You need to read the following information in order to understand the reasons why your personal data are processed, what your rights and entitlements are and how you can exercise them, in line with the provisions of European Regulation 2016/679 on Personal Data Protection and of Legislative Decree No. 196/2003, as amended (the “Data Privacy Code”), whose purpose is to safeguard the fundamental rights and freedoms of individuals.

Data Controller

The Data Controller is DoveVivo S.p.A., Viale Stelvio, 66 - 20129 MILAN (MI), Tel. 02 36697390 Email privacy@dovevivo.it

Data processing purposes

Personal information and data (including personal particulars, contact details, economic data, a copy of an ID document and, as appropriate, workplace health and safety self-declarations) are processed exclusively in order to ensure compliance with legal obligations and in order to manage suppliers (administration of suppliers, administration of contracts, orders, arrivals, invoices and recruitment in accordance with the company's needs). The following are the various legal bases and justifications of the data processing: implementing pre-contractual measures at the data subject's request, executing a contract to which the data subject is party, fulfilling applicable legal obligations, and the Data Controller's legitimate interest in the company's regular and efficient management (Article 6 (1) letters b, c and f of EU Regulation 2016/679).

Recipients or categories of recipient to whom personal data may be communicated

Your data may be disclosed to employees and collaborators of the undersigned; they will be permitted to process such data according to the undersigned's instructions. The data may also be disclosed to third party persons/entities, for example: the IT company whose services the undersigned uses, banks entrusted with payments and/or refunds, consultants (individuals and associates), public authorities who request such data; the data may also be disclosed in order to ensure compliance with applicable legal obligations.

Data retention period

The personal data will be retained for the duration of the contract and, subsequently, for as long as the Data Controller is required to retain such data for tax purposes or for other purposes envisaged by applicable legislative or regulatory provisions. If no contract is signed, the personal data will be kept for a period of 5 years and then erased.

The data subject's rights and entitlements

The data subject is entitled to receive confirmation from the Data Controller as to whether or not personal data concerning said data subject are being processed and, if so, the latter is entitled:

• to obtain access to the personal data in question, to request to have the personal data rectified or erased, to have the data processing restricted, or to object to the data processing;
• to receive from the Data Controller that data subject's personal data, in a format that is structured and in common use and readable on an automatic device, and also to transmit this data to a different data controller (data portability);
• to be informed about the existence of an automated decision-making process, including profiling;
• to revoke one's consent at any time, if the revocation is specifically notified, without prejudice to the legality of data processing operations already conducted based on consent given prior to the revocation;
• to file a complaint with the supervisory authority.

Nature of the data and consequences of failing to communicate data

We need you to provide us with your personal data if we request such data in order to give effect to specific compliance or other obligations associated with managing the contract; the failure to provide such data could, therefore, make it impossible to implement the contract itself.