by COCCE SRL, again as data controller, for the purposes referred to in point 1 and in particular for managing contacts with the customer's referents and appointees.
Such processing has the same purposes, methods and retention periods described in this notice; moreover, with regard to such processing, the data subjects have the same rights identified in point 8.
The customer undertakes to correctly inform the data subjects involved about such processing, including by delivering this notice to them and recording their signature for acknowledgement.

1. Purposes of data processing

COCCE SRL, as data controller, will process the supplier's data for the following purposes:

1. survey and registration of the supplier in the supplier list;
2. assessment of the supplier's reliability (financial solidity, economic and organisational capacity, references, professional qualifications, contribution regularity, insurance coverage, conflicts of interest, anti-corruption and anti-money laundering obligations, possible reputational implications of the relationship);
3. management of contracts entered into with suppliers for works or services, including activities relating to accounting records and entries, compliance with obligations provided for by laws, regulations or EU legislation, or by provisions issued by legally authorised authorities and supervisory and control bodies;
4. assessment of the supplier in relation to the services performed for COCCE SRL;
5. legal obligations related to civil, tax and accounting rules; fulfilment of obligations arising from concluded contracts; administrative management of relationships;

2. Legal bases for data processing

The supplier's personal data will be processed on the basis of the consent expressed by signing this notice.
We inform you that, even in the event of failure to provide consent or withdrawal of the same, your personal data may still be processed in the following cases and on the following legal bases:

1. where processing is necessary for the performance of a contract to which you are a party, or for the implementation of pre-contractual measures adopted at your request;
2. where processing is necessary for compliance with a legal obligation to which COCCE SRL is subject;
3. where processing is necessary to protect your vital interests or those of another natural person;
4. where processing is necessary for the performance of a task carried out in the public interest or connected with the exercise of official authority vested in COCCE SRL;
5. where processing is necessary for the purposes of a legitimate interest of COCCE SRL;
   in particular, legitimate interests may include:
   • the interest in entering into, managing and performing the contracts referred to in point 1(c);
   • the interest in protecting its rights arising, directly or indirectly, in relation to such contracts;
   • the interest in protecting the security and assets of the company;
   provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail.

3. Data collected from third parties

We inform you that the personal data subject to processing, in particular with reference to the purposes referred to in point 1(b), may be acquired not from the data subject but from third parties, through access to public databases, through dedicated inspection services or by requesting references from the supplier's previous customers.
The categories of data acquired from third parties are those indicated in point 1(b), namely data relating to the supplier's reliability, financial solidity, economic and organisational capacity, references, professional qualifications, contribution regularity, insurance coverage, conflicts of interest, anti-corruption, possible reputational implications of the relationship.

4. Methods of data processing

Personal data may be processed with the aid of analog and electronic or otherwise automated means, using methods and procedures strictly necessary for pursuing the purposes described above.
The Company carries out processing directly through individuals belonging to its organisation or by using parties external to the company. Such parties will process the data:

1. in accordance with the instructions received from the company to which they belong as processors or appointees, including the company's employees or collaborators assigned to company structures within the functions to which they are assigned and exclusively for the specific purposes indicated in this notice.
2. in total autonomy, as distinct Controllers.

5. Provision of data

Without prejudice to the data subject's autonomy, the provision of personal data may be:

1. mandatory under law, regulation or EU legislation, or under provisions issued by legally authorised authorities or supervisory and control bodies;
2. strictly necessary for entering into new relationships between the supplier and COCCE SRL or for managing and performing existing relationships.

6. Refusal to provide data

Any objection to data processing and/or refusal by the data subject to provide personal data may result in the impossibility or refusal, in whole or in part, to include or retain the supplier in the supplier list, to enter into new contracts with them or to perform existing ones, to comply with obligations provided for by laws, regulations or EU legislation, or by provisions issued by legally authorised authorities and supervisory and control bodies.

7. Communication of data

Personal data, for the sole purposes referred to in point 1, may be communicated to:

1. employees or collaborators of COCCE SRL authorised by the company to process data;
2. credit institutions, service companies for recording, enveloping, transport and sorting of documents, contractors for works and services or service providers, notaries, lawyers, consultants and specialised debt collection companies, audit firms;
3. parties to whom communication is due in fulfilment of any collective agreements (e.g. trade unions) or specific regulatory obligations (e.g. law enforcement or other public authorities).

Any operation of dissemination of data is excluded.

8. Data subject's rights

Privacy legislation (Arts. 7-10 of Legislative Decree 196/2003 and Arts. 12-22 of EU Regulation 679/2016) guarantees you the right to be informed about the processing of data concerning you, and the right to access the data at any time and to request its updating, integration and rectification. Where the conditions provided for by the legislation apply, the data subject may also claim the right to erasure of data, restriction of their processing, data portability, objection to processing, and not to be subject to decisions based solely on automated processing.
Where the processing of personal data is based on the data subject's consent, they have the right to withdraw the consent given.
To exercise your rights, as well as for more detailed information about the parties or categories of parties to whom the data is communicated or who become aware of it as processors or appointees, you may contact the personal data protection officer at COCCE SRL, with registered office at Borgo Pietro Wuhrer, 89 – 25123 Brescia (BS), email: dpo@cocce.it.
If you believe your rights have been infringed, you may protect yourself by lodging a complaint with the Italian Data Protection Authority.

9. Data retention period

Your personal data will be retained for the period necessary to achieve the purposes referred to in point 1 and, following the exhaustion of such purposes, until the expiry of the limitation period of the rights arising for you and COCCE SRL as a consequence of the legal and factual relationships between the parties and directly or indirectly connected to those purposes.
In any case, with reference to processing carried out for the purposes referred to in point 1(a), the supplier's data will be retained for a period not exceeding 10 years, starting from the end of the last service performed for COCCE SRL, or from the date of inclusion in the list itself, or from the renewal of consent to inclusion in the list.

10. Processing of third-party data

The supplier is informed that, where they use their own employees or collaborators (including any subcontractors) in the performance of services for COCCE SRL, the personal data of such parties may be processed by the Company for managing contacts with the supplier's referents and appointees.
Such processing has the same purposes, methods and retention periods described in this notice; moreover, with regard to such processing, the data subjects have the same rights identified in point 8.
The supplier undertakes to correctly inform its employees and collaborators about such processing, including by delivering this notice to them and recording their signature for acknowledgement.