Privacy notice on the processing of personal data for suppliers, consultants, and clients
The Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”) provides for the protection of natural persons with regard to the processing of personal data.
In compliance with this legislation, the processing of your personal data will be based on the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity, confidentiality and storage limitation, in accordance with the fundamental rights and freedoms of the data subject.
The Consorzio Interuniversitario Risonanze Magnetiche di Metallo Proteine (CIRMMP) (hereinafter the “Controller”), with registered office in Florence, Piazza San Marco 4, and operational office in Sesto Fiorentino, Via L. Sacconi 6, as Data Controller, hereby informs its Employees, Collaborators and Fellows about the manner in which their personal data will be processed.
1. Purpose of Processing and Legal Bases
Personal data is processed for the following purposes:
- management of requests for information and quotations, the pre-contractual phase and the contractual relationship;
- administrative, accounting and tax management of the relationship;
- compliance with obligations under applicable law;
- protection of the Controller's rights in judicial or extrajudicial proceedings.
The legal bases for the processing are: performance of a contract or of pre-contractual measures (Article 6(1)(b) GDPR); compliance with a legal obligation (Article 6(1)(c) GDPR); pursuit of the Controller's legitimate interest in protecting its own rights (Article 6(1)(f) GDPR).
2. Manner of Processing and Voluntary Nature
Processing is carried out using electronic and paper-based tools, protected by appropriate security measures. Provision of the data is a necessary requirement for the conclusion and performance of the contractual relationship, as well as for compliance with legal obligations. Any refusal to provide the data will make it impossible to establish or continue the contractual relationship, or to provide or receive the requested services.
3. Recipients and Data Transfers Abroad
The data is not subject to dissemination (i.e., disclosure to an indeterminate number of parties). The data may be disclosed exclusively to:
- Internal Consortium personnel expressly authorised to process the data.
- Banking institutions for the payment of fees or other amounts due.
- Professionals, consultants and companies providing administrative, accounting, tax, legal or IT services to the Consortium, appointed as Data Processors where required under Article 28 of the GDPR.
- Public authorities and social security/welfare bodies, in compliance with specific legal obligations.
Personal data is stored on servers located within the European Union. No transfer of data outside the European Economic Area (EEA) is envisaged. Should a transfer to third countries become necessary, it will be carried out in compliance with Articles 44 et seq. of the GDPR.
4. Retention Period
The data will be retained for the entire duration of the relationship with the Consortium and, thereafter, for the period required by legal obligations of a tax, civil-law, social security and welfare nature (ordinarily 10 years from termination of the relationship), without prejudice to any longer retention periods provided for under applicable law, as well as for the time necessary to protect the Controller's rights.
5. Rights of the Data Subject
The data subject may exercise the rights provided for under Articles 15–22 et seq. of the GDPR (access, rectification, erasure, restriction of processing, objection and, where applicable, data portability) by sending a request to
The data subject also has the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 of the GDPR.