PRIVACY POLICY

Customer personal data processing Information

Adv. Antonio Donvito, owner of the law firm Studio Legale Donvito, with its registered office in Milan, Via Paolo Andreani, no. 4, VAT no. 07571700157, as data controller (hereafter “Data Controller“), informs you, under EU Regulation 679/2016 (“GDPR”) and the national legislation on the protection of personal data (“Privacy Law“), that your data will be processed with the following methods and purposes:

1. Processing subject

The Data Controller processes personal, identifying and non-sensitive data (name, surname, company name, address, email address, etc. – hereafter “Personal Data” or “Data“) you communicated when signing the contract with the Data Controller and/or when the Data Controller professional services are requested.

2. Processing purposes and legal basis

Your Personal Data may be processed:
without your prior express consent, for the following Service Purposes and legal basis:

• the execution of the contract and /or the fulfilment of pre-contractual commitments, specifically:
  • pre-contractual and contractual relationship management;
  • contract execution;
  • collection and payment management;
• the fulfilment of legal obligations by the Controller, such as:
  • compliance with the obligations established by laws, regulations or national and European legislation or imposed by the relevant Authorities;
  • compilation and processing of tax returns and related obligations;
  • account keeping and related obligations;
• the pursuit of a Controller legitimate interest, such as:
  • the exercise of the Controller’s rights in court and the management of any disputes;
  • prevention and suppression of unlawful acts;
  • solvency monitoring and anti-fraud activities;

3. Processing methods

The processing of your personal data is carried out electronically and on paper, through the collection, registration, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.

4. Data Retention

The Data Controller will process Personal Data for the time necessary to fulfil the above purposes and for no longer than 10 years from the contractual relationship’s termination.

4. Data access

Your data may be made accessible for the purposes mentioned above to:

• Data Controller’s employees and/or associates, as data processors and/or internal processors and/or system administrators;
• third-party companies that carry out outsourcing activities on behalf of the Data Controller, as external data processors (for example, credit institutions, professional firms, etc.);
• third parties (for example, translation consultants, IT providers, banking institutions, brokerage and administrative agencies, employers’ associations, freelancers, graphic designers, etc.) who carry out outsourced activities on behalf of the Controller and who process Data as external data processors.

5. Data Communication

Even without your consent your data may be communicated to supervisory bodies, law enforcement agencies or judicial authorities, Ministry of Finance, Revenue Agency, ministerial bodies and relevant authorities, local authorities (regions, provinces, municipalities), regional and provincial tax commissions, at their express request. They will process data as independent data controllers for institutional and/or legal purposes during investigations and controls.

Your data may also be disclosed to third parties (for example, partners, freelancers, etc.), as independent data controllers, for the performance of activities which are instrumental to the above purposes.

6. Data transfer

The Data shall not be disseminated nor transferred to non-EU countries.

7. Data provision

The provision of data for service purposes is mandatory. This is necessary for the relationship with the Data Controller. Failure to provide Data will make it impossible to establish or continue the contractual relationship with the Data Controller.

8. Data subject rights

We inform you that, as data subject, you shall have the right to:

• confirm the existence of your personal data, even if not yet registered, and that such data is made available to you in an intelligible form;
• obtain indication and, where appropriate, a copy of: a) the personal data origin and category; b) the logic applied in case of processing carried out with the aid of electronic tools; c) the processing purposes and methods d) the identification details of the Data Controller and Processors; e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it, particularly if they are recipients of third party countries or international organisations; e) where possible, the data retention period or the criteria used to determine this period; f) the existence of an automated decision-making process, including profiling, and the related logics used, the importance and consequences for the data subject; g) the existence of adequate guarantees for data transfer to a non-EU country or an international organisation;
• obtain, without undue delay, any update or rectification of inaccurate data or the integration of incomplete data;
• exercise the right to withdraw consent at any time, easily, without impediments, using the same channels used to provide consent, if possible;
• obtain data cancellation, transformation into anonymous format or blocking if: a) it is unlawfully processed; b) no longer necessary for the purposes for which it was collected or processed; c) in case of withdrawal of consent on which the processing is based and if there is no other legal basis, d) you have opposed the processing and there is no legitimate overriding reason to continue; e) it is to fulfil a legal obligation; f) it is data referring to minors. The Data Controller may refuse the cancellation only in the event of: a) an exercise of the right to freedom of expression and information; b) fulfilment of a legal obligation, execution of a task performed in the public interest or exercise of public authority; c) reasons of public health interest; d) archiving purposes in the public interest, scientific or historical research or statistical purposes; e) exercise of rights in court;
• obtain the processing limitation in case of: a) an objection about the personal data’s accuracy; b) unlawful processing of the Data Controller to prevent its cancellation; c) exercise of your rights in court; d) verification whether the legitimate grounds of the Controller override those of the data subject;
• if the processing is carried out automatically, receive your personal data without hindrance and in a structured, commonly used and machine-readable format to transmit it to another Controller or to obtain direct transmission to another Controller, if technically feasible;
• oppose, in whole or in part: a) for legitimate reasons, to the processing of personal data, even if pertinent to the collection purposes; b) to the processing of personal data to send advertising or direct sales material or for carrying out market research or commercial communication, using automated call systems without the intervention of an operator by email and/or by traditional means of communication by telephone and/or paper mail;
• lodge a complaint with the Supervisory Authority for the Protection of Personal Data.

In the above cases, the Data Controller will inform the third parties to whom your personal data is communicated of the possible exercise of your rights, except for specific cases (e.g. when such fulfilment proves impossible or implies the use of means that are manifestly disproportionate to the protected right).

9. How to exercise rights

You may exercise these rights at any time:

• by sending a registered letter with return receipt to the Controller;
• by sending an email to sld@studiolegaledonvito.it
• by calling the number +39.02.76000107

10. Data Controller and Processor

The Data Controller is: Adv. Antonio Donvito

Milan, 25 May 2018