Information on data processing for customers and suppliers of Plastifil SA – Mendrisio
Dear Customer,
We hereby inform you that, pursuant to Art. 19 of the Federal Data Protection Act of September 25, 2020 (hereinafter referred to as “FADP”), your personal data will be processed by Plastifil SA, with registered office in Piazzale Roncaa, 2 CH-6850 Mendrisio, in its capacity as Data Controller (“Controller”), for the following purposes:
1) The Customer’s personal data (legal representative, internal contacts) will be processed for purposes related to customer-supplier contractual obligations. The processing may also involve the personal data of your employees/collaborators involved in the activities. The legal basis for the processing will be the execution of a contract.
2) Personal data will also be processed for administrative and accounting purposes, such as accounting management, treasury management, and invoicing (e.g., verification and recording of invoices), in accordance with the requirements of current legislation, or for the fulfillment of other obligations provided for by laws, regulations, and EU legislation. Legal basis for processing: compliance with a legal obligation.
3) Personal data may be processed by the Data Controller for the following purposes:
a) to assert and/or defend its rights in court, manage disputes, contractual breaches, warnings, transactions, debt collection, credit protection, and arbitration; Legal basis for processing: compliance with a legal obligation.
b) for purposes of statistics and customer satisfaction management. The legal basis for processing is the execution of the contract.
c) checks on the reliability of the customer for the management of the process of verifying customer requirements with respect to company policies. Legal basis for processing: legitimate interest.
4) The data may also be processed by the Data Controller for direct marketing and advertising activities, market research, promotional activities, information and commercial communications always and only relating to products and/or services similar to those already purchased, by post and/or email. Legal basis for processing: legitimate interest.
The nature and methods of providing users’ personal data.
The provision of personal data (such as name, surname, postal address, email address, etc.) is mandatory for the purposes listed above; therefore, failure to provide such data, or providing partial or inaccurate data, could make it objectively impossible for the data controller to establish or regularly conduct the contractual relationship.
The provision of personal data for marketing/market research/satisfaction survey purposes is optional, therefore failure to provide such data will have no consequences other than the inability to receive information and updates on products.
The provision of personal data The provision of personal data for marketing/market research/satisfaction survey purposes is optional, therefore without any consequence other than not being able to receive information and updates on the products and initiatives of the data controller.
Methods of processing and security.
Data processing refers to any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organizing, structuring, storing, adapting or modifying, extracting, consulting, using, communicating by transmission, dissemination or any other form of making available, comparing or interconnecting, restricting, erasing or destruction.
Personal Data will be processed mainly in automated form but also in paper form, using logic strictly related to the aforementioned purposes. The Data Controller has adopted appropriate security measures to protect the data against the risk of loss, misuse, or alteration of personal data. In particular, it has adopted, where possible, the measures referred to in Art. 8 LPD.
Scope of communication or dissemination and transfer of Personal Data outside Switzerland/the EU.
Personal Data will not be disclosed to third parties, except for external services used to achieve the purposes set out above. Personal Data will not be disseminated and will not be transferred to countries outside Switzerland/the EU.
Minors.
Plastifil SA does not process personal data of minors in relation to its customers.
Categories of subjects who may become aware of users’ Personal Data.
Personal Data may be disclosed to employees or collaborators of the Data Controller and Managers who, operating under the direct authority of the Data Controller, process data and are appointed as managers or persons in charge of processing or System Administrators and who will receive adequate operating instructions from the Data Controller in this regard; the same will apply, under the responsibility of the Managers appointed by the Data Controller, to the employees or collaborators of the Managers.
These subjects are essentially included in the following categories: software suppliers and related assistance/maintenance; accounting and tax consultants; occupational safety consultants; credit institutions, consultants, agents. In addition, the data may be disclosed to third parties acting as independent data controllers, such as: supervisory bodies; certification bodies and organizations.
Duration of processing and data retention.
The data communicated is retained for the time necessary to fulfill the purposes; or for any other legitimate purpose; specifically, it will be retained for the entire duration of the contract and, after its termination, for a maximum of 10 years, in compliance with tax regulations. In the event of legal disputes, personal data will be stored for the entire duration of the dispute, until the time limits for bringing legal action have expired. Data provided for marketing purposes will be retained for a maximum of 24 months from the last interaction. Once the above retention periods have expired, personal data will be destroyed or anonymized, in accordance with technical procedures for deletion and backup.
The place of processing and contact details of the Data Controller.
Personal Data is mainly processed at the Data Controller’s headquarters, via ai Ronchi 41 CH-6802 Rivera and/or at the locations where the Data Processors are located. For further information, users may contact the Data Controller by sending an email to privacy@plastifil.ch
Rights of data subjects
We inform you that, in relation to the processing of data, you may exercise the rights referred to in Articles 25-29 of the LPD, which are attached to this policy. In particular, the customer may object at any time to the processing of data for marketing purposes. For full clarity on the operations we have reported, to exercise your rights under the law, and to view the updated list of data processors, you may contact Plastifil SA at the following
address: privacy@plastifil.ch.
RIGHTS OF THE DATA SUBJECT Articles 25-29 LPD (Right of access to personal data and other rights)
- The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to the personal data and the following information:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organizations;
- where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;
- the existence of the right of the data subject to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning him or her or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the data are not collected from the data subject, any available information as to their source;
- the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and expected consequences of such processing for the data subject.
- Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the existence of adequate safeguards pursuant to Article 16 relating to the transfer.
- The data controller shall provide a copy of the personal data undergoing processing. In the event of additional copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submits the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.
- The right to obtain a copy without adversely affecting the rights and freedoms of others.
Last updated: 01.09.2023
