Processing of Suppliers’ Personal Data
1. Contact Details of the Data Controller
DATA CONTROLLER (the “Company” or the “Controller”)
W EXECUTIVE UK LIMITED (W Executive)
Company Number: 15207872
Registered office: Mappin House, 4 Winsley Street, London, United Kingdom, W1W 8HF
Email: privacy@wexecutive.uk
EU LEGAL REPRESENTATIVE under art. 27 GDPR:
W EXECUTIVE SRL
Registered Office:
Email: privacy@wexecutive.it
2. Categories of Personal Data We Use
We collect your name, surname, address, contact details, tax code, VAT, service/product you provide us with.
If you are a business contact at our supplier, we collect and use your name, surname, contact details, role.
We may collect the data directly form you through e-mails, fax, phone, in person meetings, or from your organisation or from public domain sources.
3. Why We Use Your Data and Data Retention Period
To establish and manage the business relationship with you or your company
What are the legal conditions for the processing?
The processing is necessary for the performance of the contract or in order to take steps prior to entering into the contract.
How long we hold your personal data for
For the duration of the contract and for the following 6 years. An extra time (of maximum 12 months) necessary to delete the data from our database may be added.
To send direct marketing communications
To send direct marketing communications concerning our services and initiatives through email, text messages, picture messages, video messages, direct messages via social media (electronic mail marketing purposes).
What are the legal conditions for the processing?
If you are a business contact representing your organisation we can contact you on the basis of Our legitimate interest in contacting prospect business clients in order to establish commercial relationships with business clients.
If you are an individual (sole trader, non-limited liability partnership) the legal basis is your consent.
How long we hold your personal data for
If you are a business contact representing your organisation, we will hold your data until you object to the processing.
If you are an individual, we will hold your data for 24 months unless you withdraw your consent before.
To fulfil our obligations under the applicable tax and civil laws
What are the legal conditions for the processing?
Compliance with a legal obligation to which the Controller is subject.
How long we hold your personal data for
For 6 years as of the end of the concerned business year. An extra time (of maximum 12 months) necessary to delete the data from our database may be added.
To establish, exercise or defend our rights in and/or out of court
What are the legal conditions for the processing?
Legitimate interest of the Company to protect and defend its rights.
How long we hold your personal data for
For the time necessary for the establishment, exercise, or defence of legal claims.
After the above-mentioned retention periods have expired, all data stored in our database will be deleted or anonymised.
4. Your Obligations to Provide the Data
The provision of data related to the management of the contractual relationship and to the compliance with legal obligations is mandatory. If you refuse to provide the data, the Company cannot enter in a contractual relationship.
Consent for marketing purposes for individual is optional. If you do not consent to receive our promotional communication you will not be informed about our services, events and other initiatives.
You can always object to the processing of your data for direct marketing.
5. Categories of Data Recipients
The Company is part of a Group of companies. We can share your personal data to other companies within the Group for administrative and organisational purposes, based on our legitimate interest in managing the group’s vendors within the group’s companies.
We can communicate the data to our service providers which carry out some services on our behalf (such as software and hardware providers, website providers, and other IT services providers) as data processors in accordance with a data processing agreement.
We can communicate the data to other public or private bodies whenever we are obliged to do so, in response to orders or requests from a court, regulators, government agencies or public authorities, or to comply with other law or regulatory requirements.
6. Transfer of Data
We are based in UK, and we rely on an IT infrastructure located in the European Union. However, some of our suppliers (IT services) when provide some services can operate outside of the European Economic Area (“EEA”) and Switzerland, such as in the US, and have access to the data from outside the EEA.
In these cases, data is transferred only in the presence of the safeguards indicated in the applicable data protection legislation. In particular, the transfer will take place:
- to destination countries for which the UK Government and the European Commission have issued an adequacy decision (art. 45 GDPR and UK GDPR) or
- on the basis of the International Data Transfer Addendum to the EU Commission Standard contractual clauses (“SCCs”) (art. 46 GDPR and UK GDPR), provided that supplementary security measures are also in place.
For further information about the data transfers, you can contact our DPO at privacy@wexecutive.uk.
7. Rights of Data Subjects
Under the GDPR and the UK GDPR:
You have the right to access your data and to modify or correct your data.
You can obtain the erasure of personal data and the restriction of the processing when certain conditions are met.
You have the right to receive a copy of your personal data in a structured, commonly used and machine-readable format or ask Us to transmit that data to another controller, where technically feasible, if the processing is based on consent or on a contract and is carried out by automated means.
You have the right to withdraw the consent you have given at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
You can always object to the processing of your personal data for direct marketing purposes and, on grounds relating to your particular situation, you can also object to the processing of your personal data based on the legitimate interest of the controller.
If you wish to exercise one of these rights, you can contact our DPO at privacy@wexecutive.uk.
You can lodge a complaint with the data protection authority of your country if you believe that your rights have been breached. For the UK you can contact the Information Commissioner’s Office at https://ico.org.uk.
Declaration
I have read the privacy notice on the processing of my personal data.
Place: _________________________
Date: //________
Name and surname: _________________________
Signature: _________________________
Individual’s Consent for Marketing Purposes
I have read the information on the processing of personal data and, being aware that my consent is optional and that I have the right to withdraw it at any time, as regards the processing of my personal data by W EXECTUIVE UK for marketing purposes as set out in the privacy notice.
- ☐ I consent
- ☐ I refuse
Objection to Marketing Communications for Business Contacts
- ☐ I do not want to receive electronic marketing communications