| INFORMATION AND CONTACT DETAILS OF THE DATA CONTROLLER Art. 13, paragraph 1, letter a) EU Reg. 2016/679 | |
| Data Controller | Studio Legale Associato Ambrosio & Commodo, Via Bertola 2, 10121 Turin, VAT ID 02895500011 |
| Data Controller Contact Details | Email: info@ambrosioecommodo.it |
| Studio Legale Associato Ambrosio & Commodo, Via Bertola 2, 10121 Turin, VAT ID 02895500011, as the Controller of your personal data (hereinafter also referred to as the “Data Controller”), hereby informs you, pursuant to Articles 12 and 13 of EU Regulation 2016/679 (General Data Protection Regulation, hereinafter referred to for brevity as the “GDPR”), that your personal data will be processed by specifically authorized personnel, strictly limited to the purposes and methods specified below. | |
| SUBJECT AND PURPOSE OF PROCESSING |
Studio Legale Associato Ambrosio & Commodo (hereinafter, for brevity, “Studio A&C”) hereby informs you that it will specifically process your standard personal details, namely first and last name, email address, telephone number, identification numbers, and IP addresses or domain names, in accordance with the purposes and methods defined and specified below.
The personal data of Website Users, as described above, will be processed according to the methods and forms established by the GDPR, in order to perform the functions specific to this Website.
In particular, the personal data provided to the Data Controller will be processed to pursue the following purposes:
- to follow up on specific requests addressed to the Data Controller by the User through the Website and its communication tools, and specifically through the “Contact Us” or “How to Join” features, in response to requests for information via email and other communication channels. Certain information provided by the user may fall under special categories of data pursuant to Article 9 of the GDPR.
- to receive informational communications regarding the status of the injunctive relief action and any further legal actions that will be undertaken.
This privacy policy applies solely to this web portal and does not extend to other or different portals or websites that may be accessed via links contained herein, for which the Data Controller is in no way responsible. The processing of data provided in a generic manner will be carried out—including following automatic collection during navigation—solely for the purposes of verifying and/or monitoring access to the Website and/or strictly to enhance its functionality, ensuring an optimal browsing experience. IP addresses, domain names, and all user browsing data will be used by the Data Controller’s website for statistical or marketing purposes only where consent has been expressly provided via the dedicated cookie banner provided by CookieYes.
| LEGAL BASIS FOR PROCESSING |
Apart from what is specified for browsing data, the communication of the aforementioned personal data to the Data Controller relies on the following legal basis:
- Article 6, paragraph 1, letter a) of the GDPR, concerning your express, freely given, specific, informed, and unambiguous—as well as revocable—consent, for the purposes set forth above.
- Article 9, paragraph 2, letter a) of the GDPR, concerning your express, freely given, specific, and informed consent for the purposes set forth under letter a), exclusively whenever such data are provided.
The provision of your personal data is therefore necessary for the full execution of the purposes outlined in points a) and b); consequently, any refusal to provide such data may make it impossible to carry out the aforementioned services and Website functions. In any case, any consent you may have given may be revoked at any time, resulting in the immediate cessation of the referenced activities and services.
| PROCESSING METHODS |
The Processing of personal data provided by you is carried out by means of the operations indicated in Article 4, no. 2) of the GDPR, namely: “collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of data”.
The personal data you provide are subjected to automated processing for the time strictly necessary to achieve the purposes for which they were collected, using technical and organizational measures implemented to prevent data loss, unlawful and/or improper use, and unauthorized access, thereby ensuring a level of security appropriate to the risk pursuant to Article 32 of the GDPR. This is conducted by specifically authorized individuals, in compliance with Article 29 of the GDPR, or by employees and/or collaborators of the Data Controller acting as authorized personnel and/or system administrators, who may perform consultation, use, processing, alignment, and any other appropriate operations in compliance with legal provisions necessary to ensure, among other things, the confidentiality and security of data, as well as data accuracy, currency, and relevance in relation to the stated purposes and methods.
It is specified, in particular, that the personal data you provide will be processed only at the registered office of the Data Controller, except as detailed below. They will therefore not be disseminated, and pursuant to Article 13, paragraph 1, letter (e), they may only be processed by authorized personnel and/or any external data processors pursuant to Article 28 of the GDPR (whether individual professionals and/or multi-member professional practices), and/or by entities acting as autonomous data controllers, the list of which is available at the Data Controller’s headquarters and will be provided upon the data subject's written request. These explicitly include hosting providers and/or technical personnel tasked with managing and/or maintaining the website, exclusively and strictly for the purposes expressly specified above.
| SCOPE OF DATA COMMUNICATION |
In connection with the purposes set forth above, data may be communicated to the following entities and/or categories of entities, or may be communicated to companies and/or individuals providing services, including third-party services, on behalf of the Data Controller.
These include, by way of non-exhaustive example for greater clarity: professionals and consultants, including those operating in associated form; providers of IT system and telecommunications network management services (including email and web portal/website administration – cloud storage services – hosting); competent authorities and/or Supervisory Bodies for the fulfillment of legal obligations; and entities conducting audit, oversight, and certification of the activities carried out by the Data Controller, operating either as external data processors under Article 28 of the GDPR or in total autonomy as entities independent of the Data Controller.
This Website does not share any collected data with services located outside Italy and the European Union area.
| DATA RETENTION PERIOD |
Please note that, in compliance with the principles of lawfulness, purpose limitation, storage limitation, and data minimization under Article 5 of the GDPR, the retention period for your personal data is set for a duration no longer than is necessary to achieve the purposes for which they are collected and processed, or for the duration required to fulfill the aforementioned purposes. Consequently, once the purposes of processing have been exhausted, your data will be erased from all physical and electronic media.
| AUTOMATED DECISION-MAKING AND PROFILING |
The Data Controller informs you that, for the purposes of processing your personal data, it does not utilize automated decision-making processes—that is, processes aimed at making decisions based solely on technological means according to predetermined criteria (i.e., without human intervention)—nor does it perform profiling activities, namely using your personal data to analyze or predict aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements, etc.
| DATA SUBJECT RIGHTS |
Right of Access under Art. 15 GDPR and Right of Rectification under Art. 16 GDPR
As a data subject, under Article 15 of the GDPR, you have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed, to obtain access to the same and to all information specified in Article 15, paragraph 1, letters (a) through (h), through the provision of a copy of the processed data in a structured, commonly used, machine-readable, and interoperable format.
Pursuant to Article 16 of the GDPR, you also have the right to obtain from the Data Controller the rectification and/or completion of the processed data should they be outdated, inaccurate, or incomplete.
Right to Erasure under Art. 17 GDPR and Right to Restriction of Processing under Art. 18 GDPR
As a data subject, you have the right to obtain from the Data Controller, without undue delay, strictly under the conditions set forth in Article 17, paragraph 1, letters (a) through (f) of the GDPR, the erasure of data concerning you—with the exception of the circumstances specifically provided for by Article 17, paragraph 3.
As a data subject, under Article 18, paragraph 1, letters (a) through (d) of the GDPR, you have the right to request and obtain from the Data Controller the restriction of processing of your personal data, meaning that such data will not be subject to further processing operations and can no longer be modified. The Data Controller ensures that the restriction of processing is implemented via appropriate technical safeguards that guarantee inaccessibility and immutability.
Right to Data Portability under Art. 20 GDPR
As a data subject, you have the right, under Article 20 of the GDPR, to receive from the Data Controller the personal data concerning you that is processed by automated means, in a structured, commonly used, and machine-readable format, and you also have the right to transmit those data to another data controller, or to obtain from the Data Controller, where technically feasible, the direct transmission of such data to another specifically identified data controller.
Right to Object to Processing under Art. 21 GDPR
You have the right to object at any time to the processing of personal data concerning you, on grounds relating to your particular situation, in cases where the processing of your data is necessary (1) for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller; (2) for the purposes of the legitimate interests pursued by the Data Controller or by a third party; (3) for profiling activities carried out by the Data Controller based on the preceding grounds.
You also have the right to object to the processing of your personal data on grounds relating to your particular situation where they are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89, paragraph 1 of the GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Procedures for Exercising the Above Rights
You may exercise the rights listed above by submitting a request to the email address privacy@ambrosioecommodo.it.
The Data Controller will confirm receipt of your request and provide you with information regarding the action taken concerning the exercise of your rights under Articles 15 to 22 of the GDPR within one (1) month of receiving the request. If necessary, taking into account the complexity and number of requests, the Data Controller may extend this period by two (2) months, subject to reasoned notice provided within one (1) month of receiving the request.
The Data Controller will communicate any rectification, erasure, or restriction of processing to each recipient, as identified in Article 4, paragraph 1, point 9 of the GDPR, to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort.
Following the submission of your request for rectification, erasure, restriction, or objection, should the Data Controller entertain reasonable doubts concerning your identity, it will request additional information to confirm it. Such communications will be sent via email from privacy@ambrosioecommodo.it.
Should the Data Controller fail to take action on your request within one (1) month of receipt, it will inform you of the reasons for inaction, advising you of your right to lodge a complaint with a Supervisory Authority (the Italian Data Protection Authority – Garante per la protezione dei dati personali), as specified under Article 13, paragraph 2, letter (d) and governed by Articles 77 et seq. of the GDPR.