Skip to content

Supplier Privacy Notice

Version: 1.0 – Last updated: 28 October 2026

Processing of personal data of suppliers and their contact persons, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.

This notice describes how CheckSig S.r.l. Società Benefit processes the personal data of suppliers who are natural persons and of suppliers’ contact persons: purposes, legal bases, retention periods, recipients, transfers and data subjects’ rights.

  • Document type: Privacy notice (Articles 13-14 GDPR)
  • Addressees: Suppliers who are natural persons and suppliers’ contact persons
  • Controller: CheckSig S.r.l. Società Benefit
  • Privacy contact: [email protected]
  • Owner: Compliance & Complaints
  • Review: Annually and whenever the processing changes

References: Regulation (EU) 2016/679 (GDPR) Articles 6, 12-22, 28, 44-46, 77, 79 · Italian Legislative Decree 196/2003 · Regulation (EU) 2022/2554 (DORA) Articles 28-30 · Regulation (EU) 2023/1114 (MiCAR) Article 73 · Italian Legislative Decree 109/2007 · ISO/IEC 27701 · POL Privacy System Policy · PRO Procedure for drafting and managing privacy notices · PRO Procurement and third-party management procedure.

1. Introduction and addressees

CheckSig S.r.l. Società Benefit (hereinafter, the ”Company” or the ”Controller”), pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter, the ”GDPR”), informs the natural persons whose personal data are processed in the context of the selection, qualification and management of suppliers about the methods and purposes of the processing.

This notice is addressed to:

  • suppliers who are natural persons, self-employed professionals and sole traders, including during selection or requests for quotation;
  • legal representatives, contact persons, employees and collaborators of suppliers that are legal entities, whose data are provided to the Company in the context of the supply relationship (hereinafter, together, the ”Data Subjects”).

2. Data controller and contact details

The data controller is CheckSig S.r.l. Società Benefit, tax code and VAT number 11028330964, with registered office at Piazza del Liberty 8, 20121 Milan (MI), Italy, acting through its legal representative.

For any matter relating to the processing of personal data and to exercise their rights, Data Subjects may write to [email protected] or, by certified email (PEC), to [email protected].

The Company has not appointed a Data Protection Officer (DPO); requests are handled by the Compliance & Complaints team at the contact details given above.

3. Source of personal data

Personal data are collected directly from the Data Subject or, where the Data Subject acts on behalf of a supplier that is a legal entity, from the supplier itself (for example in contracts, orders, correspondence or qualification questionnaires). Where necessary to vet the supplier, some data may be obtained from public registers, such as the Companies Register, and from the public lists of European Union restrictive measures.

4. Categories of personal data processed

The Company processes only ordinary personal data, in particular:

  • Identification and professional data: first name, last name, role, organisation;
  • Contact data: email address, telephone number, business contact details;
  • For suppliers who are natural persons and sole traders, tax and payment data: tax code, VAT number, bank details and invoicing data;
  • Data from public registers: personal details (including date and place of birth), tax code and office held by the supplier’s legal representatives and officers, when obtained from public registers to vet the supplier;
  • Data relating to restrictive measures screening: outcome of the screening of the name of the supplier and of its legal representatives and officers against European Union restrictive measures lists;
  • Access data: personal credentials, authorisations and access logs, when the Data Subject accesses the Company’s information systems or premises to perform the supply.

The Company does not request or process special categories of personal data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR).

5. Purposes, legal bases and retention period

a) Selection of the supplier, handling of requests for quotation, conclusion and performance of the contract with the supplier who is a natural person.

  • Legal basis: performance of a contract or taking steps at the Data Subject’s request prior to entering into a contract (Article 6(1)(b) GDPR).
  • Retention period: duration of the contractual relationship and 10 years from its termination (Article 2946 of the Italian Civil Code); for quotations not followed by a contract, 2 years from the request.

b) Management of operational relations with the contact persons of suppliers that are legal entities (communications, orders, coordination of activities).

  • Legal basis: legitimate interest of the Controller in the proper management of the relationship with the supplier (Article 6(1)(f) GDPR).
  • Retention period: duration of the relationship with the supplier; the contact person’s data are updated or deleted when the supplier notifies their replacement, except for those contained in documents to be retained for purposes c) and e).

c) Compliance with legal obligations: accounting and tax obligations, obligations to manage ICT third-party risk and outsourcing laid down by sector regulations (Regulation (EU) 2022/2554 “DORA” and Regulation (EU) 2023/1114 “MiCAR”), screening against the list of European Union restrictive measures (Italian Legislative Decree 109/2007) and responding to requests from the authorities.

  • Legal basis: legal obligation to which the Controller is subject (Article 6(1)(c) GDPR).
  • Retention period: accounting records and tax documents: 10 years from the date of the last entry (Article 2220 of the Italian Civil Code); documentation relating to the management of ICT third-party service providers and outsourcing and to restrictive measures screening: duration of the relationship and 10 years from its termination.

d) Qualification, assessment and monitoring of the supplier, information security and control of access to systems and premises.

  • Legal basis: legitimate interest of the Controller in information security and in managing supply chain risks (Article 6(1)(f) GDPR); mandatory requirements for ICT service providers fall under purpose c).
  • Retention period: duration of the relationship with the supplier and 10 years from its termination for qualification and assessment documentation; access logs: 12 months from recording, unless further retention is necessary to investigate security incidents.

e) Establishment, exercise or defence of a right of the Controller in judicial or out-of-court proceedings.

  • Legal basis: legitimate interest of the Controller in protecting its rights in judicial and out-of-court proceedings (Article 6(1)(f) GDPR).
  • Retention period: data contained in contracts, orders and correspondence: 10 years from the termination of the relationship with the supplier (Article 2946 of the Italian Civil Code); in the event of litigation, until it is settled and the time limits for appeal have expired.

Once the retention periods indicated above have expired, the data are deleted or irreversibly anonymised.

6. Nature of the provision of data

The provision of data for purposes a) and c) is necessary: failure to provide them prevents the Company from establishing or performing the supply relationship and from complying with legal obligations. The provision of contact persons’ data for purposes b) and d) is necessary for the operational management and vetting of the supplier: without it, the relationship cannot be managed properly. For purpose e), data are processed only if and insofar as they have already been obtained for the other purposes.

7. Processing methods and security

The data are processed mainly by electronic means and, to a residual extent, on paper, by authorised and trained personnel, with technical and organisational measures appropriate to the risk adopted within the Company’s information security and privacy management system, aligned with ISO/IEC 27001 and ISO/IEC 27701, including access control based on the principle of least privilege, multi-factor authentication, encryption and access logging.

8. Recipients of the data

The data may be disclosed, to the extent strictly necessary, to the following categories of recipients:

  • providers of IT, cloud and communication services used by the Company, acting as processors (Article 28 GDPR);
  • accounting, tax, legal and employment advisors, audit firms, the board of statutory auditors and the firm appointed to perform the outsourced internal audit function, acting as independent controllers or processors;
  • banks and payment institutions, to execute payments;
  • management system certification bodies, in the context of audits;
  • supervisory authorities (including CONSOB and the Bank of Italy), judicial authorities and other public authorities, where required by law.

The data are not made public. The up-to-date list of processors is available on request at the contact details given in chapter 2.

9. Transfer of data outside the European Economic Area

The data are processed mainly within the European Economic Area (EEA). Some of the Company’s technology service providers (for example cloud email, collaboration and relationship management services) may also process data outside the EEA, in particular in the United States. In such cases, the transfer is based on an adequacy decision of the European Commission (Article 45 GDPR), including the EU-US Data Privacy Framework for certified recipients, or on standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). A copy of the safeguards adopted may be requested at the contact details given in chapter 2.

10. Automated decision-making

The data are not subject to decision-making based solely on automated processing, including profiling, which produces legal effects concerning the Data Subject or similarly significantly affects them (Article 22 GDPR).

11. Rights of the Data Subject

The Data Subject may exercise the following rights at any time:

  • Access (Article 15 GDPR): obtain confirmation as to whether or not data concerning them are being processed and receive a copy;
  • Rectification (Article 16 GDPR): obtain the correction of inaccurate data and the completion of incomplete data;
  • Erasure (Article 17 GDPR): obtain the erasure of data, in the cases provided for and without prejudice to statutory retention obligations;
  • Restriction (Article 18 GDPR): obtain the restriction of processing, for example where the accuracy of the data is contested;
  • Portability (Article 20 GDPR): receive the data provided in a structured, commonly used and machine-readable format and transmit them to another controller, limited to processing based on the contract and carried out by automated means (purpose a);
  • Objection (Article 21 GDPR): object at any time, on grounds relating to their particular situation, to processing based on the Controller’s legitimate interest (purposes b), d) and e)). The Controller will no longer process the data unless it demonstrates compelling legitimate grounds which override the Data Subject’s interests or the need to establish, exercise or defend legal claims.

Requests may be sent to [email protected]. The Company responds without undue delay and in any event within one month of receipt; this period may be extended by two further months where requests are complex or numerous, in which case the Data Subject is informed within the first month. Responses are free of charge, except in the case of manifestly unfounded or excessive requests (Article 12(5) GDPR). The Company communicates any rectification, erasure or restriction to the recipients to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19 GDPR).

12. Right to lodge a complaint

A Data Subject who considers that the processing of their data infringes the GDPR has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Article 77 GDPR), following the procedures indicated at www.garanteprivacy.it, or to bring proceedings before the competent courts (Article 79 GDPR).

13. Communication of this notice by the supplier

A supplier that is a legal entity and provides the Company with personal data of its legal representatives, employees or collaborators undertakes to bring this notice to their attention.

14. Changes and updates

The Company may amend or update this notice, including as a result of changes in legislation or in the processing. The version in force is published on the website www.checksig.com, is referred to in contracts and purchase orders with suppliers and is communicated to active suppliers in the event of material changes.

Last updated: 28/10/2026.

15. Version history

  • 1.0 – 28/10/2026 – Compliance & Complaints: First issue.