privacy customers/suppliers


within the meaning and for the purposes of Art 13 of the EU Regulation of April 27th 2016 n° 679 “General Data Protection Regulation”

BRAMBATI SpA communicate that, for the initiation and conduct of the current contract , they are the Controller of your data qualified as personal data in accordance with the EU Reg. 2016/679 on personal data protection.

Purposes and Lawfulness of Personal Data Processing.

Personal data collection and processing are carried out:

1. for the administrative and operative management of the contract activity;

2. for the fulfilment of fiscal obligations and communications to financial administration;

3. for the fulfilment of the legal and contractual obligations associated with the contract;

4. for sending pre-contractual technical material and/or technical and economical offers on the Data Subject’s demand;

and will be processed according to the principles of correctness, lawfulness, transparency and protection of your privacy as well as of your rights. Your personal data will be processed throughout the contract period and also afterwards to perform all legal fulfilments.

The personal data that the Data Processing Controller may collect are as follows:

a) general data (name, surname, address, telephone number, e-mail address) of the legal representative / company contact;

The lawfulness of the processing is based on:

- fulfilment of any obligations arising from a contract (pursuant to art. 6.1, letter b) of the GDPR);

- fulfilment of any legal obligations (pursuant to art. 6.1, letter c) of the GDPR);

Processing Modes.

Data processing for the mentioned purposes takes place both by means of automated modes, on electronic or magnetic supports, and by means of non-automated modes, on paper support, in compliance with the privacy and security rules envisaged by the law, by consequent regulations as well as by internal provisions.

Data are always processed in full compliance with the principle of the proportionality of the processing, according to which all personal data and the different modes of their processing shall be relevant and not in excess compared to the purposes to be achieved.

Stored data are protected by adequate security measures, so as to reduce the hazard of fortuitous loss or unauthorized access as well as of processing not consented or not complying with the mentioned purposes.

Location of Processing

Data are processed and stored at the seat of Codevilla (PV), via Strada Nuova 37. Furthermore, they are processed on behalf of the Company by professionals and/or companies charged with carrying out technical, development, management and administrative-accounting activities.

Mandatory nature of providing the requested data and consequences of an objection to provide them

Providing the requested data is mandatory for all what is required pursuant to legal and contractual obligations and, therefore, an objection to provide them, completely or partially, may bring about the impossibility for BRAMBATI SpA to execute the contract or to perform correctly all the fulfilments associated with the contractual relationship.

Data Communication

Without prejudice to the communications carried out to perform legal and contractual obligations, all the data collected and processed can be communicated, exclusively for the above specified purposes, to:

- Public Bodies (INPS [National Social Welfare Institution], INAIL [ National Institute for Insurance against Accidents at Work], Provincial Department of Labour, Tax Offices, Revenue Agencies...);

- Insurance Companies and Credit Institutions;

Moreover, during the management of your data, these may be made known to persons authorized for their treatment and/or to external processors identified in writing and to whom written specific instructions have been given:

- Employees and/or Collaborators of BRAMBATI SpA;

- Professionals or Service Companies, for business administration and management, operating on behalf of our Company.

Data Transfer Abroad

No transfer of your personal data to third extra-European Countries is envisaged.

Data Storage Duration

The data provided will be stored in our archives according to the following parameters:

- 10 years after the end of the contractual relationship, except applicable obligations, if any, deriving from the regulations for personal data.

At the end of processing, data are destroyed from computer records and, as to paper documents, by means of adequate tools ensuring the effective destruction of the document.

Data Subject’s Rights

As to personal data, the Data Subject may exercise the rights pursuant to Chapter III of EU Reg. 2016/679 (a copy of which is attached herewith) in the limits and under the conditions pursuant to articles 15 – 23 of said Regulation. In particular BRAMBATI SpA assure and acknowledge Data Subjects the exercise of the following rights:

- the right to access to the personal data available in their own paper and/or electronic records;

- the right to require their correction, updating and erasure, if they are incomplete or wrong as well as the right to object to their processing for legitimate and specific reasons;

- the right to obtain the correction of inexact personal data without undue delay. Taking into account the purposes of processing, the Data Subject has the right to obtain the integration of incomplete personal data, also by providing an integrative notice;

- the right to obtain the erasure of personal data concerning him or her without undue delay where one of the following grounds pursuant to Art. 17, sub-section 1 of the Regulation applies;

- the right to obtain the restriction of processing, whenever one of the cases pursuant to Art. 18, Sub-section 1 of the Regulation occurs;

- the right to lodge a complaint with a Supervisory Authority; as well as to exercise the other rights acknowledged by the applicable framework.

The Data Subject may exercise his/her own rights by contacting the Controller of Processing via the contact details mentioned hereinafter, without prejudice to the mandatory requirements of the regulations in force at the time of the request, which might not allow executing the contract or correctly performing all contract fulfilments.

Controller of Processing

The above mentioned rights can be exercised, even through an officer, by means of request to Titolare del Trattamento dei dati at the Company Head Office in via Strada Nuova 37 – Codevilla (PV) - Tel. 0383 373100 or at the following e-mail address: .

The Controller of Processing is BRAMBATI SpA, via Strada Nuova 37 – Codevilla (PV) - Tel. 0383 373100 represented by their Legal Representative, dott. Fabrizio Brambati. E-mail

The complete text of the EU Reg. 2016/679 (GDPR) is available on the website of the Supervisory Authority

Codevilla, 24/05/2018 BRAMBATI SpA



Article 15 - Data Subject’s Access Right

1. The Data Subject shall have the right to obtain from the Controller of Processing confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or the categories of recipients your personal data are disclosed to or will be disclosed to, in particular if they are recipients of third countries or international organizations;

d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

e) the existence of the Data Subject’s right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the Data Subject or to object to such processing;

f) the right to lodge a complaint with a Supervisory Authority;

g) where the data are not collected from the Data Subject, any available information as to their source;

h) the existence of automated decision-making, including profiling, referred to in Article 22, paragraphs 1 and 4 and, at least in those cases, meaningful information about the logic involved as well as the significance and the envisaged consequences of such processing for the Data Subject.

2. Where personal data are transferred to a third country or to an international organisation, the Data Subject shall have the right to be informed on the appropriate safeguards pursuant to Article 46 relating to the transfer.

3. The Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs. Where the Data Subject makes the request by electronic means, and unless otherwise requested by the Data Subject, the information shall be provided in a commonly used electronic form. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.