PRIVACY NOTICE FOR CUSTOMERS AND SUPPLIERS

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Dear Customer, Dear Supplier,

VEGA S.r.l. designs and manufactures machines for the paper converting and packaging industry and works exclusively with businesses, in Italy and abroad. In managing our business relationships we process personal data of the individuals who act on behalf of your company (owners, legal representatives, contact persons, technicians, administrative staff) and, if you are a sole trader or a self-employed professional, your own data. This notice explains which data we process, why, on what legal basis, for how long, and what your rights are.

1. Data controller

VEGA S.r.l., VAT no. IT00814680153

• Registered office: Via Visconti di Modrone 7 – 20122 Milan, Italy
• Operational headquarters: Viale dell’Industria 6 – 20037 Paderno Dugnano (MI), Italy
• Privacy contact: Mr Marco Giovannini, Board member with responsibility for data protection
• Contacts: certified e-mail (PEC) vegagroup@pec.it – e-mail info@vegagroup.it – tel. +39 02 99046212

The company has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.

2. Data we process and where it comes from

• identification and contact details: name and surname, role and position in the company, telephone number, e-mail address;
• for sole traders and professionals: tax code, VAT number, address, bank details;
• data contained in quotations, contracts, orders, delivery notes, invoices and payments;
• data relating to technical assistance, installation and acceptance testing (names of the contact persons present, service reports);
• data of carriers and drivers handling collections and deliveries.

The data is provided by you or by the company you work for during negotiations and throughout the relationship. It may also come from public sources (company registers, corporate websites) or from contacts made at trade fairs and industry events. We do not process special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences.

3. Purposes and legal bases

a) Management of the business relationship: enquiries and quotations, negotiations, contracts and orders, deliveries, installation, acceptance testing, technical assistance, spare parts and warranty; management of purchases and of relationships with suppliers.

Legal basis: performance of a contract or pre-contractual measures (Article 6.1.b GDPR); for contact persons acting on behalf of a company, Vega’s legitimate interest in managing the relationship with that company (Article 6.1.f).

b) Administrative, accounting and tax obligations: invoicing, payments, bookkeeping, customs and other legal obligations.

Legal basis: legal obligations (Article 6.1.c).

c) Security of IT systems and premises: protection of e-mail and company systems; video surveillance of the premises to protect company assets, indicated by appropriate signs.

Legal basis: legitimate interest in security (Article 6.1.f).

d) Protection of Vega’s rights: debt collection, handling of complaints and disputes.

Legal basis: legitimate interest (Article 6.1.f).

e) Newsletter and promotional communications: Vega sends newsletters and promotional communications only to those who have given their consent, collected separately as described in the privacy notice of the website www.vegagroup.it, and which may be withdrawn at any time using the link included in every communication.

Legal basis: consent (Article 6.1.a).

Providing the data for purposes a) and b) is necessary: without it the relationship cannot be established or continued. Vega does not carry out profiling and does not take decisions based solely on automated processing.

4. How we process the data

The data is processed on paper and electronically, with appropriate security measures, exclusively by authorised and trained staff of the sales, administration, service, purchasing and warehouse departments, and only to the extent necessary for their duties.

5. Who may receive the data

The data may be disclosed, only for the purposes stated above, to:

• tax and accounting advisors, banks and insurance companies;
• couriers, freight forwarders and customs agents;
• providers of IT services, management software, e-mail and backup services, acting as data processors appointed by Vega (Article 28 GDPR);
• Vega’s agents, distributors and technical partners, when involved in the supply or in technical assistance;
• public authorities, tax authorities and judicial authorities, where required by law;
• lawyers and consultants, to protect Vega’s rights.

The data is not disseminated. The up-to-date list of data processors is available on request at the contacts in section 1.

6. Transfers outside the European Union

Company e-mail is managed on Microsoft 365: the provider may also process data in the United States, on the basis of the EU-US Data Privacy Framework or of the standard contractual clauses approved by the European Commission.

If you or the company you work for are based outside the European Union, the data needed for the relationship is exchanged with you and with the parties involved in the supply (for example freight forwarders) as necessary for the performance of the contract (Article 49.1.b GDPR).

7. How long we keep the data

• contractual, administrative and accounting data: for the duration of the relationship and for 10 years after it ends, unless longer periods are required by law or the data is needed to protect Vega’s rights in a dispute;
• enquiries and quotations not followed by a contract: up to 24 months;
• video surveillance images: 48 hours, except in specific circumstances (complaint to the police, request from the authorities);
• newsletter data: until consent is withdrawn and in any case no longer than 2 years after the last activity.

When these periods expire, the data is deleted or anonymised.

8. Your rights

At any time you may request:

• access to your data and a copy of it (Article 15);
• rectification of inaccurate data or completion of incomplete data (Article 16);
• erasure of your data, where applicable (Article 17);
• restriction of processing (Article 18);
• portability of the data you have provided, processed on the basis of a contract or consent (Article 20);
• you may object to processing based on legitimate interest and, in any case, to receiving promotional communications (Article 21);
• you may withdraw any consent given, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, write to the contacts in section 1. We will reply within one month; this period may be extended by up to two further months for complex requests.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

9. Updates

This notice may be updated; the version in force is published on the website www.vegagroup.it. In case of discrepancies, the Italian version prevails.

Last updated: 12 November 2026 – VEGA S.r.l.