On a SharePoint online (office 365) environment, assume you have three sub sites each containing a list (all lists contain same content type). Each sub site is made for a supplier. Suppliers use their sub sites to add items to the list. The root site contains a list which aggregates items from sub site's list. When suppliers go to root site they have read permission and must see only their one items that added to their sub site. Is it possible to solve it OOTB (no code at all)? thanks.
You can use Content Query Web Part (CQWP) to solve this. It is available once you activate publishing features on your site. (or use a Publishing site)
You can make the following settings using the CQWP:
Select to display items from the entire Site Collection (Which will cover your 3 sub sites)
Select to display items belonging only to a specific Content Type (select your supplier Content Type here)
Use Audience Targeting setting of the CQWP to set the required permissions for the required groups.