Personal data processing policy for customers and suppliers

In accordance with Legislative Decree 196/2003 and EU Regulation 679/2016 (GDPR) and in relation to the personal data that concerns you and which will be processed, we inform you of the following.


“Data” refers to those relating to individuals treated by the corporation Gualini S.p.A. for the conclusion and execution of the contractual relationship with its customers/suppliers, such as the customer/supplier himself where physical person, or of his legal or its employees as a legal entity, as well as any other information necessary to carry out the contract and/or the provision of the service(s).

In particular, these data will be processed for the purposes listed below.

  1. Management of the contractual/commercial relationship, such as: satisfying specific customer/supplier requests before the conclusion of the contract; conclusion, modifications, execution of the contract; provision and management of related services; handling of complaints.

The legal basis for the treatment in relation to these purposes are:

– The fulfilment of contractual obligations and/or implementation of pre-contractual measures taken at the request of the person concerned, for contracts made directly with the person concerned;

– The legitimate interest (to manage and execute the contract) for the data processing of the employees/consultants of the supplier/customer involved in the activities referred to in the contract.

  1. Administrative – accountants, such as: invoicing; management of payments, delays and non-payments; communication of the same data between the companies of the corporation, for organizational, administrative, financial and accounting purposes functional to the above-mentioned activities.

The legal basis for treatment in relation to these purposes are

– The need to fulfil the legal obligation to keep the accounts;

– The legitimate interest in the administrative management of the contractual relationship

  1. Fulfilment of statutory obligations under national or European Union law or collective agreements in accordance with national law, such as: fulfilment of obligations under EU and national regulations, in particular in the area of health and occupational safety, and crime prevention (anti-mafia, anti-corruption legislation, D.Lgs. 231/2001). The legal basis for the treatment is the need to fulfil a legal obligation to which the controller is subject.
  2. Exercise and/or defence of rights in court proceedings and debt collection, such as: management of possible litigation, protection and recovery of claims, either directly or through third parties (lawyers/agencies/credit recovery companies). The legal basis for the treatment is the legitimate interest


The data will be processed for the duration of the contractual relationship and, after its termination, until the end of the limitation period of the mutual rights between the parties. In case of administrative litigation, the data will be processed for the duration of the dispute, and until the decision is taken.


The processing of personal data can be carried out with the help of either analogue and electronic or otherwise automated tools, with methods and procedures strictly necessary to the pursuit of the purposes described above.


Data may be disclosed to external entities acting as self-employed data controllers, as public or private entities entitled to deal with the Data (e.g. governments, banks and lenders, accountants, notaries, lawyers and other professionals).

The data may be processed, on behalf of the controller, by external entities designated as those responsible for the treatment, who carry out specific activities, such as his distribution network, companies and agents who debt collection for the holder, legal, tax and administrative advisors.

The data may be processed by employees of the company functions, responsible for the pursuit of the above mentioned purposes, who have been expressly authorised for treatment and who have received appropriate operational instructions.

Data is not subject to dissemination.


If you refuse to give personal data, you may not be able (in a total or partial way) to comply with legal obligations, which means not to enter into or execute the contract or service correctly. In this case, while the person has still the option to not give his data, the Data Controller reserves the right to suspend, terminate or not establish the contractual relationship.


The data controller is the corporation Gualini S.p.A., with legal headquarters in 24060 – B. Colleoni sn street, Costa di Mezzate (BG), TAX CODE 1988450167 and VAT N.1988450167, contacts The controller can process the data directly, through his own authorized employees, or by employing external collaborators, who in this case assume the status of Treatment Managers. The updated list of Treatment Managers is made available by the Data Controller on request.


The Personal Data Protection Act (Article 12-22 of EU Regulation 679/2016) guarantees you the right to be informed about data processing and the right to access the data at all times and to request its updating, integration and adjustment. If the conditions laid down by the law are met, the person may also claim the right to delete the Data, the limitation of their treatment, the portability of the data, the opposition to treatment, not to be subject to decisions based solely on automated processing. If the processing of personal data is based on the consent of the person concerned, he is entitled to withdraw the consent.

In order to exercise your rights, or to receive more detailed information about the processing of your data, you can contact Gualini S.p.A. at the inbox:

If you feel your rights are being affected, filing a complaint with the Data Protection Authority may protect you.


The customer/supplier is informed that, if he uses his own employees or partnerships (including any subcontractors) in executing the contractual relationship, the personal data of the latter may be processed by Gualini S.p.A., as controller of the treatment, for the purposes referred to in point 1. These treatments have the same purpose, methods and period of data retention described in this policy; In relation to these treatments, the interested parties also have the same rights as in point 7. The customer/supplier has the burden of properly informing its employees and partnerships about these treatments, including by handing over to them in this policy.