Privacy information

Information pursuant to the GDPR UE 2016/679

According to the GDPR UE 2016/679 and in relation to the personal data coming in possession with the investigative study, we inform you of the following:

  1. Purposes of data processing

The processing of personal data of the customer is concluded to fulfill legal obligations, for purposes inherent to the accomplishment of the Company’s activities. The aforementioned is to be considered as an example, not limited to the following circumstances – such as the acquisition of preliminary data on acceptance of the assignment, invoicing, management of collections, any credit recovery, etc.

  1. Methods of data processing
  2. The processing is carried out by different kind of operations such as: collection, registration, organization, storage, examination, processing, amendment, selection, extraction, comparison, use, interconnection, blocking, communication, removal and destruction of data;
  3. Operations may be carried out with or without the aid of electronic and IT devices and telematic tools, or automated systems, for purposes strictly related to the aforementioned points;
  4. The data processing will be carried out in compliance with the principles of confidentiality, integrity and data availability, by adopting all necessary safety measures explained in the Impact Assessment;
  5. The processing is carried out by the Data Controller and / or the Data Processors;
  6. Provision of data

The provision of personal data is necessary to carry out the activities described at point 1. Therefore, it may be necessary the provision of some sensitive data, such as judicial, medical and sexual data in order to provide the required professional service.

  1. Legal basis of the processing

The data are obtained for the satisfaction of a request advanced by the interested party, for the fulfillment of a contract and for compliance of legal obligations.

  1. Obligation to supply the data

The interested party is not obliged to give any personal data but, in case of denial it will be impossible to provide the required service, both for practical reasons and for the non-fulfillment of legal obligations.

  1. Data retention period

The personal data necessary to perform the requested activity will be kept only for the period strictly necessary to provide the service; otherwise, the data will be kept for the period imposed by the law.


  1. Communication and recipients of the data

The Data Processors or external consultants, subjects operating in the same sector, auxiliaries, consultants, etc. (all those subjects to whom the data communication is necessary for the correct fulfillment of the purposes indicated in point 1) – can acquire personal data of the interested party for the purposes mentioned in point 1.

  1. Dissemination of data

Personal data are not subject to general dissemination, advertising, profiling, etc., but will be communicated only for compliance with legal obligations.

  1. Transfer of data abroad

Personal data will not be transferred, for any reason, to EU countries and not EU countries.

  1. Rights of the interested party

The GDPR EU 2016/679 grants the interested party the exercise of the following specific rights:

  1. a) right of access to the data (Article 15 GDPR)
  2. b) data correction right (Article 16 GDPR)
  3. c) data removal (Article 17 GDPR)
  4. d) limitation of data processing (Article 18 GDPR)
  5. e) right to oppose the data processing (Article 21 of the GDPR)
  6. f) portability right (Article 20 of the GDPR) meant as the right to obtain, from the data controller, the data in a structured format of common use and machine readable in order to transfer them to another data controller without impediments.
  7. g) right of consent withdrawal to the processing, without prejudice to the lawfulness of the processing based on the consent acquired before the revocation (Article 7 – paragraph 3 GDPR)
  8. h) the right to file a complaint to the supervisory authority, ie the Privacy Authority (Article 51 GDPR)
  9. Data controller

The data controller is Promani s.r.l., Vat number 10300080966,in Milan, Largo Tommaso Gallarati Scotti 1, in the person of its legal representative pro-tempore Nicola Ceccato, CCCNCL66T02C964P. The exercise of the aforementioned rights can be represented to the data controller by recorded-delivery letter with advice of receipt.