1. Introduction
We wish to inform you that European Regulation 679/2016 (hereinafter, for simplicity, the "Regulation"), concerning the protection of natural persons with regard to the processing of personal data, provides for the protection of the personal data of natural persons.
Pursuant to the aforementioned legislation, the processing of personal data covered by this notice, carried out by Circularity S.r.l. Società Benefit (the "Data Controller"), shall be based on the principles of fairness, lawfulness, transparency, relevance, non-excessiveness with respect to the purposes for which such data is collected, and the protection of your confidentiality and your rights.
2. Data controller
The Data Controller of personal data relating to:
- Individuals representing Customers or prospective Customers of Circularity;
- Individuals representing Suppliers or prospective Suppliers of Circularity;
- Third Parties (Directors, Statutory Auditors, Shareholders, members of the Supervisory Body, etc.),
is CIRCULARITY S.R.L. Società Benefit, with registered office in Milan, Via G. Bensi 12/5, 20152 (MI) – Tel.: +39 02.49406445 – e-mail: circularity@legalmail.it.
Personal data is collected directly from the data subject (in the context of past or present, direct or indirect contractual relationships, or during meetings with representatives of Circularity S.r.l.), or provided by Customers, Suppliers, Third Parties, or by Third-Party companies that acquired such personal data directly from the data subjects on the basis of explicit consent to the processing of personal data for marketing purposes.
Regardless of the origin of the collection of personal data, pursuant to Articles 13 and 14 of EU Regulation 679/2016, we provide you with the following information.
3. Purposes of the Processing
The personal data collected will be processed, depending on the case, in order to fulfil contractual and/or legal obligations, for the following purposes:
- a) Corporate management (legal obligations relating to the management of litigation, insolvency proceedings, related-party management, etc.);
- b) Providing information and/or sending communications relating to products and/or services to be purchased or collaborations to be established, both at the pre-contractual stage (e.g., for the preparation of a commercial offer for a Customer or a request for quotation to a Supplier) and subsequently during the performance of the contract entered into between the parties;
- c) Carrying out all accounting and tax obligations relating to the contractual relationship that may be established with the Customer or Supplier;
- d) Managing registration for webinars and other events organised by Circularity, including the communications necessary to provide information for accessing the event, logistical information, and the sending of materials presented at the event. The personal data of webinar or event registrants may be shared with partner companies of the initiative only with the prior consent of the data subject.
or on the basis of the Data Controller's legitimate interest, for:
- e) Assessing the quality of supplies and related services;
- f) Conducting market surveys and research, including for the purpose of assessing Customer satisfaction, carried out via the institutional website or other tools (software applications or by telephone);
- g) Protection of credit and defence in legal proceedings in the event of litigation;
- h) Sending communications for promotional or marketing purposes regarding products and services provided by Circularity, to contacts collected directly by Circularity or provided by Third-Party companies. In this case, if commercial and/or promotional communications are not sent to existing Customers regarding products or services similar to those already purchased, processing takes place subject to the data subject's prior consent.
E-mail messages sent to newsletter subscribers may contain "tracking pixels", i.e. an html instruction embedded in the body of the e-mail that calls up an image (usually transparent) hosted on a remote server. Consent given to receiving the newsletter containing promotional information implies acceptance of the tracking of the user's behaviour should they click on such images. Withdrawal of consent to such processing implies unsubscribing from the newsletter.
Other processing of personal data carried out by the Data Controller may be subject to specific notices.
4. Categories of personal data
The personal data processed will be strictly limited to that necessary to carry out the activities described above and will not include data belonging to special categories of data (Art. 9 of the Regulation), nor judicial data relating to criminal convictions or offences (Art. 10 of the Regulation).
5. Methods of processing
Processing will be carried out manually or, predominantly, with the aid of electronic means, and includes, in compliance with the limits and conditions set out in Articles 2, 3 and 4 of EU Regulation 679/2016, all operations, or set of operations, referred to by the Regulation as "processing", with the exception of dissemination.
The methods of processing personal data are described in the procedural documentation prepared by the Data Controller. These provide for the adoption of adequate security measures to protect the confidentiality, integrity and availability of data stored on digital or paper media. Such measures have been assessed as adequate following an analysis of all the risks — assessed considering the relevant probability of occurrence and severity of consequences — affecting the personal data processed and the rights and freedoms of natural persons.
Personal data will be retained for the period necessary to fulfil the purposes indicated above, in particular:
- to fulfil all legal obligations and contractual commitments, for a maximum of ten years from the year of the last accounting entry and from the termination of any contractual relationship;
- for marketing purposes, until any withdrawal of consent or request for erasure/restriction of processing by the data subject.
6. Obligation to provide personal data
The provision of data is:
- mandatory for the processing referred to in points a), b), c) above (limited to the personal data strictly necessary to pursue the related purposes); in such case, any refusal to provide such data may result in the failure or partial performance of the contract entered into between the parties and/or the impossibility of continuing the business relationship;
- optional for the processing referred to in points d), e), f) and g) above; in such case, any refusal to provide such data, or a subsequent request for erasure or restriction of processing for data processed on the basis of the Data Controller's legitimate interest, or the withdrawal of consent given (for the processing referred to in point h) has no effect on compliance with contractual requirements, but merely results in the impossibility of receiving information on new products and services offered by the Data Controller.
7. Disclosure of personal data to third parties
In general, data will not be disclosed to parties other than the Data Controller. Where a contractual relationship exists, the data necessary to fulfil legal obligations and manage the contractual or pre-contractual relationship may be disclosed to tax and/or legal advisors, public authorities, banks and insurance companies, IT service providers for the management and maintenance of information systems, or to the Judicial Authority, solely for purposes related to the management of the contractual relationship and to comply with legal requirements.
Personal data provided directly by the data subject or by Third-Party companies for marketing purposes may also be processed by Communication Agencies for the performance of related digital marketing activities.
The personal data collected will in no case be subject to dissemination and will not be subject to profiling (cf. Art. 4(4) of the Regulation).
Personal data will not be transferred outside the European Union.
8. Rights of data subjects
At any time, you may exercise your rights against the Data Controller, pursuant to Articles:
- 15 ("Right of access by the data subject"): the data subject has the right to know which of their personal data is being processed;
- 16 ("Right to rectification"): the data subject has the right to request a correction of their personal data;
- 17 ("Right to erasure"): the data subject has the right to request the erasure of their personal data, unless legal obligations prevent such erasure, including the right to withdraw consent to the processing of personal data that required it;
- 18 ("Right to restriction of processing"): the data subject has the right to request the restriction of processing within the limits established by the Regulation;
- 21 ("Right to object to processing"): the data subject may object to processing carried out on the basis of legitimate interest and, after withdrawing consent, to processing based on explicit consent;
of EU Regulation 679/2016 — available at www.garanteprivacy.it or from the Data Controller — by addressing the request to the Data Controller's contact details indicated above, for the purpose of exercising the above rights.
In the same manner, you may withdraw your consent to the processing of data concerning you.
It is also possible to lodge a complaint regarding the processing of personal data carried out by the Company with the National Supervisory Authority, i.e. the Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).
9. Notice on data processed on the website
On this website, personal data voluntarily provided by the user through this website (requests for information, etc.) may be processed and will be used exclusively to send e-mail communications relating to topics connected with the business activity carried out, and will not be disseminated.
With regard to the methods of processing, disclosure of personal data and the rights of the data subject, please refer to the general notice set out above.
With regard to other data processed by this website, such as browsing data, cookies and other similar technologies, please see the dedicated Cookie Policy.
Date of last update of this notice: 01/09/2026
The Data Controller is not responsible for keeping all links displayed in this Notice up to date; therefore, whenever a link is not working and/or is out of date, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by that link.