PRIVACY NOTICE AND CONSENT FORM FOR CUSTOMERS AND SUPPLIERS
PURSUANT TO THE GENERAL DATA PROTECTION REGULATION (EU) 2016/679

🞘 PREAMBLE 🞘
Pursuant to and for the purposes of the GDPR – General Data Protection Regulation (EU) 2016/679, GAMI S.R.L. hereby provides, as it does in fact provide, the information required by Article 13 in a concise, transparent, intelligible form using clear and plain language to the data subject — that is, the natural person to whom the personal data refer: sole trader, retailer, craftsman, professional, consumer, etc., or anyone acting on behalf of legal entities as their administrator, director, attorney, manager, shareholder, auditor, guarantor, etc., in their capacity as:
□ Customer, in the context of GAMI S.R.L.’s activities, particularly the repair and maintenance of machinery and equipment in general, including industrial machinery and machine tools, equipment and apparatus; installation of machinery, equipment and apparatus, including industrial ones, as well as their disassembly, final commissioning and testing;
□ Supplier, as necessary for GAMI S.R.L. and its activities as described above, in order to obtain the data subject’s free, specific, informed and unambiguous consent, as defined by Article 4 and provided by Article 7, for the lawful processing of their personal data necessary for and aimed at executing a professional (with the Customer) or supply (with the Supplier) contract of which the data subject is a party or for the execution of pre-contractual measures taken at their request.

The GDPR provides, among others, the following definitions:

  • “Personal data”: any information relating to an identified or identifiable natural person (data subject);
  • “Processing”: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  • “Special categories of personal data”: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation.

🞘 INFORMATION NOTICE 🞘

A) IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER AND ITS REPRESENTATIVE
The Data Controller is GAMI S.R.L. – Registered Office: Via Guglielmo Marconi 27/A, 10040 Val della Torre (Turin), Italy – Tel. +39 011 19473127 – Email: amministrazione@gami-srl.it – Website: www.gami-srl.it – Tax Code, VAT No. and Turin Companies Register No. 12186590019 – REA (Economic and Administrative Index) Turin 1271269.
No Representative of the Data Controller has been designated, as the requirements are not met.

B) IDENTITY AND CONTACT DETAILS OF THE DATA PROCESSOR
No Data Processor has been designated, as the requirements are not met.

C) IDENTITY AND CONTACT DETAILS OF THE DATA PROTECTION OFFICER
No Data Protection Officer has been designated, as the main activities of the Data Controller do not require regular and systematic large-scale monitoring of data subjects, nor do they involve large-scale processing of special categories of personal data or data relating to criminal convictions and offences, in accordance with the guidelines issued by the Italian Data Protection Authority in its “New FAQs on the Data Protection Officer in the private sector” dated March 26, 2018.

D) PURPOSES AND LEGAL BASIS OF DATA PROCESSING
The personal data of the data subject as a Customer are processed exclusively within the scope of GAMI S.R.L.’s activities or for the execution of pre-contractual measures requested by the data subject, while the personal data of the data subject as a Supplier are processed exclusively as necessary for GAMI S.R.L.’s activities or for the execution of pre-contractual measures requested by the data subject. In both cases, processing is carried out for:

  1. Compliance with legal obligations, EU regulations, or orders from competent authorities;
  2. Management of relationships with Customers and Suppliers;
  3. Business purposes of GAMI S.R.L., such as:
    • Direct or third-party surveys of Customer and Supplier satisfaction;
    • Promotion and sale of GAMI S.R.L.’s services via mail, automated systems, phone, etc.;
    • Market research and statistical analysis.

The personal data processed are those listed in the professional or supply contract or other related documents (e.g., name, birthdate and place, address, tax code, contact details), and may be supplemented with data arising from the business relationship.
If special categories of personal data must be processed during the course of the relationship, such processing will only take place if necessary or objectively useful for the execution of GAMI S.R.L.’s activities or services requested by the data subject, and only where the conditions of Article 9 GDPR are met, including the subject’s explicit consent.
Data are processed using manual, electronic and telematic tools, ensuring confidentiality and security in constantly monitored environments.
GAMI S.R.L. may undertake promotional initiatives for Customers and Suppliers.

E) LEGITIMATE INTERESTS PURSUED BY THE DATA CONTROLLER
The only legitimate interests pursued are those that are necessary for the lawful and objective execution of GAMI S.R.L.’s activities or services requested by the data subject or for pre-contractual measures requested by the same.

F) POSSIBLE RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The personal data of the data subject (Customer or Supplier), including special categories of personal data where necessary, may be disclosed to the following recipients and their staff:

  • Shareholders and authorised staff of GAMI S.R.L.;
  • Lawyers, collaborators, consultants, professionals, and experts (including firms);
  • Private entities (business associations, banks, IT service providers, insurance companies, data processing and storage services, public funding operators, etc.);
  • Public entities (e.g., Postel S.p.A., Judicial Offices, Chambers of Commerce);
  • Other private and public entities where data disclosure is necessary or useful for achieving the purposes outlined in section D.

Personal data processed by GAMI S.R.L. are not disseminated to the public.

G) INTENTION TO TRANSFER DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS
The Data Controller does not intend to transfer personal data to a third country or an international organisation.

H) DATA RETENTION PERIOD OR CRITERIA TO DETERMINE SUCH PERIOD
Personal data will be stored for a maximum of ten years from the last processing need, unless specific legal, civil, criminal, or fiscal requirements or judicial orders mandate a different retention period.

I) RIGHTS OF THE DATA SUBJECT
The data subject has the right to:

  • Request access to, rectification or erasure of personal data, restriction of processing, or object to processing, as well as the right to data portability (Art. 13(2)(b) GDPR);
  • Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal (Art. 13(2)(c) GDPR);
  • Lodge a complaint with a supervisory authority (www.garanteprivacy.it) (Art. 13(2)(d) GDPR).

J) REQUIREMENT TO PROVIDE PERSONAL DATA
In general, providing personal data may be required by law or necessary for the execution of a contract or pre-contractual measures requested by the data subject.
Specifically, in order for GAMI S.R.L. to perform its services or pre-contractual measures, the provision of personal data — including special categories where necessary — is mandatory. Failure to provide such data will prevent GAMI S.R.L. from delivering its services.
Conversely, providing data for promotional purposes (as per section D, point 3) is optional and not providing them does not prevent the provision of core services.

K) AUTOMATED DECISION-MAKING
GAMI S.R.L. does not use any automated decision-making process, including profiling.