PRIVACY POLICY

This privacy notice is provided in accordance with Article 13 of Regulation (EU) 2016/679 (“GDPR”) and the applicable national legislation on the protection of personal data.

The purpose of this policy is to provide information on how the personal data of users interacting with the Sani Zangrando Law Firm website is processed.

DATA CONTROLLER

Sani Zangrando Law Firm
Sani Zangrando Associated Law Firm
Corso Venezia 16 – Milan
Email – es.info@sazalex.com

The Data Controller is the entity that determines the purposes and means of processing personal data in accordance with Article 4 of the GDPR.

TYPES OF DATA PROCESSED

The website is primarily for information purposes, but may involve the collection of personal data.

Browsing data

IT systems automatically collect certain data, including:

IP addresses
browser and device type
operating system
pages visited and time spent on the site
data relating to access to and use of the website

This data is used to ensure the website functions correctly and for aggregated and anonymous statistical analysis.

Data provided voluntarily by the user

The user may provide personal data via:

contact forms
requests for information or advice
emails sent to the Firm’s addresses
registration for the Firm’s events or initiatives

The data may include:

identifying details (first name, surname)
contact details (email, telephone number)
any information contained in communications sent

Please note: In the context of the Firm’s professional activities, you may also provide special categories of data within the meaning of Article 9 of the GDPR and/or data relating to legal proceedings. Such data will be processed exclusively to the extent strictly necessary and in compliance with applicable legislation.

PURPOSES OF PROCESSING

Personal data is processed for the following purposes:

to respond to enquiries submitted via the website or by email;
to provide information on the Firm’s services;
to manage pre-contractual and contractual relationships;
to comply with legal and regulatory obligations;
to protect the Firm’s rights in and out of court;
to improve the functioning of the website (legitimate interest);
sending newsletters and informational communications;
sending updates on events and initiatives.

LEGAL BASIS FOR PROCESSING

The processing of personal data is based on one or more of the following legal bases:

compliance with legal obligations under the GDPR;
the Firm’s legitimate interest, for example in relation to website security and the management of professional relationships;
the data subject’s consent (where required), which may be withdrawn at any time.

SHARING OF PERSONAL DATA

Data may be disclosed to:

the Firm’s staff and professionals;
IT, hosting and website management service providers;
public authorities, where required by law.

The data will not be disclosed to the general public.

An up-to-date list of data processors may be requested from the Firm.

TRANSFER OF DATA OUTSIDE THE EU

Where personal data is transferred to countries outside the EU, this will take place in accordance with the safeguards provided for by the GDPR, such as:

adequacy decisions by the European Commission;
standard contractual clauses;
further safeguards provided for by applicable legislation.

PROTECTION OF PERSONAL DATA

The Firm implements appropriate technical and organisational measures in accordance with Article 32 of the GDPR to ensure:

the security of personal data;
protection against unauthorised access;
the prevention of loss, disclosure or destruction of personal data.

These measures are determined taking into account the nature of the data processed and the associated risks.

DATA RETENTION PERIODS

Personal data is retained for as long as is necessary for the purposes for which it is collected, and in particular:

data relating to contact requests: for as long as is necessary to handle the request;
contractual data: for the duration of the relationship and for the period provided for by current legislation;
data processed for legal purposes: for as long as is necessary to safeguard rights;
data processed on the basis of consent: until such consent is withdrawn.

RIGHTS OF THE DATA SUBJECT

The data subject may exercise the rights provided for in Articles 15–22 of the GDPR, including:

the right of access to data;
the right to rectification;
the right to erasure;
the right to restriction of processing;
the right to data portability;
the right to object to processing.

Requests may be sent to the Firm at the email address given above. The Firm will respond within 30 days of receiving the request, subject to extensions in the cases provided for by the GDPR.

It is also possible to lodge a complaint with the Data Protection Authority.

CHANGES TO THIS PRIVACY NOTICE

This privacy notice may be updated from time to time. Any changes will be published on this page.

Last updated: May 2026