Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) to contact persons, employees and collaborators of customers, prospective customers and suppliers of MET srl.
Last updated: October 27, 2026
1. Data Controller
Management Excellence Tools MET srl, Via G. Mengoni 4, 20121 Milano (MI), Italy, Tax Code and VAT No. 10209860153, REA of Milano 1356319.
- Telephone: +39 02 87369 200
- Email: info@met.it
- Certified email (PEC): info@pec.met.it
Contact person for data protection matters: Michele Bollini, privacy@met.it. The Controller is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR.
2. Data subjects and data processed
We process the personal data of the natural persons we come into contact with when managing relationships with customers, prospective customers and suppliers: owners, legal representatives, technical and sales contacts, employees and collaborators, and meeting participants.
- Identification and contact data: first name, last name, company, role, email, telephone.
- Communications data: content of emails and messages exchanged with the Controller.
- Meeting data: names of participants, topics discussed, decisions and agreed actions, recorded in summaries and minutes; when a meeting is recorded or transcribed, also the audio recording and the transcript of what was said.
- Contractual and administrative data: data contained in offers, orders, contracts, invoices and project documents.
We do not process special categories of data (Article 9 GDPR) or data relating to criminal convictions and offenses, and we ask you not to include them in communications with the Controller.
Data is provided directly by the data subject or by the company they work for. Company data, such as company name, registered office, corporate offices and legal representatives, may also be acquired from the Companies Register through the Openapi S.p.A. service.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Managing negotiations, offers, orders and contracts with customers and suppliers | Legitimate interest of the Controller in managing the relationship with the data subject’s company (Article 6.1.f GDPR); performance of a contract or pre-contractual measures (Article 6.1.b) when the data subject is personally a party to the contract, for example a professional or sole proprietor |
| Organizing meetings and drafting summaries, minutes and action plans, including with recording, transcription and artificial intelligence tools | Legitimate interest of the Controller in documenting project activities accurately and efficiently (Article 6.1.f GDPR). The Controller has carried out a balancing test, a summary of which is available on request |
| Managing correspondence and operational communications | Legitimate interest of the Controller (Article 6.1.f GDPR) |
| Developing business relationships with prospective customers (B2B professional contacts) | Legitimate interest of the Controller (Article 6.1.f GDPR) |
| Inviting customers to events, trade fairs and webinars relating to services similar to those already provided | Legitimate interest of the Controller (Article 6.1.f GDPR and Article 130(4) of the Privacy Code), with the option to object in each invitation |
| Inviting prospective customers to events, trade fairs and webinars and sending them other promotional communications by email | Consent of the data subject (Article 6.1.a GDPR and Article 130 of the Privacy Code), which can be withdrawn at any time |
| Complying with tax, accounting and legal obligations | Legal obligation (Article 6.1.c GDPR) |
| Establishing, exercising or defending a legal claim | Legitimate interest of the Controller (Article 6.1.f GDPR) |
Providing the data is necessary to manage the relationship with the data subject’s company: without it, the Controller cannot carry out the requested activities. Consent to invitations for prospective customers is optional. No automated decision-making or profiling is carried out within the meaning of Article 22 GDPR.
4. Processing methods and tools
Data is processed with IT tools, by authorized personnel and with appropriate technical and organizational measures to protect it from unauthorized access, loss or unlawful use.
- Management system: protected database hosted on the fmcloud.fm service, on servers in Italy (Aruba data center), with access restricted to authorized personnel.
- Microsoft 365: email, document storage, collaboration and meetings on Microsoft Teams, and the Microsoft 365 Copilot assistant, with data located in the European Union.
- Telephony: calls are handled through the Zadarma virtual switchboard, which stores data in databases located in the European Union.
- Artificial intelligence: the Controller uses the services of Anthropic Ireland, Limited (Claude API) to process emails and draft meeting summaries and minutes. Content is processed only to produce these documents, and every generated text is checked by a person before use. Under the contract terms, the provider does not use the content to train its models and deletes it within 30 days, except in the cases set out in its terms, such as checking for violations of the service’s usage rules.
- Sending event invitations: invitation emails are sent through the SMTP2GO service, via its European servers.
- Recording and transcription of meetings: when a meeting is recorded or transcribed to draft the minutes, using Microsoft Teams or software installed on the Controller’s computers, participants are informed at the start and may object. Recordings and transcripts are stored on the Controller’s systems and deleted after the minutes have been drafted and checked, and in any case within 30 days.
5. Data recipients
Data is processed by the Controller’s authorized personnel and, within the limits necessary, by these data processors (Article 28 GDPR):
| Provider | Service |
|---|---|
| 1-more-thing Group, Avenue Legrand 80, 1050 Brussels, Belgium, VAT No. BE0631700523 | Hosting of the management system (fmcloud.fm) |
| Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, VAT No. 01573850516 | Data center for the management system |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft 365: email, documents, Teams, Microsoft 365 Copilot |
| IP Telecom Bulgaria LTD (Zadarma), 16 Vasil Levski Blvd., Office 211, 8000 Burgas, Bulgaria | VoIP telephony and virtual switchboard |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland | Artificial intelligence services (Claude API) for emails, summaries and minutes |
| SMTP2GO, New Zealand | Sending event invitation emails |
| External collaborators and companies working on the Controller’s projects | Design, development and consulting activities, limited to the data needed for the project |
| Tax and accounting consultants | Administrative obligations |
Data may also be disclosed, as independent controllers, to legal advisors, banks, shipping companies and public authorities, when necessary for the relationship or required by law. It is not disseminated or sold to third parties. The updated list of data processors can be requested at privacy@met.it.
6. Transfers outside the European Union
Management system data remains in Italy. Zadarma telephony data is stored in the European Union. Data managed on Microsoft 365 is stored in the European Union; Microsoft may process some of it in the United States in limited cases, such as technical support and security.
Content processed with Anthropic’s services is handled by Anthropic Ireland, Limited and may be processed in the United States by the parent company Anthropic, PBC.
Event invitations are sent through SMTP2GO, a company based in New Zealand.
The safeguards applied to transfers (Articles 45 and 46 GDPR) are:
- Microsoft: Microsoft Corporation’s certification under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023) and the Standard Contractual Clauses included in Microsoft’s DPA.
- Anthropic: the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), included in Anthropic’s DPA.
- SMTP2GO: the European Commission adequacy decision for New Zealand (Decision 2013/65/EU).
A copy of the safeguards can be requested at privacy@met.it.
7. Retention period
| Data | Retention |
|---|---|
| Contractual, administrative and tax data | 10 years from the end of the relationship (Article 2220 of the Italian Civil Code) |
| Correspondence and minutes relevant to the contractual relationship | 10 years from the end of the project or relationship, for limitation periods |
| Operational summaries and correspondence not relevant for contractual purposes | For the duration of the project and up to 24 months after its end |
| Meeting recordings and transcripts | Until the minutes have been checked and in any case no longer than 30 days |
| Contacts of prospective customers with no contractual relationship | 24 months from the last contact |
| Consent to event invitations | Until withdrawn and in any case no longer than 24 months from the last interaction |
After these periods, data is deleted or anonymized, unless it must be kept to protect a legal claim.
8. Rights of the data subject
The data subject may at any time exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability (in the cases provided for by Article 20 GDPR, namely for data processed on the basis of a contract or consent) and objection to processing based on legitimate interest, including the use of recording, transcription and artificial intelligence tools for meeting minutes. They may also object at any time to receiving event invitations, through the link in each invitation or by writing to the Controller, and withdraw any consent given.
Requests should be sent to privacy@met.it or by certified email (PEC) to info@pec.met.it. The Controller responds within one month of receipt, a period that can be extended by two months in complex cases, after informing the data subject (Article 12.3 GDPR).
The data subject may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).
9. Information for collaborators and changes
We ask customer or supplier companies to bring this notice to the attention of their employees and collaborators whose data they disclose to the Controller.
The Controller may update this notice. The version in force is always available on request and on this page, at www.met.it/en/privacy-customers-suppliers.
For the processing of data of website visitors, see the Site Privacy Notice.