1. Data controller

Pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (“GDPR”), we wish to inform you that Techbau SpA, as Data Controller (hereinafter “Controller”), processes personal data relating to employees and collaborators of your company (hereinafter “Company”) for the purpose of the company’s supplier qualification process and the execution of the professional relationship between the parties.

2. Contact

Techbau SpA is the data controller and can be contacted at the dedicated email address privacy@tb-prod.local, or by post at the Administrative Headquarters at Via del Lago, 57 Castelletto Sopra Ticino (NO) – 28053.

3. Purpose of this information document

This information notice provides details on the nature of the personal data held by the data controller, the purposes and methods of processing, any recipients of the data, and the rights recognized under the GDPR.

4. Purpose of data use and legal basis

As part of the process of qualifying company suppliers and managing the professional contract between the parties, the Data Controller needs to acquire information about the organization of the Company, including information relating to employees and collaborators, which qualifies as personal data. This data is collected from the Company or directly from the Company’s employees and collaborators.

The personal data collected is used solely for the purpose of executing and managing professional services ( ), as well as for purposes closely related to this ( ). In any case, the Data Controller processes personal data in compliance with current legislation.

The legal basis for the processing is the legitimate interest of the Data Controller in executing the professional services contract (Art. 6, I, f) GDPR).

5. Categories of data subject to processing

Identification, contact, and professional data are processed for the purposes of providing the service involving the Company.

6. Data retention periods

Personal data is retained for the time necessary to pursue the purposes described above, in accordance with the terms applicable by law or in the cases provided for by law.

The data necessary for the administrative and legal management of professional relationships will be retained for a period of 10 years after the termination of the contract. The retention period for ordinary operational data is limited to what is strictly necessary.

7. Methods of data use

In relation to the purposes indicated, the processing will be carried out using manual and computerized tools and with organizational and processing logic strictly related to the purposes pursued and, in any case, in a manner that guarantees the security, integrity, and confidentiality of the data processed, with the adoption of technical and organizational measures appropriate to the risk identified on your rights and freedoms, pursuant to Article 32 of the GDPR.

Personal data will be processed exclusively by authorized personnel, in compliance with the instructions given, who need it for their work, who will act under confidentiality restrictions, adopting appropriate security measures.

8. Scope of data circulation

The processing is carried out directly by the data controller’s organization, through appropriately designated and trained individuals, who act as data processors, as well as by external companies that perform various services on behalf of the Company, including as data processors and/or persons in charge of processing. By way of example, the data may be communicated to external consultants, service providers (including IT providers) and other categories of suppliers whose work is necessary for the company qualification process, contract management and professional relationships. The aforementioned data will not be disclosed to unspecified parties.

9. Nature of the provision

The processing of this information is entirely instrumental to the aforementioned purpose and the provision of data is necessary for the performance of the professional contract. The provision of personal data is mandatory and, in the absence thereof, we will not be able to proceed with the execution of the contract.

10. Scope of data transfer

Within the scope of the purposes indicated above, the aforementioned personal data is stored and used in Italy. However, the parties reserve the right to transfer the data outside the European Union to countries that ensure the same level of security and guarantee in data processing.

11. Exercise of rights

At any time, employees or collaborators of the Company may obtain from the Data Controller, where applicable, access to personal data concerning them, their correction, deletion, or limitation of processing (Articles 15 et seq. of the GDPR). They may also object to the processing if the legal requirements are met. The specific request should be addressed to the contact points indicated in section 2 “Contacts,” preferably including the words “Request to exercise privacy rights” in the subject line of the communication.

Data subjects who believe that the processing of their personal data in this manner violates the provisions of the personal data protection regulations have the right to lodge a complaint with the Data Protection Authority pursuant to Article 77 of the GDPR (https://www.garanteprivacy.it/reclamo) or to appeal to the judicial authorities (Article 79 of the Regulation and Article 140 -bis of the Code).

Techbau S.p.A.

Notice updated to October 2025.