Privacy notice on the processing of personal data for supplier

The data controller is the company belonging to Satispay Group with which you have a contractual relationship (depending on the contracts, Satispay Europe S.A., Satispay Invest S.A., SatisWelfare S.p.A., Momentum S.p.A., Satispay International S.à.r.l., jointly the “Controller” or “Satispay”). In all cases, regardless of which company is the data controller, this privacy policy shall apply.

Satispay r has appointed a data protection officer (“DPO”) who may help with any questions about the data processing we carry out and/or how to exercise your rights. You can reach our DPO at dpo@satispay.com.

Personal data is collected through the contract and, more generally, any related documentation and/or communications exchanged with Satispay, either electronically (e.g. by telephone or e-mail) or in writing. The data collected are limited to those strictly necessary for the management and performance of the contractual relationship.

In particular, the data processed includes (together, the “Data”):
1. identification data (such as first name, last name, company name, address, VAT number, Tax number);
2. contact details (such as e-mail address, PEC and phone number);
3. fiscal data (such as information related to invoicing, payment, collection e.g. IBAN code, related to fulfilment of legal obligations and for the provision of goods and services)s;
4. data relating to the Legal Representative of the supplier legal entity and/or contact persons interacting with Satispay.

The Data will be processed for the following purposes:
* to perform and manage the contract entered into with Satispay. Legal basis: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6.1, lett. b), GDPR);
* to comply with tax and/or accounting obligations applicable to Satispay related to the contractual relationship and, more generally, with obligations provided for by applicable laws and regulations, as well as for provisions issued by public authorities and/or by supervisory and control bodies. Legal basis: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (art. 6.1, lett. b), GDPR), as well as to comply with legal obligations to which Satispay is subject (art. 6.1, lett. c), GDPR).

The provision of the Data of the contract signatory for the above purposes is mandatory and necessary. Any refusal, in whole or in part, to provide such Data will make it impossible for the Controller to establish or perform the relevant contractual relationship.

The Data may be disclosed to third parties only where necessary to perform the activities described above.
Such third-party recipients, acting either as independent data controllers or as data processors, fall within the following categories:
* IT service providers and software infrastructure providers appointed by Satispay;
* our staff, including Satispay group’s staff (who provides intercompany services);
* professional advisors and service providers who provide assistance or consultancy services to or on behalf of Satispay, in particular accounting and legal services;
* where requested, regulatory authorities, competent courts, law enforcement agencies (including the police).

The Data will be processed only for the time necessary to achieve the purposes for which they were collected. In particular, for the purposes indicated above, the Data will be retained for the entire duration of the contractual relationship and, upon termination for any reason, for the statutory limitation period provided by applicable law.

The Data is stored on servers located in the European Union. If needed for specific purposes, the Data is also transferred to companies located outside the European Union. In this case, Satispay ensures that the Data is processed safely and that it has entered into agreements that guarantee an adequate level of protection and/or include the standard contractual clauses provided by the European Commission.

You have the right, at any time, to request and obtain:
* access to your Data (Art. 15 GDPR);
* rectification and/or updating of your Data (Art. 16 GDPR);
* erasure of your Data or, where applicable, restriction of processing (Art. 17 and 18 GDPR);
* data portability (to receive your Data in a structured, commonly used, and machine-readable format (Art. 20 GDPR);
* object at any time, for reasons related to a particular situation, to the processing of personal data concerning you (Art. 21 GDPR).

You also have the right to lodge a complaint with the competent data protection authority. However, we encourage reaching out to us first to resolve any issues amicably and promptly.
These rights may be exercised at any time by sending a request to Satispay via email at procurement@satispay.com or dpo@satispay.com.
For any further information or clarification regarding the above rights, you may contact the Controller using the same contact details.