The Data Controller for the Personal Data you provide is Dr. MAURIZIO DE ALEXANDRIS. The Data Controller has designated Authorised Personnel and Data Processors. Internal Authorised Personnel are part of company areas that need to process data for the purposes mentioned in this statement (e.g., purchasing/commercial office, administration office, IT sector, accounting office, etc.). External Data Processors perform outsourcing activities on behalf of the Owner. The list of Data Processors is available upon request and can be obtained through the contact details provided in section 9.

The Personal Data collected by the Firm include name, surname, residence/domicile, email, tax code and/or VAT number, telephone number and/or mobile phone. Special Data may be collected only in cases that require specific attention from the staff.

The processing of your data serves the essential purpose of executing a contract in which you are a party or implementing pre-contractual measures that have been taken at your request. These measures encompass various forms, including requests for information or commercial offers (in accordance with Article 6, paragraph 1, letter b) of the GDPR). Specifically, these actions relate to services such as Consultancy and ongoing assistance in tax accounting and corporate matters, Accounting, and Corporate and legal services. Furthermore, this data processing is essential to fulfilling legal obligations entrusted to DE ALEXANDRIS ASSOCIATI. Your decision to provide us with your Data for these outlined purposes is imperative. It must be understood as an implicit facet of your request for the aforementioned services. Refusal to provide such data explicitly could potentially hinder our ability to fulfil the Services that you have requested. As we process your data to achieve the aforementioned goals, it’s important to note that the Firm may incidentally become privy to special categories of personal data. These categories are in accordance with Articles 9 and 10 of the GDPR and are referred to as “Sensitive or Judicial Data.” They encompass information such as racial and ethnic origin, philosophical or religious beliefs, trade union or political affiliations, genetic and biometric data, data related to health, sex life, or even details about criminal convictions, crimes, or security measures. For this subset of data, we kindly request your explicit consent for processing. It’s important to highlight that even for such data, the legal basis for processing is rooted in the proper execution of a professional service or a contract to which you are a party or in the execution of pre-contractual obligations that have been initiated at your behest. Furthermore, your Data may also be processed to send newsletters containing periodic tax and legal updates. These newsletters are crafted by the Firm and intended for our valued customers’ benefit. In this regard, we kindly seek your express consent for this form of data processing.

The processing of your data will be executed using both automated and manual methods. These methods will strictly adhere to the provisions outlined in Article 32 of GDPR 2016/679 and the directives set forth in Article 29 of GDPR 2016/679. Our diligent Studio team, as well as external individuals specifically designated as Authorized (responsible) for processing and Data Processors, will conduct these operations.These Data Processors may access your data for the same purposes that prompted its collection. These professionals belong to the following categories:Subjects providing assistance and/or services to DE ALEXANDRIS ASSOCIATI ASSOCIAZIONE PROFESSIONALE: For a complete listing of our Data Processors, please do not hesitate to reach out. You can request this information by contacting us through the details provided in section 9 (Contact Details) below. It’s important to note that the Data Controller refrains from adopting any automated decision-making processes, including profiling, as defined in Article 22, paragraphs 1 and 4 of EU Regulation no. 679/2016.

Your communicated data will never be transferred to unauthorised or unaccountable third parties except when necessary to fulfil legal obligations as stipulated by laws (such as Public Bodies, in cases where such transfer is mandated by law), including the Financial Administration and Judicial Administration. Furthermore, with your explicit consent, the data collected may be shared with our trusted business partners. These partners are engaged in activities outsourced by the Firm, such as legal opinions, financial statement analysis, and appraisals. This sharing is essential for the effective execution of the required contractual services. We assure you that the processed data will never be transferred to third countries. However, should such a circumstance arise in the future, we will provide an advanced separate notice. This notice will comprehensively detail the legal guarantees that will be in place to ensure the secure and compliant transfer of your data.

We process all provided Personal Data in compliance with the principles of lawfulness, correctness, relevance, and proportionality. We utilise methods that are computerised or telematic, ensuring they are strictly necessary to fulfil the stated purposes. For data in paper form, we maintain them in the personal folders of each employee, secured in closed archives under keys or in restricted-access rooms. Similarly, computerised data is stored on servers with limited network connections, fortified with authentication and firewall protection. Backup disks are stored securely and protected by unique passwords. These protective measures are implemented to safeguard data against unauthorised access, processing, loss, alteration, or accidental destruction. The processing of data is conducted for a duration that does not exceed the requirements for executing contractual services or pre-contractual measures requested by the interested party. Specific legal regulations, such as those related to tax, accounting, and security or the legitimate interest of the Data Controller, may allow for a different retention period as per Article 6, Paragraph 1, Letter f of the GDPR. In situations involving litigation with the interested party or third parties, data will be processed for as long as necessary to protect Company rights. The Data Controller’s legitimate interest in data storage is generally quantified at an average of 24 months from the termination of the customer relationship. This period is determined through statistical analysis of aggregated and non-personal data. These insights demonstrate the continued need for reusing Personal Data even after the contractual service ends, facilitating requests for new contractual services. After this period, the Data will be deleted in accordance with our data retention policy.

Data collected will be stored at the headquarters of DE ALEXANDRIS ASSOCIATI ASSOCIAZIONE PROFESSIONALE in CORSO MILANO, 45 – 20900 MONZA.

As the interested party, you have the following rights: (I) Obtain confirmation regarding the existence of Personal Data concerning you; (II) Know the purposes of the data processing, the methods involved, the recipients of such Data, and the retention period; (III) Request rectification or cancellation of your data and, where applicable, the limitation of its processing; (IV) Oppose the processing of your data; (V) If applicable, receive your Personal Data in a structured, commonly used, and machine-readable format from the Company. You can then transmit this data to another Data Controller without hindrance from us; (VI) Lodge a complaint with the Guarantor Authority for the protection of personal Data.