1. Data controller
Yellow Tech S.r.l., tax code and VAT no. 10568721210, Via Carlo Boncompagni 3/B, 20139 Milan (MI), Italy, represented by its legal representative pro tempore. Email: info@yellowtech.it, PEC (certified email): yellowtech@pec.it.
2. Data Protection Officer (DPO)
Avv. Francesco Angelo Lorusso, Viale Monte Nero 66, Milan, Italy. Email: lorusso@legalelorusso.it, PEC (certified email): lorussofrancesco@milano.pecavvocati.it.
3. What data we process and where it comes from
First and last name or company name; tax details (VAT number, tax code); registered and legal addresses, postal addresses, phone numbers and email addresses of contacts; bank details; the economic value of the goods and services purchased; the content of operational communications.
Data is collected directly from the data subject or received from the supplier they work for (Art. 14 GDPR).
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Requesting quotes, entering into and performing the supply contract, managing orders and operational communications | Performance of a contract or of pre-contractual measures (Art. 6.1.b GDPR); legitimate interest in performing the contract, for the data of the supplier's contacts (Art. 6.1.f) |
| Administration and accounting: recording invoices received, making payments | Compliance with legal obligations, in particular tax and accounting obligations (Art. 6.1.c) |
| Protecting Yellow Tech's rights in the event of complaints or disputes | Legitimate interest (Art. 6.1.f) |
Providing the data is necessary to enter into and perform the contract: without it, Yellow Tech cannot manage the supply or make payments.
5. How we process it and who it may be disclosed to
Data is processed in digital form on company systems, with personal user accounts and access limited to Yellow Tech staff authorised under Art. 29 GDPR. It may be disclosed to: public authorities, where required by law; companies that provide data processing services or carry out activities related to the contractual relationship; banks and post offices, for making payments; law firms and professional advisers for the handling of any disputes. These parties act as independent controllers or as processors. Data is not disseminated.
6. Transfers outside the European Economic Area
For the purposes of this notice, data is not intentionally transferred to countries outside the European Economic Area (EEA). Where this happens through technology tools of providers based outside the EEA, the safeguards required by the GDPR apply (an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses). A copy of the safeguards can be requested from the Controller.
7. How long we keep it
For the duration of the supply relationship and, afterwards, for the period required by tax and accounting obligations (10 years for accounting records, Art. 2220 of the Italian Civil Code) and by the limitation periods for the protection of rights in civil proceedings. In the event of a dispute, until it is resolved. Once these periods have elapsed, the data is deleted or anonymised.
8. Rights of data subjects
Every data subject may request access to their data, rectification, erasure, restriction of processing and portability, and may object to processing based on legitimate interest (Arts. 15-22 GDPR), by writing to info@yellowtech.it or to the DPO. Yellow Tech replies within one month of the request, extendable to three months for complex requests, in which case it explains why within the first month. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
9. Automated decision-making
No decisions based solely on automated processing, including profiling, are taken on the data processed for the purposes of this notice.
10. Updates
This notice may be updated, including following changes in the law; the updated version is communicated to data subjects. Last updated: 12/10/2026.
If anything here is unclear, ask us
To exercise your rights or to ask a question about this notice, write to info@yellowtech.it. We reply within 30 days, as the GDPR requires.