Skip to content
Savino Del Bene Volley
Shop
🇬🇧|🇮🇹

Supplier privacy notice

Pallavolo Scandicci Savino Del Bene Società Sportiva Dilettantistica a Responsabilità Limitata, with registered office at Via Benozzo Gozzoli 5/6, 50018 Scandicci (FI), Italy, as data controller, represented by its legal representative pro tempore, informs data subjects of the purposes and methods of processing of the personal data collected, the scope of their disclosure and the nature of their provision.

How this notice is provided

Pursuant to EU Regulation 2016/679 (GDPR), Legislative Decree 196/2003 and any other data protection law applicable in Italy, including the measures of the Italian Data Protection Authority («Privacy Law»), the club fulfils the obligation of art. 13 GDPR by providing this notice to customers and suppliers. The notice is available on the club's website.

Data processed

The controller processes the identification data (for example name, surname, company name, address, telephone, email, bank and payment details, tax code — «personal data» or «data») that you provide when entering into or performing contracts with the controller. The controller may also process special categories of data that you voluntarily provide for the services you request: please provide them only where necessary. If you send special categories of data without specifically consenting to their processing, the controller cannot be held liable, since processing is then allowed as it concerns data manifestly made public by the data subject (art. 9(2)(e) GDPR). We nevertheless remind you of the importance of giving explicit consent to the processing of special categories of data if you decide to share them.

In providing some services the controller may process personal data of third parties that you send (for example your employees, customers or suppliers). In these cases you are an independent controller and bear the related legal obligations and responsibilities, holding the controller harmless against any claim from third parties whose data were processed after you disclosed them in breach of applicable law. You also warrant, under your own responsibility, that the processing of third-party data you provide rests on an appropriate legal basis under art. 6 GDPR.

The controller may also process data not provided by you but obtained elsewhere, even without your consent, for example from the tax register or public registers (land registry, companies register).

Data controller

The data controller is Pallavolo Scandicci Savino Del Bene Società Sportiva Dilettantistica a Responsabilità Limitata, with registered office at Via Benozzo Gozzoli 5/6, 50018 Scandicci (FI), Italy, represented by its legal representative pro tempore, whom you can contact at any time at [email protected].

Purposes and legal basis

1. Processing, subject to your specific consent where required, has the following purposes:

  1. entering into contracts with the controller;
  2. fulfilling pre-contractual, contractual and tax obligations arising from existing relationships;
  3. providing the services and supplies requested;
  4. answering requests for assistance or information;
  5. fulfilling legal, accounting and tax obligations;
  6. protecting the controller's credit and other rights relating to the individual contract;
  7. fulfilling other obligations under law, regulation, EU legislation or an order of an authority;
  8. exercising the controller's rights (for example the right of defence in court);
  9. safeguarding the operation of IT systems, including: backup and restore of data; logging and checking transactions to verify system functionality; detecting and preventing unauthorised access; managing incidents and problems.

2. Only with your express consent (art. 7 GDPR), to send you communications by automated means (sms, mms, email, push notifications, fax) and non-automated means (post, telephone with an operator). The controller collects a single consent for these communications. You can object or withdraw your consent at any time by writing to the contacts in this notice, without affecting the lawfulness of processing carried out before withdrawal.

Processing methods

Data are processed in accordance with the law cited and the controller's confidentiality obligations, with computer tools, on paper and on any other suitable medium, adopting the technical, organisational and security measures required by the GDPR.

Recipients

Without prejudice to disclosures required by law and contract, data processed by the controller (also as processor of data of which you remain controller) are not disseminated, that is, not made known to unspecified parties in any form, including making them available or open to consultation.

Within the limits of the purposes stated, data may be disclosed to the controller's employees and collaborators; professional partners; factoring companies; banks; debt collection companies; credit insurance companies; business information companies; professionals and consultants; parties appointed or authorised by the controller to provide data processing, consultancy or activities instrumental to the contract; and to all parties to whom disclosure is required by law.

Data are not disseminated except in anonymous and aggregate form, for statistical or research purposes (for example ISTAT surveys).

For the purposes stated, data may also be made available to third parties acting on behalf of the club, for example:

  • couriers and forwarders delivering products (for example returns) and documents addressed to you;
  • companies, consultants or professionals installing, maintaining, updating and managing the club's hardware and software or those it uses for its services;
  • companies or Internet providers sending documentation or information material;
  • companies processing or sending advertising and information material on behalf of the club.

These parties process data exclusively as external processors on behalf of the club. The up-to-date list of processors is available at the club's registered office.

Disclosure of data

Without express consent (art. 6(b) and (c) GDPR), the controller may disclose data processed for the purposes of point 1 to supervisory bodies, judicial authorities, insurance companies for the provision of insurance services and to parties to whom disclosure is mandatory by law. These parties process data as independent controllers.

Transfers abroad

Data are kept on paper in Italy and on servers and electronic equipment in Italy or in any case within the European Union. Any transfer outside the EU will only be to countries for which the European Commission has recognised an adequate level of data protection.

Retention period

Data are kept no longer than necessary for the purposes for which they are processed (storage limitation principle, art. 5 GDPR) or according to legal deadlines. The controller processes them for the time needed for the purposes stated and, afterwards, to fulfil the legal obligations connected with the contract: up to 11 years after the end of the relationship, that is no more than one year after the limitation periods, with annual erasure by 31 December.

Nature of provision and consequences of refusal

Providing data for the purposes of point 1 is mandatory: without them we cannot guarantee what is provided for in point 1. Providing data for the purposes of point 2 is optional: you may provide no data or later refuse processing of data already provided.

Your rights

As a data subject you have the rights of art. 15 GDPR, namely to:

  1. obtain confirmation of whether personal data concerning you exist, even if not yet recorded, and their communication in intelligible form;
  2. obtain information on the source of the data; the purposes and methods of processing; the logic applied to processing by electronic means; the identity of the controller and processors; the parties or categories of parties to whom data may be disclosed or who may learn of them;
  3. obtain the updating, rectification or, where you have an interest, completion of the data; the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is not necessary; confirmation that these operations have been notified to those who received the data, unless this is impossible or disproportionate;
  4. object, in whole or in part, on legitimate grounds to the processing of data concerning you, and to processing aimed at sending you, by email, post, sms, WhatsApp or telephone, confirmations or changes of appointments and other information about existing relationships: you may choose to receive only traditional communications, only automated ones, or neither.

Where applicable you also have the rights of arts. 16-21 GDPR (rectification, erasure, restriction of processing, data portability, objection) and the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

How to exercise your rights

To exercise your rights, write to [email protected].

Privacy notice — version 01/2021.