Privacy Notice
On the processing of personal data pursuant to Articles 13 and 14 of the GDPR — Platform
Last updated 13 October 2026
Marvinet S.r.l., with its registered office at Viale Bruno Buozzi 77 - 00197, Rome, VAT No. 17748281007 (hereinafter the “Data Controller”), in its capacity as Data Controller, hereby informs you, in accordance with EU Regulation 2016/679 (“GDPR”) and current legislation on the protection of personal data, that your data (hereinafter “Data”), in relation to the Platform (hereinafter “Platform”) and the use of the services offered by the Data Controller, will be processed in the manner and for the purposes set out below.
Unless otherwise stated, the contents of this notice shall be deemed to apply to Personal Data processed in connection with the use of the Platform. It is understood that, for the processing of Personal Data carried out for purposes other than those indicated below, the processing notices relating to the specific services in question shall apply.
Types of data processed
The Data Controller processes the following Personal Data provided by you at the start of and during your use of the Platform, including both general and specific categories, by way of example: identification data (first name and surname), contact details (email), browsing data, employer details and all data necessary for KYC and KYB procedures, in accordance with the applicable AML/CFT legislation.
The Personal Data of the invited Third Party – first name, surname, email address, mobile phone number and company affiliation – has been provided to the Data Controller by a User already registered on the Platform, who entered this information in order to invite the Third Party to register and participate in the Platform’s activities.
Purposes and legal bases for processing
| No. | Purpose | Legal basis |
|---|---|---|
| 1 | Creation and management of user accounts on the Marvinet Platform, necessary for the purposes of registration and use of the Platform itself. Please note that the user account is linked to a company; the user registering must be a representative of that company. | The processing is necessary for the performance of contractual or pre-contractual measures pursuant to Article 6(1)(b) of the GDPR |
| 2 | Completion of the User’s company profile on the Platform following initial registration. | The processing is necessary for the performance of contractual or pre-contractual measures pursuant to Article 6(1)(b) of the GDPR |
| 3 | Compliance with customer due diligence (Know Your Customer – KYC) obligations in relation to the corporate profile created by the User, in accordance with the applicable AML/CFT legislation. | The processing is necessary for compliance with a legal obligation pursuant to Article 6(1)(c), in relation to anti-money laundering and counter-terrorist financing (AML/CFT) legislation. Where the processing concerns Special Categories of Data, the legal basis is the substantial public interest pursuant to Article 9(2)(g) of the GDPR. Where the processing concerns judicial data, the legal basis is compliance with a legal obligation pursuant to Articles 10 and 6(1)(c) of the GDPR. |
| 4 | Compliance with customer due diligence obligations (Know Your Business – KYB) in relation to the company whose profile has been created by the User, in accordance with the applicable AML/CFT legislation. | The processing is necessary for compliance with a legal obligation pursuant to Article 6(1)(c), in relation to anti-money laundering and counter-terrorist financing (AML/CFT) legislation. Where the processing concerns special categories of data, the legal basis is the substantial public interest pursuant to Article 9(2)(g) of the GDPR. Where the processing concerns judicial data, the legal basis is compliance with a legal obligation pursuant to Articles 10 and 6(1)(c) of the GDPR. |
| 5 | Management of Users’ activities on the Platform, including: the creation and publication of products; sending invitations to third parties in relation to products and deals; the creation and management of deals; conducting commercial negotiations; concluding agreements (including via chat); and uploading documents relating to transactions (e.g. commercial and transport documents). | The processing is necessary for the performance of contractual or pre-contractual measures pursuant to Article 6(1)(b) of the GDPR |
| 6 | Coordination with the escrow agent for the verification and management of transactions relating to deals concluded on the Platform. | The processing is necessary for the performance of contractual or pre-contractual measures pursuant to Article 6(1)(b). |
| 7 | Sending invitations to third parties via the Platform. A registered User enters a third party’s contact details (first name, surname, email address, mobile phone number and company name) to enable that third party to register and participate in the Platform’s activities. The third party receives an electronic communication inviting them to complete their registration. | The processing is necessary for the purposes of a legitimate interest pursued by the Data Controller pursuant to Article 6(1)(f) of the GDPR |
| 8 | Technical management of the Platform and its operational functions, to ensure it operates correctly, to improve the quality of the services offered and to optimise the Platform’s functionality | The processing is necessary for the purposes of a legitimate interest pursued by the Data Controller pursuant to Article 6(1)(f) of the GDPR |
| 9 | Exercising the Data Controller’s rights in court and the management of legal disputes | The processing is necessary for the purposes of the Data Controller’s legitimate interests pursuant to Article 6(1)(f) of the GDPR |
| 10 | Prevention and prosecution of unlawful acts | The processing is necessary for the purposes of the Data Controller’s legitimate interests pursuant to Article 6(1)(f) of the GDPR |
Methods of processing
Your Data is processed both on paper and electronically in such a way as to minimise the risk of destruction, loss (including accidental loss), unauthorised access or use, or use incompatible with the original purpose of collection. This is achieved through the technical and organisational security measures implemented by the Data Controller.
Data retention
Personal Data will be retained for the period strictly necessary to fulfil the purposes for which it was collected, in accordance with the principle of storage limitation set out in Article 5(1)(e) of the GDPR, and will be erased at the end of the respective retention period. The Data Controller shall, however, be entitled to retain the Personal Data further, in whole or in part, in accordance with specific legal provisions or to assert or defend a right in court.
Specifically, the retention periods vary depending on the purpose of the processing, as set out below:
- 10 years from the termination of the contractual relationship with regard to Data processed for the performance of the contract, for legal and accounting obligations, and for the management of disputes, in accordance with Articles 2220 and 2946 of the Italian Civil Code.
- For the data of third parties invited to the Platform by a registered User (Article 14 of the GDPR): the data is retained until the third party completes their registration; if registration does not take place, the data is erased within 30 days of the invitation being sent.
Provision of data
The provision of Data for the purposes described above is necessary and mandatory, and any refusal to provide such Data will make it impossible to use the Data Controller’s services. This applies to Data processed for the purposes of creating and managing the account, completing the company profile, carrying out KYC/KYB activities, managing the Platform’s features, coordinating with the escrow agent, managing internal messaging, assessing goods and the technical management of the Platform.
Data disclosure
For the purposes set out above, the Data Controller may disclose your Data to:
You may request an up-to-date list of data processors from the Data Controller at any time at [email protected].
- employees and/or contractors, who have been duly instructed and authorised to process data in accordance with Article 29 of the GDPR and Article 2-quaterdecies of Legislative Decree 196/2003;
- third parties (for example, IT service providers, hosting providers, etc.) engaged by the Data Controller to carry out activities necessary to achieve the aforementioned purposes, who will process the Data in their capacity as data processors or independent data controllers.
Data transfer
The Data Controller may transfer data outside the European Economic Area for the purposes set out above. This will take place exclusively on the basis of an adequacy decision pursuant to Article 45 of the GDPR or, in any event, in accordance with the safeguards set out in Chapter V of the GDPR.
Rights of the data subject
The Data Controller informs you that, as a data subject, unless the restrictions provided for by law apply, you have the right to:
In the above cases, where necessary, the Data Controller will inform any third parties to whom your Personal Data has been disclosed of any exercise of your rights, except in specific cases (e.g. where such compliance proves impossible or involves a use of resources that is manifestly disproportionate to the right being protected).
If the data subject considers that their rights have been infringed, they have the right to lodge a complaint with the Data Protection Authority. For further information, please consult the Data Protection Authority’s website – www.garanteprivacy.it – where you will find a section dedicated to these rights.
- obtain confirmation as to whether or not your Personal Data exists, even if not yet recorded, and to have such Data made available to you in an intelligible form;
- to obtain information and, where applicable, a copy of: a) the source and category of the Personal Data; b) the logic applied where processing is carried out with the aid of electronic means; c) the purposes and methods of processing; d) the identification details of the Data Controller and Data Processors; e) the recipients or categories of recipients to whom the Personal Data may be disclosed or who may become aware of it, in particular if recipients are in third countries or international organisations; f) where possible, the period for which the Data will be stored or the criteria used to determine that period; g) the existence of automated decision-making, and, where this is the case, the logic involved, as well as the significance and the envisaged consequences for the data subject; h) the existence of appropriate safeguards in the event of a transfer of Data to a country outside the EU or to an international organisation;
- to have inaccurate Data updated and rectified without undue delay or, where the data subject has an interest in doing so, to have incomplete Data completed;
- to withdraw, at any time, easily and without hindrance, the consents given, using, where possible, the same channels used to provide them;
- to have the Data erased, anonymised or restricted: a) where it has been processed unlawfully; b) where it is no longer necessary in relation to the purposes for which it was collected or subsequently processed; c) where consent on which the processing is based has been withdrawn and there is no other legal basis; d) where you have objected to the processing and there are no overriding legitimate grounds for continuing the processing; e) where there is a legal obligation to do so; f) where the Data relates to children. The Data Controller may refuse to erase data only in the following cases: a) where the right to freedom of expression and information is exercised; b) where a legal obligation is being fulfilled, a task carried out in the public interest is being performed, or public powers are being exercised; c) for reasons of public health interest; d) where the data is archived in the public interest, for scientific or historical research, or for statistical purposes; e) where a right is being exercised in legal proceedings;
- to obtain restriction of processing in the following cases: a) where the accuracy of the Personal Data is contested; b) where the Data Controller has processed the data unlawfully, to prevent its erasure; c) where you are exercising a right in legal proceedings; d) to assess whether the Data Controller’s legitimate grounds override those of the data subject;
- to receive, where the processing is carried out by automated means, without hindrance and in a structured, commonly used and machine-readable format, the Personal Data concerning you in order to transmit it to another data controller or – where technically feasible – to have the Data Controller transmit it directly to another data controller;
- to object, in whole or in part, on legitimate grounds relating to your particular situation, to the processing of your Personal Data;
How to exercise your rights
You may, at any time, exercise your rights:
- by sending a registered letter with acknowledgement of receipt to the Data Controller’s address;
- by sending an email to [email protected].