Information notice for suppliers

INFORMATION NOTICE pursuant to Article 13, Regulation (EU) 2016/679 (“GDPR”)


UMBRAGROUP S.p.A., with registered office in Via V. Baldaccini, 1 - Z.I. Loc. Paciana, Foligno (PG), in person of its legal representative pro tempore ANTONELLO MARCUCCI, is the Data Controller of your personal data (“Data Controller” or “UMBRA”).


Under the GDPR, personal data is defined as: “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (“Data”).

Within the selection process and in order to manage the following contractual relationship that might be established with you, UMBRA processes the following Data:

- first name, surname;

- tax code and/or VAT number;

- address and/or registered office;

- contact details, such as telephone number and e-mail;

- bank account details (i.e. IBAN).

The provision of your Data is voluntary; however, it is necessary to allow the establishment and the performance of the contractual relationship, as well as to allow UMBRA to provide you with services in your favor (such as to carry out the payment of your fees for the services you provide), and to fulfil legal obligations. Should you refuse to provide your personal data, it would not be possible for the Data Controller to establish and perform the contractual relationship.

In any event, the Data Controller is committed to ensure that the information collected and processed is appropriate for the purposes as set forth under the following paragraph, and that this does not involve an invasion of your privacy.

The legal basis of the processing of your Data is the performance of the contract entered into between you and UMBRA.


a.  To perform the contract

Your Data will be processed by UMBRA for the establishment and the performance of the contractual relationship. By way of example, your Data shall be processed during the selection process and for the administrative management of the contract (e.g.: your Data will be processed for administrative purposes during the stage of selection and during the performance of the business relationship.)

b.  To comply with a legal obligation

Your Data will be processed by UMBRA to fulfill legal obligations, such as tax obligations related to the performance of the contract.


UMBRA may disclose some of your Data to third parties which provide the Data Controller with services related to the management of the contractual relationship.

In particular, for the purposes set forth under paragraph 3 above, as an integral part of the processing activities, your Data might be disclosed to organizations which provide UMBRA with administrative services, as well as to external consultants; said third parties shall process your Data as Data Processors.

The list of Data Processors is kept up-to-date by the Purchasing Manager who makes it available for consultation.

The Data Controller may also disclose your Data to third parties to which said disclosure is provided for as a legal obligation, as well as to public authorities, other legal entities members of the Group, either subsidiaries or affiliates, established in the EU, and to banking institutions that UMBRA uses to make payments.

Your Data shall not be subject to any kind of dissemination to unidentified subjects.


UMBRA will process your Data for the entire duration of the contractual relationship and will store it for further 11 years starting from the termination of the contract, for the sole purpose of being compliant with legal obligations or for the defense of UMBRA’s rights in court.


At any time, while we are in possession of or processing your Data, you, the data subject, have the following rights:

  • Right of access – you have the right to obtain confirmation as to whether or not your personal data is being processed, and, where that is the case, the right to access to the personal data and to receive any information regarding said processing;
  • Right of rectification – you have the right to obtain without undue delay the rectification of your personal data, should it be inaccurate or incomplete;
  • Right to erasure – in certain circumstances, you have the right to obtain the erasure of your personal data from our records;
  • Right to restriction on processing – where certain conditions apply, you have the right to obtain from the Data Controller restriction of processing;
  • Right of portability – you have the right to have your personal data we hold transmitted to another data controller;
  • Right to object – you have the right to object to the processing;
  • Right to lodge a complaint before the Supervisory authority - should UMBRA refuse to follow up to your request to exercise your rights as provided for by the GDPR, UMBRA shall provide you with the reason underpinning said refusal. If need be, you have the right to lodge a complaint as set forth under paragraph 7 below.

Should you intend to exercise your rights as provided for by the GDPR, please contact UMBRA at the following dedicated e-mail address


Should you wish to file a motion as to how your Data is being processed by UMBRA, or as to how your complaint has been handled, you have the right to lodge a complaint directly before the Supervisory authority.