Information policies on the processing personal data for Customers and Partners

Version 1 | Last update on 03/2025

Pursuant to Articles 13 and 14 of the EU Regulation 2016/679 (hereinafter, the “Regulation”), also known as GDPR, Fabrick S.p.A. (hereinafter, the “Data Controller”) provides you with the following information regarding the characteristics of the processing it carries out on your personal data.

The Data Controller of your personal data is Fabrick S.p.A. with its registered office at Piazza Gaudenzio Sella, n. 1, 13900 Biella (BI), Italy.

The Data Protection Officer (hereinafter, “DPO”) can be contacted at the following details:

• Postal address: Piazza Gaudenzio Sella, n. 1, 13900 Biella (BI) - DPO;
• Email address: privacy@fabrick.com

The processing concerns your personal data, belonging to the categories detailed below, in your capacity as:

a) Customer or Partner (or legal representative of the company or sole proprietor or freelancer), with reference to the following categories of data:

• Personal, contact, and contractual data (e.g., name, surname, tax code, VAT number, residence, ID document, company affiliation details, email address, phone number, PEC, registered office, and administrative office);
• If invoicing is required, data revealing financial information (e.g., payment account details).

b) Employee or business collaborator of the customer or partner, acting as a contact for specific activities (e.g., communication recipient, administrative contact, technical contact), with reference to the following categories of data:

• Personal, contact, and contractual data (such as: name, surname, email address, phone number).

The data mentioned above is personally provided by you to the Data Controller or has been acquired in the context of corporate operations (e.g., mergers, acquisitions).

The processing of your personal data is carried out by the Data Controller for the following purposes:

a) To sign the contract and execute the relationship, as well as ensure everything necessary for its execution (in particular, for contract registration, communication and correspondence management, carrying out the activities provided for in the contract).

The processing referred to in point a) is carried out as it is necessary for the execution of the contract or pre-contractual measures adopted at your request, pursuant to Article 6, paragraph 1, letter b) of the Regulation. Providing the data is necessary, and failure to provide one or more data will make it impossible to establish the relationship.

b) To comply with obligations set forth by law, including, for example but not limited to, accounting, tax obligations, and complaint management.

The processing referred to in point b) is carried out to comply with legal obligations to which the Data Controller is subject, pursuant to Article 6, paragraph 1, letter c) of the Regulation. Providing the data is mandatory, and failure to provide one or more data will prevent the establishment of the relationship as it would prevent the Data Controller from fulfilling legal obligations.

Your personal data may be accessed by authorized personnel of the Data Controller, based on their work responsibilities, or by entities acting as processors – specifically appointed pursuant to Article 28 of the Regulation – or independent data controllers. The categories of recipients involved include:

• Public authorities in cases of legally required communications, supervisory authorities and bodies (e.g., Chamber of Commerce);
• entities handling the audit and certification of the Data Controller’s financial statements;
• companies providing software for customer and supplier registration and invoicing;
• entities supporting customer assistance activities;
• third-party companies supporting the Data Controller in the development and improvement of services;
• companies supplying customer relationship management (CRM) software;
• entities managing debt collection or providing professional consultancy and tax/legal assistance, or investigative activities in case of contractual non-compliance.

To pursue the above-mentioned purposes, the Data Controller may transfer your personal data outside the European Economic Area (e.g., to the United States). Transfers will occur only to third countries recognized by the European Commission as providing an adequate level of protection, or in the presence of adequate safeguards, such as the Standard Contractual Clauses adopted by the European Commission or specific exemptions provided by the Regulation.

The data will be processed for as long as necessary to pursue the purposes for which the data was collected and/or provided. In particular, the data will be processed and retained for the entire duration of the contractual relationship and subsequently retained for 10 years from the termination of the contract in accordance with the applicable legal requirements (e.g., accounting and tax obligations).

After the retention period, personal data will be deleted or kept in a form that does not allow identification, unless the data processing is necessary for one or more of the following purposes:

• Resolution of pre-litigation and/or litigation initiated before the expiration of the retention period;
• Follow-up on investigations/inspections by internal control functions and/or external authorities initiated before the expiration of the retention period;
• Compliance with requests from Italian and/or foreign public authorities received/notified to the Data Controller before the expiration of the retention period.

You are informed that, as a data subject, you can exercise the following rights regarding the processing of your personal data:

To exercise the above rights, you can submit a request to the following contact details:

• Postal address: Piazza Gaudenzio Sella, n. 1, 13900 Biella (BI) - DPO;
• Email address: privacy@fabrick.com

The Data Controller will provide information about the actions taken regarding your request without undue delay, and at the latest, within one month of receipt.

In any case, you can contact the Data Controller and/or DPO at the aforementioned contact details for further information or clarification regarding the processing of your personal data.