Privacy Policy

Privacy Policy regarding the Processing of Personal Data
(pursuant to Art. 13 of Regulation (EU) 2016/679 and Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018)

Dear Sir/Madam,

We wish to inform you that Regulation (EU) 2016/679 (“European Regulation on the protection of personal data”, hereinafter “GDPR”) provides for the protection of natural persons with regard to the processing of personal data.
According to the aforementioned legislation, such processing shall be based on the principles of correctness, lawfulness, transparency, and the protection of your privacy and your rights.
Pursuant to Article 13 of the GDPR and current national legislation, in relation to the personal data that Studio Legale Sperti (hereinafter also the “Firm”) will come into possession of for the assignment of professional mandates or through the consultation of the website www.studiolegalesperti.it, we provide you with the following information:

1. Data Controller

The Data Controller is Attorney Isidoro Sperti, with offices in Rome, Via Antonio Allegri da Correggio no. 1.
Contacts: Telephone +39 0636001459; Email: studiolegalesperti@gmail.com.

2. Purposes of Data Processing

Your personal data will be processed for the following purposes:

  • a) Execution of the professional mandate: For purposes strictly connected and instrumental to the performance of the professional mandates entrusted to the Firm (legal advice and assistance, both judicial and extrajudicial), in accordance with the purpose for which the mandate was granted.

  • b) Compliance with legal obligations: To comply with the obligations incumbent upon the Firm and provided for by current legislation, including those in tax and accounting matters, as well as in matters of anti-money laundering (Legislative Decree no. 231/2007 and subsequent amendments).

  • c) Sending informative communications (subject to consent): Exclusively upon your specific and separate consent, to send you newsletters of legal and tax content or information relating to activities and initiatives carried out by the Firm (e.g., conferences, publications, regulatory updates).

  • d) Further processing: Should the Data Controller intend to further process personal data for a purpose other than that for which they were collected, prior to such further processing, the Controller will provide you with information regarding this different purpose and any other relevant information.

3. Legal Basis for Processing

Pursuant to Art. 6 of the GDPR, the processing of your personal data is based on:

  • For the purposes referred to in point 2.a): the necessity to perform the professional mandate contract to which you are a party.

  • For the purposes referred to in point 2.b): the necessity to comply with a legal obligation to which the Data Controller is subject.

  • For the purposes referred to in point 2.c): your free, specific, informed, and unambiguous consent.

4. Methods and Retention Period of Data Processing

  • a) Methods: The processing of your personal data will take place in compliance with the provisions of the GDPR, using paper, computer, and electronic tools, with logic strictly related to the indicated purposes and, in any case, in a manner suitable to guarantee their security and confidentiality, in accordance with the provisions of Art. 32 of the GDPR. Processing is carried out by the Controller, by any duly appointed Data Processors, and by persons authorized to process data under the direct authority of the Controller.

  • b) Retention Period:

    • Data processed for the purposes referred to in points 2.a) and 2.b) will be stored for the entire duration of the professional mandate and, subsequently, for the time imposed by legal and tax retention obligations (ordinarily 10 years from the conclusion of the mandate or the last relevant entry) or to assert or defend a right in court.

    • Data processed for the purpose referred to in point 2.c) (newsletter) will be kept until the revocation of your consent or until your request for deletion, and in any case for a period not exceeding [e.g., 24/48 months] from the last contact or expression of interest, unless otherwise indicated by you or upon renewal of consent.

5. Nature of Data Provision and Consequences of Refusal

  • The provision of personal data for the purposes referred to in points 2.a) and 2.b) is mandatory as it is strictly necessary for the performance of the professional mandate and the fulfillment of legal obligations. Any refusal will result in the impossibility of establishing or continuing the professional relationship.

  • The provision of data for the purpose referred to in point 2.c) (newsletter) is optional and the lack of consent will in no way affect the performance of the professional mandate.

6. Communication and Dissemination of Data

  • a) Communication: Your personal data may be communicated, for the purposes referred to in point 2, to: external collaborators of the Firm (e.g., co-counsel, technical consultants), entities operating in the judicial sector (e.g., court registries, bailiffs), opposing parties and their counsel, public bodies, tax consultants or other professionals for the fulfillment of legal obligations or for the execution of the mandate, boards of arbitrators, mediation bodies, and, in general, to all those subjects to whom communication is necessary for the correct fulfillment of the indicated purposes. Furthermore, they may be communicated, if the conditions are met, to the competent authorities regarding anti-money laundering legislation and other supervisory and control bodies. For the purpose of newsletters (2.c), data may be communicated to service providers for the management and sending of mailing lists (appointed as Data Processors, where applicable).

  • b) Dissemination: Your personal data are not subject to indiscriminate dissemination.

7. Transfer of Personal Data Abroad

For the purposes indicated above, your personal data may be transferred outside the territory of the European Union only if strictly necessary for the execution of the mandate or for the use of technological services (e.g., cloud, mailing list providers), and in any case in full compliance with the conditions set out in Chapter V of the GDPR (e.g., towards third countries for which an adequacy decision of the European Commission exists, or upon adoption of adequate guarantees such as Standard Contractual Clauses, or other conditions provided for by the GDPR). All necessary measures will be adopted to ensure that the level of protection for natural persons guaranteed by the GDPR is not undermined.

8. Rights of the Data Subject

As a data subject, you have the right to exercise, against the Data Controller and under the conditions provided for by the GDPR (Articles 15-22), the following rights:

  • Right of access: Obtain confirmation as to whether or not personal data concerning you are being processed and, if so, access your data and specific information (purposes, categories of data, recipients, retention period, etc.).

  • Right to rectification: Obtain the rectification of inaccurate personal data or the integration of incomplete ones.

  • Right to erasure (right to be forgotten): Obtain the erasure of personal data concerning you in the cases provided for by law (e.g., data no longer necessary, withdrawal of consent if it is the only legal basis, unlawful processing).

  • Right to restriction of processing: Obtain the restriction of processing in the cases provided (e.g., contesting the accuracy of the data, unlawful processing with opposition to erasure).

  • Right to data portability: Receive the personal data concerning you provided to the Controller in a structured, commonly used, and machine-readable format, and transmit them to another controller, provided the processing is based on consent or a contract and is carried out by automated means (within the limits provided).

  • Right to object: Object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the legitimate interest of the controller or the performance of a task carried out in the public interest, including profiling. Object at any time to processing for direct marketing purposes (if carried out).

  • Right to withdraw consent: For processing based on consent (such as the newsletter purpose 2.c), you have the right to withdraw the consent given at any time, with the same ease with which it was granted, without affecting the lawfulness of processing based on consent before its withdrawal.

The exercise of your rights is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, the Controller may charge you a reasonable fee or refuse to act on the request.
To exercise your rights, you may contact the Data Controller at the contact details indicated in point 1.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Supervisory Authority for the protection of personal data (Garante per la protezione dei dati personali, Piazza Venezia no. 11 – 00187 Rome; Email: garante@gpdp.it; PEC: protocollo@pec.gpdp.it; Switchboard: +39 06.69677.1).

10. Changes to This Policy

The Data Controller reserves the right to make changes to this policy at any time, giving notice to users on this page. Please therefore consult this page periodically, referring to the date of last modification indicated at the top of the document.