Supplier Privacy Notice

Notice on the processing of suppliers’ personal data pursuant to Articles 13 and 14 of Regulation (EU) 679/2016 on the protection of personal data

Last updated: 9 July 2026

Herholdt Controls S.r.l., with registered office at Via Mestre 13, 20132 Milan (MI), VAT number and tax code 07482370157 (hereinafter also referred to as “Herholdt Controls”, the “Company” or the “Data Controller”), recognises the importance of protecting personal data and proactively undertakes to process such data responsibly and in accordance with the applicable principles and provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) and/or the national legislation in force.

To this end, our Company, as Data Controller, is required to provide you, in your capacity as a “data subject” — that is, the individual to whom the data being processed relate — with specific information on how we process your personal data, which we collect, organise, use, store or otherwise process for the purpose of establishing, managing and/or performing the relationship for the supply of goods and/or services to Herholdt Controls, in your capacity as a supplier (the “Supplier”).

In accordance with the Regulation, we therefore provide you with the following information through this notice (the “Privacy Notice”).

A. Data controller and privacy delegate

The Data Controller is Herholdt Controls S.r.l., with registered office at Via Mestre 13, Milan, tax code and VAT number 07482370157.

The person appointed by the Data Controller as its delegate for personal data protection matters, whom you may contact at any time for clarification and to exercise the rights set out in Articles 15–22 of the Regulation, as specified below (see section I of this Privacy Notice), is Mr Matteo Maggi.

The Privacy Delegate may be contacted by post at the registered office of Herholdt Controls S.r.l., Via Mestre 13, 20132 Milan, or by email at privacy@hhcontrols.com

B. Categories of personal data processed

Your personal data (the “Personal Data” or “Data”) that are or may be processed by the Company are listed below:

Ordinary personal data

These are data that relate directly or indirectly to the Supplier and identify or make the Supplier identifiable.

This category includes, for example: personal details (first name, surname, date of birth, residential address or other contact details, etc.) or email addresses; data that enable indirect identification (such as user ID, landline or mobile telephone number, etc.); tax information (such as tax code, VAT number, etc.); data relating to professional training or previous professional experience; bank details (such as IBAN or current account number); and income/financial data.

This category also includes judicial data (i.e. data relating to the enforcement of measures issued by judicial authorities, criminal convictions, etc.).

Ordinary Personal Data also include “metadata” and technical information associated with the management of the contractual relationship and communications with the Data Controller. For example, the Data collected and processed may include the date and time when requests, communications, orders or reports are sent, received or handled; identifiers associated with the Customer, the contract, orders or open cases; information on the progress of requests and activities carried out; and any other technical, administrative or organisational information generated in connection with the establishment, management, performance and monitoring of the contractual or pre-contractual relationship with that Customer.

These Data will be processed only to the extent strictly necessary to fulfil the purposes specified in section C of this Privacy Notice.

To ensure the proper establishment, management and performance of its relationship with Suppliers, Herholdt Controls may also obtain certain Personal Data through its business partners and third parties.

C. Purposes and legal bases for processing personal data

Information relating to you will be processed in accordance with the principles of fairness, lawfulness and transparency, and with due regard for the protection of your privacy and your rights.

Your Personal Data are collected and processed for the purposes and on the legal bases specifically set out below. You may always ask the Data Controller to clarify the specific legal basis for each processing activity and, in particular, to specify whether the processing is based on the law, on a contractual obligation to which you are a party, or on a legitimate interest of the Data Controller.

1. Purposes relating to the handling of pre-contractual requests to establish the relationship

To enable the handling of any requests made by the Supplier at the pre-contractual stage (for example, requests for contact or information), or to enable the Company to carry out the assessments needed to establish a relationship with you and enter into the corresponding contract for the supply of products and/or services by you to Herholdt Controls.

Legal bases

Processing for the above purposes is carried out on specific legal bases: taking pre-contractual steps to establish the relationship with you and enter into the corresponding supply contract — see Article 6(1)(b) of the Regulation.

2. Purposes relating to the proper performance of a contract

For purposes aimed at: (i) enabling Herholdt Controls to properly fulfil its contractual obligations towards you; (ii) enabling the supply of goods or services connected with the performance of that contract; (iii) sending communications relating to the performance of the contract (including, for example, information and notifications concerning the technical specifications of products or services sold by the Supplier and/or the status and quality of those products and/or services); (iv) enabling any further requests concerning products and/or services purchased by Herholdt Controls, or any complaints concerning those products or services; and (v) managing the Supplier’s account (order management, invoicing, debt collection, etc.).

Legal bases

Processing for the above purposes is carried out on specific legal bases: the performance of a contract to which you are a party — see Article 6(1)(b) of the Regulation.

3. Purposes relating to compliance with legal requirements and/or obligations

Your Data may be processed: (i) for administrative and management purposes and to fulfil and comply with obligations laid down by law (such as accounting, tax or anti-money laundering obligations), regulations, EU legislation or an order issued by an authority to which Herholdt Controls is subject; and (ii) to establish, exercise or defend a legal claim.

Legal bases

Processing for these purposes is carried out on specific legal bases: compliance with legal obligations to which the Data Controller is subject — see Article 6(1)(c) of the Regulation — and the Data Controller’s legitimate interest (with full respect for your rights and freedoms as a data subject) in defending its rights in legal proceedings — see Article 6(1)(f) of the Regulation.

D. Methods of processing

Your Personal Data, which are necessary to achieve the purposes set out in section C of this Privacy Notice, are and will be processed both on paper and using electronic or telecommunications tools, in all cases equipped with security measures suitable to safeguard the data subject’s rights and freedoms and the confidentiality, integrity and availability of the information processed, in accordance with the Regulation, the law and the Company’s internal policies.

E. Mandatory or optional nature of the provision of data

Providing the Company with your Personal Data for the purposes referred to in points 1, 2 and 3 of section C of this Privacy Notice is optional but necessary: any refusal to provide the Data could prevent the Company from carrying out activities closely connected with and/or instrumental to achieving the stated purposes. Consequently, for example, Herholdt Controls might be unable to enter into the requested contract with you, or the Company might be unable to perform its obligations under a contract already in force with you.

If you have any doubts as to whether providing your Personal Data is mandatory or optional, we encourage you to contact the Company.

F. Categories of recipients of personal data

Your Personal Data will not be disseminated, meaning that they will not be disclosed to unidentified parties in any manner, including by making them available or accessible for consultation.

Your Personal Data, or at least some of them, will be disclosed solely and exclusively for the purposes specified in section C of this Privacy Notice to the Data Controller’s employees and collaborators working within Herholdt Controls’ business functions who are assigned to process Personal Data. They act under the Data Controller’s authority or delegation, respectively, as Authorised Persons or Delegated Persons for processing, and need to process the Data to perform their duties or delegated responsibilities, or by virtue of their position. These persons, whose number will be kept as limited as possible, will have access only to the Data relevant to their assigned activities and will act on instructions provided for this purpose by the Data Controller or its delegate.

Suppliers’ Personal Data may also be disclosed, where necessary, to the following categories of recipients:

A. Other companies in the Group to which Herholdt Controls belongs (affiliates, subsidiaries or parent companies), or business partners

Herholdt Controls may share Personal Data with, or grant access to such Data to, the parent company, Hager Italia Partecipazioni S.r.l., other Italian or foreign companies within its Group (affiliates, subsidiaries or parent companies), or business partners, to facilitate the management and administration of our Suppliers’ accounts, for direct electronic marketing purposes and for other legitimate business purposes.

B. Third-party service providers

Personal Data may be disclosed to third parties that provide specific services on behalf of the Data Controller (for example, third-party providers of IT or web system management, maintenance and support services, freight forwarders, etc.).

Herholdt Controls may also disclose Personal Data to external consultants, lawyers and advisers, in accordance with applicable personal data protection laws.

C. Other third parties

Herholdt Controls may also disclose your Personal Data to other third parties (including any competent judicial or administrative authority) to: (i) comply with obligations imposed on our Company by law or regulations, and comply with an order issued by a judicial or other public authority; (ii) where necessary, establish, exercise or defend the Data Controller’s rights in potential, threatened or actual litigation with the Supplier; or (iii) in connection with the sale or other transfer of all or part of the business carried on by Herholdt Controls.

Where these recipients process Data on behalf of Herholdt Controls, they will be appointed as external Data Processors under a specific contract (or other legal act) that binds them to the Company and provides the safeguards required by Article 28 of the Regulation to protect the data subject’s rights and freedoms.

The full list of Data Processors appointed pursuant to Article 28 of the Regulation is available at Herholdt Controls’ registered office.

Finally, please note that any information concerning you may be accessible, directly or indirectly, to the professionals whom the Company has individually identified and expressly designated as System Administrators. These are technical staff whose activities involve managing and maintaining the data processing system or its components (for example, overseeing the resources of a computer operating system or database and enabling their use, managing system access credentials, organising network traffic, performing backups and adopting protective measures, etc.).

G. Place of processing and transfer of data

Your Personal Data are processed, always for the purposes specified in section C of this Privacy Notice, on servers located at the registered office at Via Mestre 13, Milan (MI), or at the premises of other Hager Group companies within the European Union/European Economic Area.

As Herholdt Controls operates worldwide, in order to achieve the purposes set out in section C of this Privacy Notice, your Personal Data may be transferred to companies in the Hager Group, to which Herholdt Controls belongs, located both within and outside the European Union/European Economic Area.

In such cases, any transfer by the Data Controller of Personal Data to countries outside the EU/EEA will comply with the appropriate safeguards applicable to that transfer under Articles 45 and 46 of the Regulation, or take place under the derogations set out in Article 49(1) of the Regulation, with appropriate confidentiality and security safeguards.

H. Personal data retention period or criteria used to determine that period

Your Personal Data will be retained and processed by the Company for as long as necessary to fulfil the purposes specified in section C, or for a different period required by applicable law.

In any event, to ensure compliance with the principles of necessity and proportionality of processing, and without prejudice to any further statutory obligations, the Data Controller has identified different retention periods for your Data according to the specific purposes pursued:

• for the purposes referred to in point 1 of section C above (pre-contractual stage), your Data will be retained only for as long as strictly necessary to establish the business relationship;
• for the purposes referred to in point 2 of section C above (performance of the contract), your Data will be retained for the entire actual duration of the business relationship with the Supplier concerned, or for a different period required by applicable law. For example, accounting and tax Data will be retained for a maximum of ten years from the end of the business relationship.

The Data Controller may be required to retain the Data for a longer period, corresponding to the limitation period applicable to the right concerned, in order to comply with legal or contractual obligations, or to exercise or defend a legal claim (for example, obligations to retain accounting records, handling any litigation, etc.).

At the end of the retention period, the Personal Data will be erased. Therefore, once that period has expired, the rights of access, erasure, rectification and portability of the Personal Data may no longer be exercised.

I. Data subject’s rights

You may exercise the rights granted by the Regulation at any time. In particular, in addition to the right to withdraw at any time, pursuant to Article 7 of the Regulation, any consent you may have given to processing for specific purposes, you have the following rights:

• Right of access (Article 15 of the Regulation): the right to obtain confirmation as to whether or not your personal data are being processed and, if so, to access your Personal Data and information concerning:

  1. the purposes of the processing;
  2. the categories of Personal Data processed;
  3. the recipients or categories of recipients to whom your Personal Data have been or will be disclosed;
  4. the Data retention period or, if this is not possible, the criteria used to determine that period;
  5. the existence of your rights as a data subject to ask the Data Controller to rectify or erase your Personal Data, restrict the processing of those Data or object to their processing;
  6. the existence of the right to lodge a complaint with the supervisory authority;
  7. the existence of your right to access all available information about the source of your Data, where they have not been collected from you;
  8. the existence of automated decision-making.
• Right to rectification (Article 16 of the Regulation): the right to obtain, without undue delay, the rectification of inaccurate Personal Data concerning you and/or the completion of incomplete Personal Data.

• Right to erasure (Article 17 of the Regulation): the right to obtain the erasure of your Personal Data without undue delay, provided that the restrictions laid down in the Regulation do not apply, where:

  • the Data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • consent is withdrawn and there is no other legal ground for processing;
  • you object to the processing and there are no overriding legitimate grounds for continuing it;
  • the Personal Data have been unlawfully processed;
  • the Personal Data must be erased to comply with a legal obligation;
  • the Personal Data have been collected in connection with the offer of information society services;

• Right to restriction of processing (Article 18 of the Regulation): the right to obtain restriction of processing:

  • where you contest the accuracy of the Personal Data, for the period necessary for the Data Controller to verify their accuracy;
  • where processing is unlawful and you oppose erasure of the Personal Data and request restriction of their use instead;
  • where you require the Personal Data to establish, exercise or defend a legal claim, even though the Data Controller no longer needs them for processing purposes;
  • where you object to processing by exercising your right to object;
• Right to be notified (Article 20 of the Regulation) of any rectification or erasure of Personal Data or restriction of processing;

• Right to Data portability (Article 21 of the Regulation): the right to receive your Personal Data in a structured, commonly used and machine-readable format and to transmit those Data to another data controller, where:

  • processing is based on your express consent for one or more specific purposes or on a contract entered into with you;
  • and processing is carried out by automated means;

  and/or the right to request that such information be transmitted to another service provider (where technically feasible);

• Right to object (Article 22 of the Regulation): the right to object at any time, on grounds relating to your particular situation, to the processing of Personal Data concerning you;
• Right to lodge a complaint (Article 77 of the Regulation): the right to lodge a complaint about the Company’s processing of your Personal Data with the Italian Data Protection Authority or the equivalent supervisory authority with territorial jurisdiction.

J. Updates to this privacy notice

The Data Controller reserves the right to amend and update this Privacy Notice in response to regulatory, technical and/or business changes.

You are therefore advised to review it regularly and refer to the most up-to-date version provided by the Data Controller. The date on which this Privacy Notice was last updated will be shown at the top of the document.

This Privacy Notice cancels and fully replaces all previous versions, which must therefore be considered superseded.

Thank you for your attention.