Privacy Policy for Customers, Suppliers and Business Partners
Customers, suppliers, and business partners — Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
1. Data controller
The data controller is ARCA DEFENSE ITALY SpA, with registered office at Via Cino del Duca 5, 20122 Milan (MI) and operational headquarters at C.da Termini snc, 66021 Casalbordino (CH), Fiscal Code and VAT number 02835800695, tel. +39 0873 918150, email direzione@arcadefenseitaly.it, certified email direzione.arcadefenseitaly@pec.it, in the person of its legal representative pro tempore.
The Company has designated Dr. Noè MELE as Data Protection Officer (DPO).
Privacy contact point: email dpo@arcadefenseitaly.it, certified email dpo.arcadefenseitaly@pec.it.
2. Interested parties and categories of data
This information is provided to customers, suppliers, consultants, contractors, and business partners who are natural persons, as well as—pursuant to Articles 13 and 14 of the GDPR—natural persons acting on behalf of entities and companies (legal representatives, contact persons, employees, and collaborators designated for the execution of the relationship).
The following are processed: identification and contact data, company role, billing and payment data, data contained in offers, contracts, correspondence, and shipping documents, data required for technical and professional suitability checks (Article 26 of Legislative Decree 81/2008) and, where required by sector legislation (Royal Decree 773/1931 – TULPS, Law 185/1990 and export control regulations), data relating to subjective requirements, including—within the limits of Article 10 of the GDPR and Article 2-octies of Legislative Decree 196/2003—judicial data.
3. Purposes and legal bases
| Purpose | Legal basis | Conferral |
| Negotiations, offers and pre-contractual measures | Art. 6(1)(b) GDPR | Necessary for the conclusion of the contract |
| Execution of the contract and administrative and accounting management of the relationship | Art. 6(1)(b) GDPR; art. 6(1)(f) for data of contact persons of legal entities | Necessary |
| Tax, accounting and customs compliance | Art. 6(1)(c) GDPR | Mandatory by law |
| Technical-professional suitability checks and procurement compliance (DUVRI) | Art. 6(1)(c) GDPR; D.Lgs. 81/2008 | Mandatory by law |
| Compliance with regulations on explosives and armaments (authorizations, communications to authorities) | Art. 6(1)(c) GDPR; art. 10 GDPR con art. 2-octies D.Lgs. 196/2003 | Mandatory by law |
| Legal and extrajudicial defense of rights, debt collection | Art. 6(1)(f) GDPR | — |
| Commercial communications about similar products and services to active customer contacts (B2B soft spam) | Art. 6(1)(f) GDPR; art. 130, comma 4, D.Lgs. 196/2003 | Opposition possible at any time |
4. Recipients
The data may be processed by authorized personnel pursuant to Art. 29 GDPR and disclosed to: data processors pursuant to Art. 28 GDPR (administrative and tax consultants, IT and cloud service providers, including Microsoft Ireland Operations Ltd. and WebZone srl); credit institutions; the Italian Revenue Agency and financial authorities; public security and sector authorities (Prefecture, Police Headquarters, UAMA/MAECI) in the cases provided for by law; debt collection professionals and companies; and judicial authorities. The data will not be disseminated.
5. Transfers to third countries
As a rule, data is processed within the European Economic Area. Any data flows to the parent company Arca Savunma Sanayi Ticaret A.Ş. (Turkey) are generally in aggregate form; where they concern personal data, they are subject to the guarantees set forth in Articles 46 et seq. of the GDPR (standard contractual clauses — Decision (EU) 2021/914, currently being finalized). A copy of the guarantees is available upon request.
6. Conservation
Data is retained for the duration of the relationship and for the following 10 years (Article 2220 of the Italian Civil Code), subject to longer periods arising from industry-specific obligations (documentation pursuant to Law 185/1990) or ongoing litigation. Data relating to unfinished negotiations is retained for 24 months.
7. Data source
The data is collected from the interested party, from the company or organization to which they belong, or from publicly accessible sources (chamber of commerce registers, lists, and directories) and from databases for the checks required by industry regulations.
8. Rights of the interested party
The interested party may exercise, against the Data Controller, the rights provided for by Articles 15-22 of the GDPR and, in particular:
- access to personal data and information on processing (Article 15 GDPR);
- rectification of inaccurate data and integration of incomplete data (Article 16 GDPR);
- cancellation, in the cases provided for by art. 17 GDPR;
- limitation of processing, in the cases provided for by art. 18 GDPR;
- portability of data processed by automated means on the basis of a contract or consent (Article 20 GDPR);
- objection, for reasons related to the particular situation of the interested party, to processing based on legitimate interest (Article 21 GDPR);
- withdrawal of consent, where the processing is based on consent, without prejudice to the lawfulness of the processing prior to the withdrawal (Article 7, paragraph 3, GDPR).
Requests can be sent to the email address dpo@arcadefenseitaly.it or certified email address dpo.arcadefenseitaly@pec.it. The Company will respond within one month, which may be extended by two months in particularly complex cases (Article 12, paragraph 3, GDPR). The right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali) remains unaffected.www.garanteprivacy.it)pursuant to art. 77 GDPR, or to take legal action.
9. Updates
Version 1.0 of 01/09/2026. The information is available on the institutional website and attached to the contractual documentation; for representatives of legal entities, we rely on the collaboration of the entity to which they belong to make it available (Article 14, paragraph 5, letter b), GDPR).