Information for clients and suppliers

Pursuant to art. 13 of regulation (EU) 2016/679

Our Company processes your personal data for the execution of the contract and/or the mandatory relationship with you and for purposes exclusively related to it, in compliance with Regulation (EU) 2016/679 (hereinafter referred to as “GDPR”) and the other applicable legislation on the protection of personal data. This information describes how we collect, use and communicate your personal data and how we carry out the related processing to ensure their security and confidentiality. For any clarification concerning the processing of your personal data, you can contact us by sending an email to This email address is being protected from spambots. You need JavaScript enabled to view it.


1. Who is responsible for processing your personal data?

The Data Controller of personal data is ITS Controlli Tecnici S.p.A. (hereinafter "ITS")
Registered & Operating Office: Via di Torre Rossa 66 – 00165 Rome
Phone: +39 06881791
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Certified email: This email address is being protected from spambots. You need JavaScript enabled to view it.

2. For what purposes are your personal data processed?
We process your personal data (including the personal data of your employees and collaborators), obtained directly from you or from third parties on your behalf, or acquired from private or public archives in carrying out ITS’s economic and commercial activity or that ITS will be obtain during the execution of this relationship, directly and/or through third parties, for the following purposes:

  • Management of clients, suppliers and commercial partners;
  • Execution of obligations resulting from pre-contractual and contractual agreements, as well as from tax, accounting and regulatory agreements;
  • Economic and administrative management and execution of the contract or the mandatory relationship with you;
  • Participation in public and private tenders and/or private negotiations (for ex. establishment of ATI, RTI);
  • Litigation management.

3. On what legal basis are your personal data processed?
We process your personal data mainly to perform the obligations arising from the contract and/or from the mandatory relationship with you, to implement pre-contractual measures to be taken at your request, as well as to fulfil a legal obligation (art. 6, para 1 b-c of GDPR). We also process your personal for legitimate interests pursued by ITS aimed at managing, protecting and improving our services (art. 6, para 1, f of GDPR).

4. What type of data do we process?
As part of the management of the contractual/mandatory relationship with you, we may collect the following categories of data:

  • Identification data: we will use the data provided including the personal data of your employees and collaborators, (such as name, surname, address, tax code, details of contract contact persons, etc.), for the establishment and/or execution of the contractual/mandatory relationship with you. For these purposes, we may also use your company data, the data acquired from private and/or public archives (i.e. from the Chamber of Commerce) and possibly your bank details.
  • Judicial data: when participating in public and private tenders and/or private negotiations, in order to comply with anti-mafia legal requirements, we may also process data relating to criminal convictions or crimes and related security measures, according to the definition referred to in art. 10 of GDPR (such as, for example, the data relating to registrations in the national criminal records and pending charges).

5. Is the provision of your personal data mandatory?
The provision of your personal data is mandatory for the establishment and execution of the contract or mandatory relationship with you. Failure to provide such data will make it impossible for ITS to execute the relationship and/or fulfill the obligations legally and/or contractually entered into towards you.

6. For how long do we store your personal data?
The data will be kept for the entire duration of the pre-contractual and contractual relations established and after their termination, only for the time necessary to guarantee the completion of all legal obligations, however not less than 10 years from the last registration (art. 2220 of the Civil Code). Failure to provide such data will make it impossible for ITS to execute the relationship and/or fulfill the obligations legally and/or contractually entered into towards you.

7. To whom can your personal data be communicated?
We can communicate your personal data to the following categories of subjects:

  • Individuals and/or public and private bodies to whom the data will be communicated in order to demand or fulfil specific obligations provided for by laws, regulations or EU legislation;
  • Accreditation and Certification Bodies (for ex. Accredia), public and private bodies for participation in tenders and/or private negotiations and/or to comply with specific legislative, regulatory, national and EU provisions;
  • Freelancers or professional firms charged with defending ITS in litigation and/or administrative proceedings resulting from the aforementioned relationships;
  • Companies that provide, on behalf of ITS, IT support and IT maintenance services, supply of hardware and software products and cloud services providers,
  • Professional firms and companies that carry out activities in the field of administration and accounting, accounting audit and certification of the financial accounts;
  • Banks or other credit institutions used for the execution of payments;
  • Public security authorities;
  • Judicial authority.

8. To whom can your personal data be transferred abroad?
Your personal data may be transferred abroad, both within the European Union and in third countries, for the purposes of the execution of the contract or the obligatory relationship with you or the pre-contractual measures adopted at your request, as well as the fulfilment of obligations imposed by applicable laws.
This transfer will take place in accordance with article 44 et seq. of GDPR. In particular the transfer may take place on the basis of an adequacy decision adopted by the European Commission which can prove that the recipient country offers an adequate level of security for the protection of personal data (art. 45 of GDPR). Instead, for transfers to third countries for which there is no decision of the European Commission, ITS undertakes to guarantee an adequate level of protection of personal data, providing for “adequate guarantees” in compliance with art. 46 of GDPR.

9. What are your rights regarding the processing of personal data?
At any time, you can have full clarity on the operations we have reported to you and exercise the rights recognised by art. 15 et seq. of GDPR. You may exercise, at any time, in the manner and within the limits covered by the aforementioned regulations: