Privacy notice for third parties

ILIOS S.r.l. (hereinafter also “ILIOS” or the “Company”) is the Controller of the Processing and processes the personal data of its Partners, Clients and Suppliers/Consultants (“Third Parties”) – hereinafter also “Data Subjects” – in compliance with the Data Subject’s rights, lawfully, transparently and fairly, in accordance with EU Regulation 2016/679 (“GDPR”).

1. Legal basis (Art. 6 GDPR), purposes and nature of the processing

(why we process your data)

The Data Subject is informed that ILIOS will process their personal data, depending on the category, for the following purposes:

1. Management of contractual and pre-contractual relationships:
   • preliminary assessment and management of relationships with suppliers (professionals, technical, legal and IT consultants, experts, etc.);
   • management of relationships with industrial partners (e.g. investment funds, utilities, co-developers);
   • management of relationships with clients (landowners, parties interested in buying or co-developing projects, etc.);
   • exchanges of information and contacts needed to develop or manage projects;
   • administrative activities, such as drafting contracts, operational communications, order management, collections and payments.
2. Compliance with legal obligations (civil, tax, administrative and accounting) or arising from requests by the judicial Authority or the Public Administration.
   • Legal basis: providing the data for the purposes under points (1) and (2) is a requirement for entering into the contract (Art. 6(1)(b) GDPR) and a legal obligation (Art. 6(1)(c) GDPR).
   • Nature of the Processing: mandatory: refusal to provide the data makes it impossible for ILIOS to carry out the activities required to enter into and perform the contract, and would breach the legal provisions imposing an obligation on the Controller.
3. Integrity checks (through databases and related online search engines), carried out in accordance with internal policies and 231 compliance safeguards.
   • Legal basis: legitimate interest of the Controller (Art. 6(1)(b) GDPR), under the policies of the Organisation and Control Model pursuant to Legislative Decree 231/01.
   • Nature: the processing is carried out only to the extent strictly necessary to assess the integrity, professionalism and reputation of the person in relation to the nature of the assignment or project. Checks are carried out by consulting publicly accessible sources and information provided directly by the Data Subject.
4. Management of disputes and protection of the Company’s rights (establishment, exercise or defence of a right in or out of court).
   • Legal basis: legitimate interest of the Controller (Art. 6(1)(b) GDPR).
   • Nature: necessary for the Controller’s legal protection, activated only in the event of a dispute.

2. Types of data processed

COMMON DATA:

• personal, identification and contact details (e.g. email, tax code, phone number, first and last name, place and date of birth, etc.);
• payment data (IBAN, billing details);
• other common data (including non-personal data that may nevertheless allow, even indirectly, the identification of a natural person) such as:
  • company data (e.g. company register extracts, powers of attorney, signing powers);
  • other data needed to carry out the relationship (land registry data provided by owners, technical documents shared with partners, etc.).
• contractual data (for consultants):
  • CV data (curriculum, career, certifications, training);

JUDICIAL DATA (information on convictions, legal proceedings or criminally relevant facts, obtained from publicly accessible sources).

3. Retention period and methods

Your data will be processed for the duration of the contract and in compliance with the retention obligations laid down by law (Art. 2220 of the Italian Civil Code) for civil and tax purposes and, in any case, always for the shortest possible time for each purpose, in line with the principle of privacy by default; specifically, 10 years from the date the relationship ends.

All data are processed by electronic means and stored in cloud archives provided by third parties located within the European Union or, in the case of paper documents, kept in dedicated files accessible only to specifically authorised persons.

4. Communication and disclosure of data

ILIOS undertakes not to transfer the personal data provided by the Data Subject to anyone. However, they may be communicated to third parties in order to comply with legal or contractual obligations, to the extent necessary for the Company’s activities, in particular to:

• parties acting as Processors under Art. 28 GDPR (e.g. IT service providers, service providers, legal, tax and administrative advisers);
• parties acting as independent Controllers (e.g. banks, financial intermediaries, etc.), including public and supervisory Authorities, where required by law or by sector regulations.

5. Data subject’s rights

The Data Subject has all the rights set out in Articles 15 et seq. of the GDPR. In particular, they have the right to obtain access, rectification, erasure and portability of their data, as well as the right to restrict Processing, the right to withdraw consent (without affecting the lawfulness of Processing carried out before withdrawal), the right to object to Processing and the right to lodge a complaint with a supervisory authority.

These rights may be exercised by the Data Subject by sending a request to the Controller. The request may be sent by registered letter with return receipt to the registered office address given at the end of this notice (writing “Privacy Request” on the envelope), or by email to: info@iliositalia.com

The Controller will reply to the request without undue delay.

Data Controller

The Data Controller is ILIOS srl.
Registered office: Via Monte Napoleone 8, 20121, Milan (MI), Italy
Tel: (+39) 080 893 5086