Dear User,

The lawyers Francesca Sani, Francesca Baroncelli Poggi, Camilla Amunni, Eleonora Verdelli, and Silvia Papalini, with their office in Florence (FI), Piazza Franco Nannotti n. 11, tel. 055 0469320, act as data controllers (hereinafter “Data Controller(s)”) and protect the personal data provided by Data Subjects during the navigation and use of the web page https://www.milanolegale.com/, ensuring its confidentiality and guaranteeing compliance with the regulations in force, as well as the necessary level of protection, from any event that could put it at risk of violation.

As required by Art. 13 of the General Data Protection Regulation of the European Union (GDPR), before proceeding with the processing, the user of the aforementioned web page (hereinafter also “Data Subject”) is informed that their personal data, collected through the website, are processed by the Data Controller as specified above, through IT and/or telematic tools, for the purposes indicated below in this policy.

For any questions regarding the processing of personal data, you can contact the Data Controllers by writing to info@firenzelegale.it

1. Type of personal data processed

The following personal data of the Data Subject will be processed:

  1. name, surname, e-mail address, telephone number, information contained in the request sent by the Data Subject.

2. Purposes and legal basis of the processing

Personal data will be processed for the following purposes:

  1. to be contacted by the Controller in case of a request for online consultation, appointments, quotes or training courses by filling out the contact form or by sending the request to the contact details on the site.

The legal basis for the processing referred to in letter a) of this point is:

Art. 6 par. 1 lett. b) GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.

3. Processing Methods

The personal data being processed are collected directly by the Data Controller or by third parties expressly authorized by them, or communicated by the Data Controller to such third parties appointed as data processors for the pursuit of the purposes referred to in point 2.

The processing of personal data will be carried out mainly with the aid of IT tools by the Data Controller or by external subjects specifically appointed as data processors for this purpose, in compliance with the provisions of the GDPR.

The Data Controller periodically carries out checks to ensure that personal data that is not necessary for the processing and its related purposes as indicated in point 2 of this policy is not processed, collected, stored or kept.

The Data Controller does not adopt automated decisions likely to influence the Data Subject. All decision-making processes associated with the processing purposes described above are carried out with human intervention.

4. Recipients of personal data

The personal data processed for the purposes referred to in point 2 of this policy may be communicated:

  • to internal subjects of the Controller, duly authorized for the parts of the processing of their respective competence;
  • to external subjects such as:
    • providers of IT infrastructure and solutions;
    • web service providers;
    • consultants and/or suppliers and/or other professionals, to the extent necessary to carry out their assignment;
    • Public authorities, for any legal obligations and/or requests from the authority.

The communication concerns the categories of personal data whose transmission to the aforementioned third parties is necessary for the performance of the activities and for the purposes referred to in point 2 of this policy. The updated list of External Processors is kept at the headquarters of the Data Controller and can be requested by the Data Subject.

For the processing carried out for the purpose referred to in point 2 letter a), the consent of the Data Subject is not required.

In no case will personal data be communicated to other categories of third parties (in addition to those mentioned above) and will not be subject to dissemination operations.

5. Transfer outside the EU/EEA

The Data Controller does not transfer the Data Subject’s personal data abroad (abroad meaning all countries not belonging to the European Economic Area).

In some cases, personal data may be processed abroad and the transfer will take place on the basis of the principles and conditions set out in Chapter V of the GDPR, as well as on the basis of adequate security guarantees.

6. Retention period/Data Retention

Personal data will be processed by the Data Controller for the entire duration of the relationship with the same and for the time necessary to achieve the purposes for which they were collected as per point 2 letter a) of this policy.

Upon reaching the aforementioned terms, the Data Controller will delete the data concerning you.

Longer retention periods may be applied in the presence of specific legal obligations or if requests are received by the Data Controller from public authorities or for further needs to protect the rights of the Data Controller or the Data Subject.

7. Rights of the Data Subject

Pursuant to EU Reg. 2016/679, the Data Subject has the right to:

  • obtain confirmation of the processing carried out by the Data Controller on personal data concerning them;
  • access their personal data and know its origin (when the data is not obtained directly from the Data Subject), the purposes of the processing, the data of the subjects to whom it is communicated (recipients), the data retention period or, failing that, the useful criteria for determining it;
  • obtain the rectification of their personal data;
  • obtain the cancellation of their personal data from the Data Controller’s databases if they are no longer necessary for the purposes for which they were collected or if the processing is unlawful and in the other cases referred to in Art. 17 GDPR;
  • limit the processing of their personal data, for example, where its accuracy is contested, for the period necessary for the Data Controller to verify its accuracy and in all other cases referred to in Art. 18 GDPR;
  • obtain their personal data in electronic format, also in order to be able to communicate it to another Data Controller (portability).

The Data Subject may assert their rights by contacting the Data Controller by written communication sent to the address info@firenzelegale.it

The Data Controller must proceed in this sense without delay and, in any case, no later than one month from receipt of the request. The term can be extended by two months, and in this case the Data Controller will, always within thirty days, inform the Data Subject about the reasons that make the extension necessary.

8. Complaint

The Data Subject has the right to lodge a complaint with the Personal Data Protection Authority.

In the event that the Data Subject resides in a different member state or the violation of the data protection legislation occurs in another EU country with respect to the one where the Data Controller is based, the Data Subject must lodge a complaint with the Authority responsible for supervising compliance with the legislation on the protection of personal data of the aforementioned country.

The lodging of the complaint is without prejudice to the possibility for the Data Subject to bring any other legal action.

9. Provision of data and consequences

The provision of personal data is optional, however if the Data Subject does not provide the personal data concerning them, the Data Controller will not be able to carry out the processing activities for the purposes referred to in point 2 of this policy.