{"id":5628,"date":"2026-07-20T09:29:27","date_gmt":"2026-07-20T08:29:27","guid":{"rendered":"https:\/\/www.brivio.it\/supplier-information\/"},"modified":"2026-07-27T08:17:46","modified_gmt":"2026-07-27T07:17:46","slug":"supplier-information","status":"publish","type":"page","link":"https:\/\/www.brivio.it\/en\/supplier-information\/","title":{"rendered":"Supplier Information"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Supplier Notice<\/strong><\/b><\/h1>\n

<\/p>\n

Supplier Notice on the Processing of Personal Data pursuant to Article 13 of EU Regulation 2016\/679<\/h2>\n

Dear Supplier,<\/p>\n

A. Brivio Compensati S.p.a.<\/b>, acting as the Data Controller, with registered office at Via Novara 258<\/b>, 27038 Robbio (PV)<\/b>, Tax Code: 02109430153<\/b> and VAT No.: 02109430153<\/b>, tel.0384 689211<\/b>, email: <\/b>hr@brivio.it<\/b><\/a>, hereby informs you that the personal data you have provided to us will be processed in accordance with European (EU Regulation 2016\/679, hereinafter the \u201cRegulation\u201d) and national data protection legislation. The processing will be based on the principles of fairness, lawfulness and transparency, safeguarding your privacy and your rights.<\/p>\n

– Purposes and legal bases of the processing<\/b><\/p>\n

The personal data collected will be processed exclusively for the following purposes:<\/p>\n

    \n
  1. management and selection of suppliers, as well as the performance of activities related to contractual or pre-contractual obligations;<\/li>\n
  2. administrative, accounting and tax management of the relationship, including payments and invoicing;<\/li>\n
  3. verification of technical and professional requirements and compliance with social security contributions;<\/li>\n
  4. management of access to company premises and systems, where necessary;<\/li>\n
  5. protection of the Data Controller\u2019s rights, including the management of disputes, breaches of contract, formal notices, settlements, debt recovery and arbitration.<\/li>\n<\/ol>\n

     <\/p>\n

    For the purposes set out above, the processing of personal data is carried out in accordance with the conditions of lawfulness laid down in EU Regulation 2016\/679 and, in particular, pursuant toArticle 6(1)(b)<\/b> for the performance of the contract or pre-contractual measures, and Article 6(1), (c)<\/strong><\/b> for the fulfilment of legal obligations, and Article 6(1)(f)<\/b> for the pursuit of the Data Controller\u2019s legitimate interests relating to the management of relations with suppliers, organisational matters and the protection of its rights.<\/p>\n

    – Types of data processed and nature of provision<\/b><\/p>\n

    The processing may concern personal and identification details, contact details, company details (for representatives of legal entities), administrative, tax and accounting data, payment details (e.g. IBAN), data relating to technical and professional qualifications and compliance with social security contributions, as well as data relating to the performance of the contractual relationship and, where necessary, access details for company systems. The provision of personal data is mandatory for the purposes set out above; therefore, failure to provide such data, or the provision of incomplete or inaccurate data, may make it impossible, in whole or in part, to establish or manage the contractual relationship with the Data Controller.<\/p>\n

    – Methods of data processing<\/strong><\/b><\/p>\n

    Personal data is processed using IT and paper-based methods by internal staff expressly authorised by the Data Controller and, where necessary, by third parties appointed as data processors pursuant to Article 28 of the Regulation; processing is carried out in accordance with the principles of lawfulness, fairness and transparency and in a manner suitable for ensuring the security and confidentiality of the data.<\/p>\n

    The Data Controller implements appropriate technical and organisational measures to protect personal data against the risk of loss, unauthorised access, unlawful use or alteration, in accordance with the provisions of Article 32 of the Regulation and applicable legislation.<\/p>\n

    – Scope of data disclosure and transfer<\/b><\/p>\n

    Personal data may be processed by internal staff expressly authorised by the Data Controller, such as employees and contractors, and may also be disclosed to third parties engaged by the Data Controller for the purposes set out above, such as tax advisers and accountants, legal advisers, banks and financial institutions, public authorities and government bodies, IT and management service providers, and other parties involved in the management of the contractual relationship; these parties process the data in their capacity as data processors pursuant to Article 28 of the Regulation or, where applicable, as independent data controllers, in accordance with the instructions provided by the Data Controller and limited to what is necessary for the performance of the tasks entrusted to them. Personal data are not disclosed and are not transferred outside the European Economic Area.<\/p>\n

    – Retention of processed data<\/b><\/p>\n

    Personal data is retained for the time strictly necessary to fulfil the purposes set out above and, in any event, in compliance with applicable legal obligations; in particular, data relating to the contractual relationship, including administrative, tax, accounting and payment data, is retained for a period of 10 years from the termination of the relationship, without prejudice to any further regulatory obligations or the need to protect the Data Controller\u2019s rights. Data relating to potential suppliers is retained for a maximum period of 24 months from the date of collection, whilst any data processed for the purpose of verifying technical and professional requirements or compliance with social security contributions is retained for the time necessary to carry out such checks; in the event of a dispute, the data will be retained for the entire duration of the dispute and until the time limits for bringing appeals have expired. Once the retention period has expired, the data will be erased or anonymised, subject to technical backup and archiving procedures.<\/p>\n

    – Rights of the data subject<\/b><\/p>\n

    We inform you that, in relation to the processing of data, as a data subject, you may exercise the rights set out in Articles 15\u201322 of the GDPR 2016\/679, namely:<\/p>\n