VAM Investments Group S.p.a.
Administrative management of suppliers
Administrative management of suppliers
The controller processes personal data of suppliers and their contact persons in the administrative and contractual management of supply relationships. The processing includes: collecting and recording master data; assessing and selecting suppliers; managing and filing contracts; managing purchase orders; checking performance; managing operational and administrative communications.
Why we process the data and on what legal basis
- Collecting and recording the master data of suppliers and their contact persons.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR)
- Assessing and selecting suppliers.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR)
- Managing and performing supply contracts.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR)
- Managing purchase orders and checking performance.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR)
- Managing operational and administrative communications with suppliers.Legal basis: Performance of a contract (or pre-contractual measures) (Art. 6(1)(b) GDPR)
Categories of data subjects
- Suppliers who are natural persons
- Contact persons of suppliers that are legal persons
- Professionals and external collaborators
Data subjects requiring greater protection: B2B customers and/or suppliers
Categories of personal data
- Identification data (e.g. first name, surname)
- Contact data (e.g. email, telephone, office address)
- Tax data (e.g. tax code, VAT number)
- Contractual data (e.g. financial terms, contract duration)
- Bank data (e.g. IBAN, payment details)
Categories of recipients
- Lawyers (in the event of disputes)
- Banks (for payments)
- External auditors
- Statutory auditors
Processors
- XION Informatica S.a.s. di Cattivelli & C. (IT services)
- TLA Studio Tributario e Legale (Accountants and tax advisers)
- Datev Koinos S.r.l. (Software services)
- Microsoft Ireland Ltd. (Software services)
Transfers to third countries
Some personal data are transferred to countries outside the European Economic Area (EEA). Below you will find, for each transfer, the party involved, the destination country and the safeguard that makes it lawful:
- Microsoft Ireland Ltd. (Software services) — United States (safeguard: EU-US Data Privacy Framework)
Microsoft has obtained certification under the EU-US DPF, which is covered by an adequacy decision of the European Commission.
Retention period
The data are retained for the duration of the relationship and, thereafter, for the period needed for administrative/accounting obligations and the protection of rights (as a rule 10 years), unless there is litigation.
Consequences of not providing the data
Providing the data is necessary to manage the assessment/onboarding of the supplier and the performance of the contract; without them it will not be possible to establish or manage the supply relationship.