privacy policy

1. Data Controllers

The Data Controllers are Avv. Stefano Bonacina, and Avv. Paola Bussini (the ‘Data Controllers’), with offices in Milan, via Savarè 1, tel./Fax +39 02..99202030, e-mail: info@bb-lex.it. The updated list of any data processors is available at the Data Controllers' offices.

2. Place and methods of data processing

The processing operations connected to the web services of this website, as well as the processing operations that are carried out by BB Lex - Bonacina Bussini - Studio Legale Associato in any other capacity pursuant to this information notice, take place at the Data Controllers‘ offices and are carried out by internal technical personnel, duly appointed, in writing, as Data Processors, pursuant to the GDPR, and/or by personnel external to the Data Controllers’ organisation, subject to appropriate appointment, again in writing, as Data Processor, pursuant to art. 28 of the GDPR.

All personal data are processed both in paper format and, predominantly, electronically. The same will be stored in a form that allows the user to be identified only for the time strictly necessary to achieve the purposes for which the data were originally collected and, in any case, within the limits of the law. Specific security measures are observed to prevent data loss, unlawful or incorrect use and unauthorised access, in compliance with the GDPR.

3. Purpose of processing

Personal data are processed by the Data Controllers for the following purposes:

a) within the limits and for the sole purposes of providing the services accessible through the Site, as well as to allow users to learn about and explore the activities carried out by the Data Controllers;

b) to manage and process, in relation to what is indicated in the preceding point, requests and enquiries for interactions with the Law Firm, its professionals and the subjects referable to the organisation of the Holders; and

c) offer a jurisprudential update, through the contributions proposed by the Law Firm;

The performance of the activities under letters a), b) and c) listed above does not require the consent of the Data Subject, since these are services or performances performed, in most cases, in execution of requests made directly by the Data Subject pursuant to Art. 6, c. 1..

4. Provision of data and consequences in the event of failure to provide data

The provision of personal data for the above purposes is optional and failure to provide such data will have the sole consequence of making it impossible for the Data Controller to manage and process the requests of the data subject or to send the above-mentioned communications.

5. Types of data processed

i. Navigation data

Computer systems and software procedures used to operate this Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.

This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning and is deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the Site.

This category also includes data processed through the use of cookies. To this end, please refer to the Cookie Policy available on the Law Firm's website: www.bb-lex.it/

ii. Data provided voluntarily by the user or collected from third parties

The optional, explicit and voluntary sending of an e-mail address as well as of the relevant message to the addresses indicated on the Website entails the subsequent acquisition of the sender's address and of any other personal data entered, necessary to reply to requests.

Specific summary information may be reported or displayed, from time to time and where strictly necessary, on the pages of the Site set up for particular services on request.

In addition to the foregoing, any further personal data (such as, for example, personal data, data relating to professional activity, job title and/or company role, contact data such as company and/or personal telephone number, e-mail address) provided to the Data Controllers or otherwise collected by the Data Controllers from third parties, shall be processed by the Data Controllers in accordance with this notice and within the limits set by the GDPR.

6. Recipients and Categories of Recipients

No data will be disclosed or transferred to third parties without the consent of the Data Subject. Should communication to third party suppliers or partners of the Law Firm be necessary for organisational, administrative or support needs of the services provided, it shall be the responsibility of the Data Controllers to appoint them as data processors pursuant to the GDPR.

It is understood that the personal data of the Data Subjects may be freely disclosed to third parties, such as the police, whenever this is permitted by law or required by an order or provision of a competent authority.

7. Retention period

Personal data will be kept for the time strictly necessary to achieve the purposes for which they are collected and processed. Once the purpose of the processing has been fulfilled, or in case of exercise of the right to object to the processing or to revoke the consent given, Data Controllers will still be entitled to further retain personal data in whole or in part, for the purposes allowed by the GDPR (such as the need to assert a right in court). As a general rule, personal data will be retained for 2 years from their registration, i.e. 12 months for profiling purposes, subject to the legitimate interest of the Data Controllers under the GDPR, as well as any longer period that may be provided for in the future in cases from time to time governed by applicable law or the relevant authorities.

8. Links to other websites

The Data Controllers do not control nor have any way of supervising either the content or the personal data processing policies of third party websites and services accessible through links contained within the Site. Therefore, BB Lex - Bonacina Bussini - Studio Legale Associato shall in no case be held liable for any processing carried out through or in relation to such third party websites.

Users are therefore invited to pay the utmost attention in this respect, by reading the conditions of use and privacy policies published on the portals visited.

9. Rights of data subjects

9.1 Rights of access, deletion, restriction and portability

Data subjects are granted the rights set out in Articles 15 to 20 of the GDPR. By way of example, each data subject may:

(a) obtain confirmation as to whether or not personal data concerning him or her is being processed;

(b) if a processing is taking place, obtain access to the personal data and information relating to the processing as well as request a copy of the personal data

(c) obtain the rectification of inaccurate personal data and the integration of incomplete personal data

(d) obtain, if one of the conditions provided for in Article 17 of the GDPR applies, the deletion of personal data concerning him/her

(e) obtain, in the cases provided for in Article 18 of the GDPR, the restriction of processing;

(f) receive the personal data concerning him/her in a structured, commonly used and machine-readable format and request their transmission to another controller, if technically feasible.

9.2 Right to object

Each data subject has the right to object at any time to the processing of his or her personal data carried out in pursuit of a legitimate interest of the Data Controllers. In the event of an objection, his or her personal data shall no longer be processed, unless there are legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

9.3 Right of withdrawal of consent

9.4 Opt-out

Where consent is required for the processing of personal data, any data subject may, at any time, withdraw consent already given, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal. Consent may be revoked by sending an email to info@bb-lex.it.

With reference to the processing of personal data for the purpose referred to in Art. 3 letter e), Data Controllers may not require the consent of the data subject, provided that the latter is adequately informed and does not refuse such use, either initially or on the occasion of subsequent communications. The data subject shall be informed, at the time of collection and on the occasion of the sending of any communication made for the purposes referred to in this paragraph, of the possibility to object to the processing at any time, easily and free of charge.

9.5 Right to lodge a complaint with the Data Protection Authority

In addition, each data subject may lodge a complaint with the Data Protection Authority if he or she considers that his or her rights under the GDPR have been infringed, in accordance with the procedures indicated on the Authority's website accessible at: www.garanteprivacy.it.

10. Updates

This Privacy Policy will be subject to updates. The Data Controllers therefore invite Data Subjects who wish to know how their personal data is processed to periodically visit this page.