Privacy Notice

Information provided according to article art. 13 of European Regulation 679/2016 (GDPR -General Data Protection Regulation)


DATA CONTROLLER. The Data Controller is Vernay Italia s.r.l.– Località Rilate 21, 14100, Asti (AT) Tel. 0141 413511 email:

DATA PROCESSING DESCRIPTION. Management of the data of employees, third parties and subjects reported in the context of reports of any wrongdoing (so-called “Whistleblowing”)

PURPOSE AND LEGAL BASIS. It should be noted that the processing will be carried out for the following purposes:

PurposeLegal BasisStorage Period or Criteria
Investigative activities aimed at verifying the validity of what has been reported, as well as, where appropriate, take appropriate corrective measures and take appropriate disciplinary and/or judicial action against those responsible for the unlawful conduct.(art. 6.1.c GDPR) – Comply with a legal obligation to which the controller is subjectThe Data Controller carries out a preliminary investigation of the report. If, as a result of the turnaround, it finds that it is manifestly unfounded, it disposes of the archiving. If the report is found to be a prima facie case, it transmits the same, without the whistleblower’s data, to the relevant bodies. Personal data is stored for a period of 5 years and, in any case, until the procedures initiated by the recipient offices have been resolved.
Reporting, in the interest of the Administration, of alleged unlawful conduct of which the whistleblower has become aware.(art. 6.1.c GDPR) – Comply with a legal obligation to which the controller is subject

The data processing always be based on principles of fairness, lawfulness, transparency and protection of the confidentiality and rights of the data subjects.

MANDATORY OR OPTIONAL NATURE OF DATA PROVISION. Please be advised that, considering the purposes of the data processing, data provision is mandatory. Failure, partial or incorrect provision could make impossible to finalize the contract.

In case of providing data by filling forms containing asterisks:

RECIPIENTS OR GROUPS OF RECIPIENTS. The personal data may be processed exclusively by the Controller or persons authorized by the latter.

The data in question may be transferred to the following groups of third parties:

National Anti-Corruption Authority – ANAC
Court of Auditor

The data will not be disclosed.

LODGING A COMPLAINT WITH THE SUPERVISORY AUTHORITY. The data subject is entitled to lodge a complaint with the Supervisory Authority (for Italy: Garante per la protezione dei dati personali

RIGHTS OF THE DATA SUBJECTS. It is possible at any time, to exercise the rights to access personal data, rectify or erase the latter, restrict processing, object thereto or to processing portability according to articles 15-20 of European Regulation 679/2016 by sending an e-mail to the following address:  The exercise of the rights of the interested party may be delayed, limited or excluded in the cases provided for by Article 2-undecies of Legislative Decree 196/03.

RIGHT TO OBJECT. At any time, the right to object may be exercised, for reasons connected with the particular situation of the interested party, to the processing of personal data concerning him / her, pursuant to art. 6, paragraph 1, letters e) or f) GDPR. With regard to the processing of personal data for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him for these purposes, including profiling to the extent to which it is connected to such marketing direct by sending an email request to

EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS. Processing does not involve any automated decision-making process.

TRANSFER OF DATA TO A THIRD COUNTRY OR TO AN INTERNATIONAL ORGANISATION. The data Controller shall not transfer personal data to a third country or international organisation.