Privacy Notice for suppliers

Date of last update: 9 July 2026

Pursuant to Articles 13 and 14 of EU Regulation 2016/679, we inform you of the following:

  1. Data Controller.

    The Data Controller is M4SS S.r.l., with registered office in Reggio Emilia, via dello Statuto n. 1/A, tax code and VAT number: 02772290355, e-mail: privacy@m4ss.net, which has appointed its own Data Protection Officer (DPO), who can be contacted at the registered office of M4SS S.r.l. and at the following e-mail address: dpo@m4ss.net.

  2. Purposes and legal basis of data processing.

    Processing is aimed at:

    1. availing ourselves of your performance, or, where the data subject is an internal contact person, of your company or professional firm, and thus executing the contract or the requested pre-contractual measure; the legal basis is the necessity to perform a contract to which the data subject is a party (or their company or professional firm), or to carry out pre-contractual measures adopted at their request;

    2. contacting and communicating by e-mail or telephone for pre-contractual purposes related to the provision or use of services or products; the legal basis for processing your identification data (name and surname) and contact data (e-mail address or telephone number), retrieved from public sources on the web (for example: corporate websites), consists in the pursuit of M4SS S.r.l.'s legitimate interest in identifying potential commercial partners by contacting (minimising the processing of their personal data) internal contact persons specifically designated for this purpose;

    3. fulfilling obligations provided by law, by a regulation, by Community legislation or by an order of the Authority; the legal basis is the fulfilment of a legal obligation to which the Data Controller is subject;

    4. defending a right in legal proceedings; the legal basis is the pursuit of the Data Controller's legitimate interest.

  3. Categories and sources of data processed.

    Processing may concern personal data for personal identification, such as name and surname, for electronic identification, such as e-mail addresses, as well as any telephone numbers, provided by the data subject or by the company or professional firm to which they belong for the execution of contractual or pre-contractual relationships.

  4. Methods of data processing.

    Processing is carried out, using methods strictly necessary to meet the purposes indicated above, by means of some of the operations or the set of operations referred to in Article 4, no. 2) of EU Regulation 2016/679: collection, recording, organisation, structuring, storage, consultation, processing, adaptation, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. The operations may be carried out with or without the aid of electronic, telematic or otherwise automated tools. The personal data are not subject to any fully automated decision-making process, including profiling.

  5. Provision of data.

    The provision of personal data, while not a legal obligation, may be a necessary requirement for concluding the contract between M4SS S.r.l. and the supplier, or for carrying out the requested pre-contractual or contractual measure; therefore, any refusal or failure to provide the data may make it impossible to conclude and perform the aforementioned contract or the requested pre-contractual or contractual measure. In any case, by communicating your personal data for any of the purposes referred to in point 2, M4SS S.r.l. may process such data to fulfil obligations provided by law, by a regulation, by Community legislation or by an order of the Authority and to pursue its legitimate interests in protecting a right in legal proceedings.

  6. Data retention.

    Personal data will be processed and retained for the entire period necessary for the complete performance of the contract or the requested pre-contractual measure, as well as for the period necessary for the defence of its rights in legal proceedings or before judicial authorities. In any case, personal data will be processed and retained for the period necessary for the correct fulfilment of retention obligations for tax purposes or for other purposes provided by law or regulation, to which M4SS S.r.l. is subject.

  7. Communication of data.

    Personal data may be communicated to, or become known to, for the purposes referred to in point 2 and to provide, improve, protect and promote its services:

    1. internal personnel of M4SS S.r.l., specifically authorised to process data and assigned to personnel management and related payroll, to administration, and to the management and control of the corporate IT infrastructure;

    2. data processors and their further processors and authorised parties, such as, by way of example and not exhaustively: accountants, labour consultant, IT service providers or their support providers, and the relevant appointed technical staff, any collaborators, persons in charge of occasional maintenance operations, all adequately trained in confidentiality protection;

    3. public bodies, judicial or administrative authorities, for the fulfilment of legal obligations;

    4. banking and insurance institutions;

    5. other parties processing the data in fulfilment of specific legal obligations.

  8. Transfer of data abroad.

    Personal data will not be transferred outside the European Union and the European Economic Area.

  9. Rights of the data subject.

    Pursuant to Articles 15-18 and 20-21 of EU Regulation 2016/679, the data subject has the right to obtain:

    1. confirmation as to whether or not personal data concerning them exist, even if not yet registered, and their communication in intelligible form;

    2. the indication of:
      - the origin of the personal data;
      - the purposes and methods of processing;
      - the logic applied in case of processing carried out with the aid of electronic tools;
      - the identifying details of the Controller and of any processors;
      - the parties or categories of parties to whom the personal data may be communicated or who may become aware of them in their capacity as processors or appointees;

    3. updating, rectification or, where they have an interest therein, the completion of the data;

    4. the erasure, anonymisation or blocking of data processed in breach of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;

    5. confirmation that the operations referred to in letters c) and d) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where such fulfilment proves impossible or involves a manifestly disproportionate effort compared to the right protected.

    The data subject has the right to object, in whole or in part:

    1. for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purpose of collection;

    2. to the processing of personal data concerning them for the purpose of sending advertising material or direct selling, or for carrying out market research or commercial communication.

    The data subject has the right to data portability, i.e. to receive, in a structured, commonly used and machine-readable format, the personal data concerning them and has the right to transmit such data to another Data Controller without impediment.
    The data subject also has the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la Protezione dei dati personali, the Italian Data Protection Authority: www.garanteprivacy.it).
    They may exercise their rights by means of a written request, sent to M4SS S.r.l., at the contact details indicated in point 1.