In compliance with EU Regulation 2016/679 (European Regulation on the protection of personal data, hereinafter also referred to as GDPR), we provide you with the necessary information regarding the processing of your personal data. Please note that this notice does not apply to other websites that may be accessed via links on this website.
DATA CONTROLLER The Data Controller is Attorney Carlo Pontei, located at Via San Raffaele 1, 20121 Milan (MI) - Contact: This email address is being protected from spambots. You need JavaScript enabled to view it..
PERSONAL DATA SUBJECT TO PROCESSING
Common data (personal details, address, and contact information).
The personal data provided will be processed, in compliance with the conditions of lawfulness, for the following purposes:
- Contact request, including the sending of information requested by you (including quotations);
- Informative activities related to the provision of services and/or consultancy requested by you;
- Completion of data collection forms in dedicated areas, including the submission of CVs;
- Website registration;
- Administrative and accounting activities (e.g., payment processing and invoicing);
- Website maintenance.
The legal basis for the processing is found in Article 6.1 (b) of the GDPR (fulfillment of contractual or pre-contractual obligations). Specifically concerning administrative and accounting activities, processing is necessary to comply with a legal obligation to which the Data Controller is subject.
Finally, regarding the technical maintenance of the website, the legal basis is the legitimate interest of the Data Controller (security, organization, and protection of private economic initiative pursuant to Article 41 of the Constitution).
For purposes from no. 1 to no. 4, the provision of data is optional, but failure to provide it would make it impossible to respond to the requests made. For purpose no. 5, the provision of data is mandatory, as required by law. For purpose no. 6, no data provision is required, but processing may still occur during system or website maintenance.
SPECIAL CATEGORIES OF PERSONAL DATA
The Data Controller does not allow the data subject to transmit, using the designated section of the website or the contact channels indicated therein, personal data falling within the special categories of personal data referred to in Article 9 of the GDPR, namely: “[…] data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health or a person’s sex life or sexual orientation.”
If the data subject nonetheless provides such data, they must explicitly consent to the processing of special categories of personal data at the bottom of the request.
It should be noted that if special categories of personal data are transmitted but no explicit consent for their processing is given, the Data Controller—who expressly advises against sharing such information—cannot be held responsible in any way, nor can any claims be made against them, as in such a case, processing will be allowed based on data manifestly made public by the data subject, in accordance with Article 9, paragraph 1, letter e) of the GDPR.
RECIPIENTS OR CATEGORIES OF DATA RECIPIENTS
The personal data provided will be communicated to entities that will process the data as Data Processors (Article 28 GDPR) and/or as individuals acting under the authority of the Data Controller and the Data Processor (Article 29 GDPR) or as independent Data Controllers.
Specifically, data will be communicated to:
- Freelancers, firms, or companies in the context of assistance and consultancy relationships;
- Entities providing services for the management of the information system used by the Data Controller, including email, newsletters, and website management;
- Competent authorities for compliance with legal obligations and/or requirements of public bodies, upon request.
The list of Data Processors is constantly updated and available from the Data Controller.
DATA RETENTION PERIOD OR CRITERIA FOR DETERMINING THE PERIOD
Processing will be carried out in both automated and manual form, using methods and tools designed to ensure maximum security and confidentiality, by personnel specifically appointed for this purpose. In compliance with Article 5, paragraph 1, letter e) of the GDPR, the personal data collected will be retained in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed. An annual review is planned for this purpose.
RIGHTS OF DATA SUBJECTS
The data subject may exercise their rights as expressed in the GDPR by contacting the Data Controller via email. Specifically, they have the right, at any time, to request from the Data Controller access to their personal data (Article 15), rectification (Article 16) or erasure (Article 17), or restriction of processing (Article 18) or to object to its processing.
If processing is based on consent, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. They also have the right to lodge a complaint with the Supervisory Authority.
NOTES
The transfer of data outside the EU is not planned. However, should it become necessary, the measures and precautions provided for by the GDPR will be adopted, and such transfer will take place in compliance with the GDPR.
No automated decision-making processes or profiling activities are foreseen.
RESPONSIBILITY
Since the Data Controller is not the website owner, it should be noted that TOUCH SOLUTION SRL (the website owner) may be engaged by the Data Controller to carry out interventions aimed at resolving technical issues related to the website. In such cases—and only in relation to this specific aspect—Touch Solution may occasionally and incidentally have access to personal data, which it commits not to store or process in any way. In this case, Touch Solution and the Law Firm will act as joint Data Controllers.
In the event of a security incident or requests from data subjects, the Parties agree that responsibility, subsequent obligations, and charges will remain entirely with the Law Firm, as better specified in the "Data Controller" section above.
