Privacy policy - Clients

In performing our engagement, we could collect and use personal data relevant to:

• the Client, its company, its trustees, and its clients, and
• Client’s employees, agents and collaborators
• Any other personal data collected also at third-party companies, being useful for the performance of the engagement.

Depending on the degree of autonomy, with which we process your personal data, Grant Thornton could act either as Controller or as Processor.

• Should we act as Controller, we would process all data as Controller in compliance with Opinion 1/2010 of Article 29 Working Party on personal data protection. In this case, data will be processed in order to carry out pre-contractual verifications provided by our procedures, to execute our engagement, and to comply with law, accounting and tax fulfilments, also according to the requirements of applicable regulations, by the policies and procedures on quality control from time to time in force at Grant Thornton, as well as by applicable professional standards.
• Should we act as Processor, we would process only data relevant to the contractual management as Controller, while we would process data as Processor those data processed on behalf of the Client, also with reference to Opinion 1/2010 of Article 29 Working Party on personal data protection. As regards the role as Processor, we acknowledge that the engagement was assigned considering the company profile, in terms of resources, property, equipment and know-how, which is adequate to provide sufficient guarantees so that proper technical and organizational solutions can be enacted to make processing be compliant with the requirements of the Regulation and ensure the protection of data subjects. The Processor will report to the Client any event that could breach the above requirements. The parties agree that the breach of one of the requirements under art. 28 of the Regulation constitutes a just cause for the revocation of the role as data Processor by the Controller. The Processor will stick to the instructions agreed with the Client.

Generally, the Client’s referents can be included in the distribution lists of informative newsletters concerning issues related to the contract and can be contacted for commercial purposes, in the pursuance of the interests of the Controller, without prejudice to the data subjects’ right to object.

Data will be processed by Grant Thornton for the whole term of the contract and afterwards for the execution of all law fulfilments provided. Data will be retained for the terms provided by civil and tax law.

Data can be disclosed to data processors, which Grant Thornton engages within outsourcing relationships, as well as to people authorized to personal data processing, pursuant to art. 29 of the Regulation, under the direct authority of the Controller or the Processor for the purposes of this statement. Data processing is not subject to automated decision-making, including profiling.

Within the relationships between Grant Thornton entities, as concerns the management of communication processes, such as the management of newsletters, the entities are joint controllers, as regulated in a specific internal agreement.