Privacy Policy

As per Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR for brevity) and per Legislative Decree 196/2003, BCR Legal Società tra Avvocati S.r.l. (hereinafter the Company) intends to inform data subjects on how their personal data, including personal data of a particular nature, are processed to request their consent where necessary and to make them aware of their rights and how to exercise them fully.

Data controller, data and contact point

The data controller is the company BCR Legal Società tra Avvocati S.r.l. (hereinafter also the Data Controller), in the person of its legal representative pro tempore, with registered office in Milan (MI), Via Monte Napoleone, n. 8, postcode 20121, fiscal code VAT no. 10757700967, tel. +39 02 83910108, e-mail: areacomunicazione2.0@bcrlegal.net.

The contact person for the privacy structure (point of contact) is the legal representative pro tempore, domiciled for this purpose at the company’s registered office.

Sources of personal data collection

The Data Controller collects personal data directly from the data subjects, both at its registered office and externally and through distance communication techniques (e.g. through this site). Personal data may be provided when requesting information, quotes, at the time of the assignment, in the course of the management of the file.

Where necessary, the Company accesses public registers, lists or databases.

Methods of treatment

The processing of personal data, carried out in compliance with current legislation and confidentiality obligations, takes place by means of manual instruments, in paper format and/or with the aid of electronic, computerised, telematic and/or automated means and is carried out by the Company, in the person of the partners and/or associates registered with the Bar and/or those entrusted with such processing, with logic strictly related to the purposes indicated below.

Personal data (personal and/or contact details) are entered into the management system and, in the presence of specific consents, may also be processed for the further purpose of sending communications, information and/or technical information circulars concerning legal matters.

In any case, personal data are protected by means of appropriate technical and organisational measures, so as to guarantee their security and confidentiality, in accordance with the regulations in force. The Data Controller has activated and implemented specific security measures to prevent the loss or destruction of data, unauthorised access, unauthorised processing or processing that does not comply with the purposes for which it was collected.

Purpose and legal basis of data processing

The processing of personal data, collected as specified above, is aimed at:

1. A) the correct and complete execution of the professional assignment conferred, in extrajudicial contexts and, where appropriate or necessary, in judicial ones;
2. B) if the data subject consents to it, for purposes functional to the development of the Company’s business, the sending of communications, information and/or technical newsletters concerning legal matters.

Provision of data

In the cases indicated in Paragraph “PURPOSE AND LEGAL BASIS OF DATA PROCESSING”, letter A), the provision of common, sensitive and judicial personal data and the consent of the data subject to the relevant processing is compulsory on the basis of laws, regulations, EU rules, provisions issued by Authorities, Supervisory and/or Control Bodies, or strictly necessary for the management and execution of the professional assignment conferred. Any refusal on the part of the data subject to provide personal data and to consent to its processing shall make it impossible to carry out the activities related to the professional assignment conferred.

In the cases stated in Paragraph “PURPOSE AND LEGAL BASIS OF DATA PROCESSING”, letter B), the provision of data is optional and therefore the person concerned has the right not to give consent. Any refusal to do so will not have any effect on the legal relationship in existence or in the process of being established or on the performance of activities related to the professional assignment conferred.

Special categories of data and processing

The Company may request its clients to provide ‘sensitive’ and/or ‘judicial’ data in connection with the performance of the professional assignment conferred. In this case, the consent given also concerns the processing of such data, where strictly connected and instrumental to the specific purpose pursued and/or to the performance of the same specific operations. Any refusal on the part of the client, in his capacity as data subject, to provide sensitive or judicial personal data shall entail the impossibility of performing the requested activities.

Knowledge of data, their communication and dissemination

Personal data, for the purposes described in Paragraph “PURPOSE AND LEGAL BASIS OF DATA PROCESSING”, letter A), may come to the knowledge of the members and associates registered with the Bar Association and/or of the persons in charge of data processing, and may be communicated to external structures for the performance of activities strictly connected and instrumental to the performance of the professional task conferred (e.g. telematic process management, invoicing and accounting fulfilment management, debt collection management). In the event of the data subject’s failure or refusal to consent to the communication of data to the aforesaid structures and to the related processing, the Company will only be able to carry out those operations and/or services that do not require such communication of personal data to third parties (legal advice). Personal data may be communicated -to be subjected to related processing for the same purposes and limited to what is strictly within their competence- to other entities in the sector such as, for example, insurance and/or reinsurance companies, co-insurers, insurance and/or reinsurance distributors/intermediaries, lawyers, consultants, loss adjusters, doctors and medical examiners, external collaborators, subjects operating in the judicial sector, counterparties and their advocates, boards of arbitrators, mediators, companies that provide IT and telematic services and, in general, all those public and private subjects to whom communication is necessary for the correct fulfilment of the professional assignment conferred, Public Administrations and Authorities, Supervisory Authorities and/or other Authorities.

The data provided will also be processed for the purposes of the current anti-money laundering legislation.

Personal data are not subject to dissemination, unless specific regulatory measures impose different obligations on the Data Controller.

Transfer of data abroad

For the same purposes as described above, personal data may also be transferred outside the national territory, to countries of the European Union and to third countries that comply with the GDPR and within the scope of the purposes envisaged above, if the data subject expresses his/her free and clear consent following this information notice. The data subject will be able to obtain a copy of such data electronically and the data will be available at all times.

Period of data retention

Personal data are kept in our archives in paper or digital form, for the above-mentioned purposes, for the following duration:

-management of contacts not followed by assignment: three months from data acquisition;

-contact management following assignment (also for the purposes of anti-money laundering legislation): ten years from the conclusion of the professional assignment conferred.

Rights of the data subject

Pursuant to the GDPR, the data subject is granted the exercise of specific rights, including the right to obtain from the Controller, at any time, confirmation whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and to the following information:

(a) purpose of the processing; (b) categories of personal data concerned; (c) recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations; (d) where possible, expected period of storage of the personal data or, if this is not possible, the criteria used to determine this period; (e) existence of the right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning you or to object to their processing; f) existence of the right to data portability (i.e. to receive, in a structured, commonly used and machine-readable format, the personal data provided); g) right to file a complaint with a supervisory authority; h) if the data are not collected from the data subject, all available information on their origin (i) the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4) GDPR and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject.

Our company does not carry out any automated decision-making processes.

The data subject has the right to obtain, if there is an interest, the integration of the data.

The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him/her, without undue delay, and the data controller shall be obliged to erase, without undue delay, the personal data if any of the following grounds apply:

1. (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. b) the data subject withdraws the consent on which the processing is based (both for common data and for special categories of data) and there is no other legal basis for the processing;
3. (c) the data subject objects to the processing pursuant to Article 21(1) GDPR and there is no overriding legitimate reason for processing, or objects to the processing pursuant to Article 21(2) GDPR;
4. (d) the personal data have been unlawfully processed;
5. (e) the personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the controller is subject;
6. (f) the personal data were collected in connection with the provision of information society services referred to in Article 8(1) GDPR.

Where personal data are transferred to a third country or international organisation, the data subject shall have the right to be informed of the existence of safeguards relating to the transfer.

Where required, the data controller shall provide a copy of the personal data being processed. The right to obtain a copy must not infringe the rights and freedoms of others.

To obtain further information regarding the processing and communication of their personal data, the data subject may contact: BCR Legal Società tra Avvocati S.r.l., in the person of its legal representative pro tempore, at the email address: areacomunicazione2.0@bcrlegal.net.

To exercise the aforementioned rights, the interested party may send a written request by registered mail to the registered office of BCR Legal Società tra Avvocati S.r.l., or by PEC to: bcrlegal@legalmail.it or by email to: areacomunicazione2.0@bcrlegal.net.

The request for cancellation of subscription to the newsletter service may be made by the interested party at any time by clicking the “unsubscribe” link at the bottom of the text.

Right to Oppose

The data subject has the right to object at any time, due to his/her particular situation, to the processing of personal data concerning him/her. In this case, the Controller shall refrain from further processing the personal data unless there are compelling legitimate reasons for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling where related to such direct marketing. In this case, the personal data will no longer be processed for such purposes.

Withdrawal of consent

If the data subject has given consent to authorise a specific processing operation, he/she may cancel it at any time by contacting the Data Controller as indicated above in the paragraph “RIGHTS OF THE DATA SUBJECT”. Such cancellation, in any case, shall not affect the lawfulness of the processing based on the consent given before said cancellation.

Before giving consent, the data subject shall be properly informed. Consent shall be withdrawn in the same manner in which it is given: therefore, a written notice to be sent by registered letter or email to the contact point referred to in the Section “DATA CONTROLLER, DATA AND CONTACT POINT” of this notice shall be sufficient.

Right to complain

The data subject has the right to file a complaint with the competent supervisory authority (in Italy, Garante per la protezione dei dati personali), to appeal to the competent courts of the Member States and, where appropriate, to obtain compensation for breach of mandatory business rules. The supervisory authority to which a complaint has been submitted shall inform the complainant of its decision.

Purpose other than that for which the data were collected

If the Company, as data controller, intends to process personal data for a purpose other than the one for which it was collected, it shall, prior to such further processing, provide the data subject with information about that other purpose and any further relevant information.

Cookie

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.