Privacy Notice for Customers, Suppliers and Business Contacts. This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to individuals whose personal data are processed by ComPart Multimedia S.r.l. in the context of professional, commercial, contractual and administrative relationships with customers, prospective customers, suppliers, consultants and other third parties.
This notice also applies to such relationships when communications take place outside the website, for example by email, telephone, meetings, quotations or contracts. For website browsing and the contact form, please refer to the Website Privacy Policy.
1. Data Controller
ComPart Multimedia S.r.l.
Via delle Cave, 105 – 00181 Rome, Italy
Italian Tax Code and VAT No. 05327951009
For enquiries about personal data protection or to exercise your rights under the GDPR, you can use the contact form, stating that your enquiry concerns privacy, or write to the postal address above.
2. Data Subjects and Categories of Personal Data
Processing concerns individual customers and suppliers, professionals and sole proprietors, as well as legal representatives, sales, administrative or technical contacts, employees and collaborators of companies and organisations with which ComPart maintains or is considering professional relationships.
Depending on the relationship, the following information may be processed: first name, surname, company or organisation, role or position, business contact details, correspondence, appointments, enquiries, quotations, proposals, orders, contracts and project-related documentation. Where relevant, tax, invoicing and payment details, including bank account details relating to individuals, may also be processed.
The routine collection of special categories of personal data under Article 9 GDPR or personal data relating to criminal convictions and offences under Article 10 GDPR is not envisaged for these purposes.
3. Purposes and Legal Bases
- Managing contacts and professional relationships: receiving and responding to enquiries, preparing quotations and proposals, negotiating agreements, coordinating activities and maintaining relevant records of relationships with contacts at companies and organisations. Legal basis: the Controller's legitimate interest (Article 6(1)(f) GDPR) in managing and documenting professional relationships, with due regard for data subjects' rights.
- Contracts with individuals: taking pre-contractual steps requested by the data subject and entering into or performing contracts with professionals, sole proprietors or other individuals acting as contracting parties. Legal basis: Article 6(1)(b) GDPR.
- Managing suppliers, consultants and engagements: assessing proposals, placing orders and managing the performance of business relationships, communications and business contacts. Legal bases: Article 6(1)(b) GDPR where the contracting party is an individual; Article 6(1)(f) GDPR for contacts at organisations.
- Administrative, accounting and tax obligations: issuing and receiving invoices, recording transactions, managing receipts and payments, documenting statutory obligations and protecting rights arising from the relevant relationships. Legal bases: compliance with a legal obligation (Article 6(1)(c) GDPR); where relevant, performance of a contract (point (b)) and legitimate interest in protecting claims and rights (point (f)).
In our current operations, these data are not used for unsolicited promotional campaigns, newsletters, profiling or decisions based solely on automated processing.
4. Sources of Personal Data
Personal data are normally provided directly by the data subject during communications, meetings, enquiries or contractual dealings. They may also be provided by the company or organisation to which the data subject belongs, by another contact involved in the relationship, or obtained from professional and contractual documents exchanged between the parties. Where data are not obtained directly from the data subject, the information is provided under the conditions and within the time limits established by Article 14 GDPR. Data subjects may request information about the source of their personal data.
5. Provision of Personal Data
Providing contact details is generally optional, but certain data are necessary to respond to enquiries or to establish and manage a contractual relationship. Tax and accounting data required by law are necessary to fulfil the relevant obligations. Failure to provide essential data may prevent us from handling an enquiry or managing the relationship.
6. Recipients and Services Used
Personal data may be accessed by authorised internal personnel only to the extent necessary for their duties. Where necessary, data may be disclosed to accounting and tax advisers, appointed professionals, banks, public bodies and competent authorities, as well as to providers of technology services actually used to manage communications, documents and business relationships.
The technical services used include email and hosting provided by A2 Hosting LLC / hosting.com, as well as, where relevant, contact storage and synchronisation tools and certified email services. These parties process personal data according to their respective data protection roles and the applicable agreements. Personal data are not sold or disclosed publicly for advertising purposes.
7. Transfers Outside the European Economic Area
Some technology services may involve processing or transfers of personal data outside the European Economic Area (EEA). In such cases, the safeguards provided for in Chapter V of the GDPR apply, depending on the provider and service concerned: European Commission adequacy decisions, including the EU–U.S. Data Privacy Framework where applicable to the recipient, or Standard Contractual Clauses or other safeguards provided for by law. You may request information from the Controller about the safeguards relevant to your relationship.
8. Data Retention
- Simple information requests or contacts that do not lead to a significant business relationship: for up to five years from the last exchange, where there is a reasonable need to retain a record of the correspondence.
- Business relationships with customers and prospective customers: commercial documentation, quotations, proposals, contracts, correspondence and contact details may be retained for up to ten years from the last significant business interaction, identified as the latest enquiry, offer, project or other substantive interaction.
- Relationships with suppliers, consultants and professionals: contact details and correspondence are retained for the duration of the relationship and thereafter for as long as reasonably necessary to maintain professional relationships or protect legal rights; data that are no longer necessary are deleted or updated.
- Accounting and tax documentation: generally retained for ten years from the last accounting entry or for any different period required by applicable law, without prejudice to inspections, disputes or further obligations.
Once the applicable retention period has expired, personal data are deleted or anonymised, unless further documented needs or obligations apply. Backup copies follow their respective technical retention and overwriting cycles.
9. Data Subjects' Rights
In the circumstances and within the limits laid down by the GDPR, data subjects may request access to their personal data, rectification, erasure, restriction of processing and, where applicable, data portability. They may object to processing based on legitimate interest on grounds relating to their particular situation. They also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
To exercise these rights, please use the contact details provided in Section 1. No consent or signed acknowledgement is required for the processing described in this notice.
10. Security and Updates
ComPart Multimedia implements technical and organisational measures proportionate to the risks, including access restricted to authorised personnel, protection of accounts and archives, and backups of relevant systems. This notice is reviewed when processing activities, relationships or applicable requirements change.
Last updated: 12 November 2026.