PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA (Articles 13 and 14 of Regulation (EU) 2016/679 – GDPR)
Introduction
Serena Mattei, Attorney-at-Law, whose law office is located at Palazzo Grazioli, Via del Plebiscito 102, Rome, in her capacity as Data Controller, provides this notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018, to explain how data subjects’ personal data are collected, used, managed, stored and erased, and to describe the technical and organisational measures adopted to protect them.
Personal data are processed in full compliance with the principles of lawfulness, fairness, transparency and security set out in Articles 5 and 6 of Regulation (EU) 2016/679 (GDPR), ensuring that data subjects’ fundamental rights and freedoms are protected at every stage.
This notice applies solely to the website matteilawyers.com, owned by Serena Mattei, Attorney-at-Law, and does not cover any other websites that the User (hereinafter also referred to as the “user” or “data subject”) may access through hyperlinks.
Data Controller
The Data Controller (Article 4(7) of Regulation (EU) 2016/679) is Serena Mattei, Attorney-at-Law, whose law office is located at Palazzo Grazioli, Via del Plebiscito 102, Rome. She can be contacted by ordinary email at the following address:
- e-mail: info@matteilawyers.com
Legal basis for processing
1. The legal basis for processing relates to the legal services provided by Serena Mattei, Attorney-at-Law, or to activities connected with her professional practice, as well as to the use and browsing of the Website by visitors and users who consent to the processing of their personal data.
2. Personal data are processed on the basis of the data subject’s consent pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR) and, in relation to special categories of personal data, pursuant to Article 9(2)(a) of that Regulation.
3. Serena Mattei, Attorney-at-Law, promotes data subjects’ awareness and understanding of the risks, rules, safeguards and rights associated with processing. She also promotes awareness, both in her capacity as Data Controller and among data processors, of the obligations imposed on them by the Regulation (Article 57(1)(b) and (d) of Regulation (EU) 2016/679).
Purposes of processing
Serena Mattei, Attorney-at-Law, may process the personal data provided by the user (first name, surname, email address and telephone number), after obtaining specific consent expressed by submitting the acceptance form, in order to send information about the Firm’s activities, news and services (Article 4(11) of Regulation (EU) 2016/679).
The user may unsubscribe at any time (Article 17 of Regulation (EU) 2016/679).
Providing personal data is optional. However, refusal to provide the data or give consent may prevent Serena Mattei, Attorney-at-Law, from processing the newsletter subscription request.
Collection of personal data
Serena Mattei, Attorney-at-Law, will collect users’ personal data for purposes connected with the provision of her services, as specified in this Privacy Policy.
When requesting contact and/or subscribing to the newsletter, the user will be asked to provide the following information: first name and surname (required field), email address (required field), and other optional information.
Users’ personal data will be retained only for as long as necessary to provide the requested services and fulfil the purposes indicated above.
Types of data processed
Browsing data
During their normal operation, the IT systems and software procedures used to operate this website collect certain personal data whose transmission is inherent in the use of Internet communication protocols.
This category of data includes the IP addresses or domain names of the computers and devices used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file returned in response, the numerical code indicating the status of the server’s response (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment. These data, which are necessary to use the web services, are also processed in order to:
- obtain statistical information on the use of the services (most visited pages, number of visitors by time slot or day, geographical areas of origin);
- check that the services offered are functioning correctly.
Browsing data are retained for no longer than seven days, unless the judicial authorities need them for the investigation of criminal offences.
Data provided by the data subject
The optional, explicit and voluntary sending of messages to the contact addresses indicated on the website, as well as private messages sent to social media profiles, entails the collection of the sender’s contact details, which are necessary to provide a response, and any additional personal data included in the communications.
Cookies and other tracking systems
The Law Firm’s website uses non-persistent technical session cookies that are strictly necessary to ensure secure and efficient browsing. Subject to the user’s prior consent, it may also use profiling cookies, including third-party cookies, to analyse preferences and offer personalised content or communications. Users may manage or withdraw their consent at any time through the dedicated cookie settings panel. The storage of session cookies on devices or in browsers is under the user’s control. On the servers, however, information relating to cookies remains recorded in the service logs after HTTP sessions end, with retention periods of no more than seven days, as with other browsing data.
Data subject’s consent
The data subject gives consent through a freely given, specific, informed and unambiguous indication of their wishes, by a statement or clear affirmative action, signifying agreement to the processing of their personal data.
The data subject has the right to withdraw consent at any time (Article 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn, but may make it impossible to provide the requested services where consent is a necessary condition for processing. Before giving consent, the data subject receives all the necessary information. In accordance with applicable legislation, the data subject may express consent through specific settings in browsers, software or devices that are clear and easy to use (Articles 4(7) and (11), and 7 of Regulation (EU) 2016/679).
Data subject’s rights
The data subject is entitled to exercise the following rights with the Data Controller:
I. Right of access
The data subject has the right to obtain confirmation as to whether personal data concerning them are being processed (Article 15 GDPR) and, where that is the case, access to those personal data and the following information:
- the purposes of processing;
- the categories of personal data processed;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly recipients in third countries or international organisations;
- where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
- the existence of the right to request rectification, erasure or restriction of processing, or to object to processing;
- the right to lodge a complaint with a supervisory authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali);
- where the data are not collected from the data subject, any available information about their source;
- the existence of automated decision-making, including profiling (Article 22 GDPR).
II. Right to rectification
The data subject has the right to obtain the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of processing, they also have the right to have incomplete personal data completed, including by providing a supplementary statement (Article 16 GDPR).
III. Right to erasure (“right to be forgotten”)
The data subject has the right to obtain the erasure of personal data concerning them without undue delay in the cases provided for by the Regulation (Article 17 GDPR).
IV. Right to restriction of processing
The data subject has the right to obtain restriction of processing in the cases provided for by the Regulation, including where the accuracy of the data is contested or the processing is unlawful (Article 18 GDPR).
V. Right to data portability
The data subject has the right to receive personal data concerning them in a structured, commonly used and machine-readable format and to transmit those data to another data controller, where technically feasible (Article 20 GDPR).
VI. Right to object
The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, including profiling (Article 21 GDPR).
VII. Right not to be subject to a decision based solely on automated processing, including profiling (Article 22 GDPR).
The data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or significantly affects them.
Data subjects may submit requests to exercise their rights by email to: info@matteilawyers.com.
VIII. Right to lodge a complaint
To exercise their rights, or for any questions or requests concerning the processing of their personal data by Serena Mattei, Attorney-at-Law, data subjects may contact the Data Controller at: info@matteilawyers.com.
The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Article 77 of Regulation (EU) 2016/679) or seek a judicial remedy before the competent courts (Article 79 of Regulation (EU) 2016/679) if they consider that the processing of their personal data infringes this Regulation.
Place of processing
Personal data relating to this website’s online services are processed at the law office of Serena Mattei, Attorney-at-Law, located at Palazzo Grazioli, Via del Plebiscito 102, Rome. The data are handled exclusively by technical personnel authorised to process them or by personnel entrusted with maintenance operations who manage the website’s technical aspects (Article 28 of Regulation (EU) 2016/679).
Security of personal data
Processing methods
Personal data are processed in accordance with the principles of confidentiality, fairness, lawfulness and transparency, using manual, IT and electronic communication tools, in ways strictly related to the purposes of processing, including through the use of telephones, mobile phones, email and other means of remote communication.
Users’ personal data are managed by implementing appropriate technical and organisational measures to ensure a level of security proportionate to the risk (Article 32 of Regulation (EU) 2016/679). In particular, to implement data protection principles effectively, the Data Controller applies pseudonymisation so that personal data can no longer be attributed to a specific data subject without the use of additional information. Such additional information must be kept separately to ensure that the personal data are not attributed to an identified or identifiable natural person (Articles 4(5) and 25 of Regulation (EU) 2016/679).
Storage methods
Serena Mattei, Attorney-at-Law, takes care to implement and maintain the security of her services and her users’ data. She has also implemented appropriate physical and technological safeguards to help prevent unauthorised access, maintain data security and ensure the proper use of the information collected. These safeguards vary according to the sensitivity of the information collected and stored.
Serena Mattei, Attorney-at-Law, uses thorough procedures and specific technical controls to ensure the security of IT systems, including:
- a secure network topology, including intrusion prevention systems;
- encrypted communications;
- authentication and access controls;
- external and internal testing.
In any event, given the current state of technology, the measures adopted to protect users’ information cannot provide an absolute guarantee against unauthorised access or the misuse of certain services by third parties. Should such an event occur, Serena Mattei, Attorney-at-Law, will restore the security systems and report the incident to the competent authorities.
Recipients of personal data
All data collected and processed may be disclosed, exclusively for the purposes indicated above, to:
- K4 Solutions S.r.l., as the provider of web platform development and maintenance services.
- Aruba S.p.A., as the provider of development, delivery and operational management services for the technology platforms used.
- Persons, entities or authorities to whom disclosure of your personal data is mandatory under orders issued by the authorities or legal provisions.
The full list of data processors is available by sending a written request to: info@matteilawyers.com.
Data retention period
The data will be retained for the period strictly necessary to fulfil the purposes for which they were collected and for no longer than one year from the date consent was given, and for the entire duration of the contractual relationship or the requested services, as well as afterwards, to comply with legal obligations and for commercial purposes.
Data transfers
Users’ data will not be managed, stored or transferred outside the European Union.