Privacy Policy

PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA

PROVIDED PURSUANT TO ARTICLES 13-14 OF THE GDPR (GENERAL DATA PROTECTION REGULATION) 2016/679

In accordance with the aforementioned regulation, the processing of data will be based on principles of fairness, lawfulness, transparency, and the protection of your privacy and rights.
Pursuant to Regulation (EU) 2016/679 (hereinafter “Regulation”), this page describes the methods of processing the personal data of users who consult the SaiaLegal.com website (hereinafter “Site”), accessible at https://www.saialegal.com.

This information does not apply to other websites, pages, or online services that may be accessed via hyperlinks published on the Site but refer to resources outside the Site’s domain.

Data Controller

The Data Controller of the collected data is Attorney Elisabetta Saia, with registered office at Via Silvio Spaventa, 25 – 24122 Bergamo (BG) – VAT No. 03024520169. Email address of the Data Controller: avv.elisabettasaia@saialegal.com

Data Processor

The hosting service provider of this Site is Artera S.r.l., with registered office at Via della Posta, 10 – 6900 Lugano (CH). Artera S.r.l. is appointed as Data Processor pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR), being responsible for the technical management of the infrastructure on which the personal data collected via this Site is hosted.

For more information about Artera S.r.l.’s processing practices, please consult their privacy policy at: https://www.artera.net/it/informativa-privacy/

Types of Data Processed and Purpose of Processing

While browsing this website, the following categories of personal data may be processed:

1. Browsing data
The IT systems and software procedures used to operate this website acquire certain personal data during their normal operation, the transmission of which is implicit in the use of internet communication protocols.
This data includes, by way of example: IP addresses, domain names of computers used by users who connect to the site, URI (Uniform Resource Identifier) addresses of requested resources, time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters related to the user’s operating system and IT environment.
This data is used solely to compile anonymous statistical information on site usage and to ensure its proper functioning. It may also be used to determine liability in the event of hypothetical cybercrimes against the site.

2. Data voluntarily provided by the user
The optional, explicit, and voluntary sending of messages via contact forms on the site involves the acquisition of the data provided by the user, which is necessary to respond to the requests (such as name, email address, and any other data voluntarily entered). This data is processed exclusively to provide the requested service.

3. Cookies and other tracking systems
This website uses technical cookies necessary for its functioning and third-party cookies for statistical and analytical purposes, including through the use of Google Analytics.
Google Analytics is a web analytics service provided by Google LLC, which uses the collected data to track and examine the use of the website, compile reports, and share them with other Google-developed services.
User IP addresses are anonymized before being processed by Google.
Users can manage their cookie preferences through the initial banner and change their consent at any time via the cookie management panel.

For more information about the use and management of cookies, please refer to the site’s Cookie Policy.

Legal Bases for Data Processing

The processing of users’ personal data is carried out in compliance with the lawfulness conditions provided for by Article 6 of Regulation (EU) 2016/679 (GDPR) and is based on the following legal grounds:

• Contractual or pre-contractual obligations: The processing of voluntarily submitted data via contact forms is necessary to respond to specific requests, provide information, or deliver the requested services (Art. 6(1)(b) GDPR).
• Consent of the data subject: The processing of data for statistical and analytical purposes using third-party cookies (such as Google Analytics) is based on the user’s explicit consent provided via the cookie banner (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
• Legitimate interest of the controller: Browsing data is processed for security, quality improvement, and anonymous traffic analysis purposes, based on the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR), while respecting users’ fundamental rights and freedoms.

Data Recipients

The personal data collected through this website may be disclosed to third parties exclusively for the purposes indicated in this notice and in accordance with Regulation (EU) 2016/679 (GDPR). These parties may belong to the following categories:

• Providers of technical and IT services: companies providing hosting, maintenance, and website development services, including Artera S.r.l., designated as Data Processor under Art. 28 GDPR;
• Providers of analysis and monitoring services: companies offering web traffic analysis services, such as Google LLC via Google Analytics;
• Public authorities: entities to which data disclosure is mandatory by law or by order of an authority.

All parties mentioned above process data either as appointed Data Processors or as independent Data Controllers in compliance with GDPR regulations.

Data Processing/Location

The personal data collected through this site is processed primarily at the operational offices of the Data Controller and in the data centers of the hosting provider Artera S.r.l., located in Italy. Artera ensures the physical and digital security of the data, with exclusive access granted to users at any time.

Data processing is carried out using IT and/or telematic tools with organizational methods and logic strictly related to the purposes described in this privacy notice. Appropriate technical and organizational measures are in place to ensure data security, integrity, and confidentiality, in accordance with Regulation (EU) 2016/679 (GDPR).

Personal data will not be transferred outside the European Economic Area (EEA). If a transfer to third countries becomes necessary, it will be carried out in accordance with applicable laws, ensuring adequate protection of personal data.

Data Processing/Access

Personal data is processed exclusively by authorized personnel of the Data Controller, who have received appropriate training on data protection, and by any third parties designated as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR).

Access to data is permitted only to the extent necessary for the fulfillment of the purposes described in this policy and is limited to:

• Law Firm personnel;
• Technical service providers, such as the hosting provider (Artera S.r.l.) and analytics providers (e.g., Google LLC), solely for service delivery purposes;
• Legal or administrative consultants, if necessary to fulfill legal obligations or protect the rights of the Data Controller.

All third parties accessing data do so based on specific agreements or formal designations and are bound to confidentiality and compliance with data protection regulations.

Data Retention Period

The personal data collected through this website is retained only for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the storage limitation principle provided for in Article 5(1)(e) of Regulation (EU) 2016/679 (GDPR).

In particular:

• Browsing data: retained for as long as necessary to ensure the proper functioning and security of the site, generally not more than 7 days, except where necessary to investigate computer crimes.
• Data voluntarily disclosed by the user: data provided through contact forms are kept for the time necessary to respond to user requests and thereafter for up to 12 months.
• Data collected through cookies and tracking tools: data collected for statistical and analytical purposes, subject to user consent, are retained for up to 24 months.

At the end of these periods, personal data will be deleted or irreversibly anonymized, except where legal obligations require longer retention.

Consequences of Failure to Provide Data

The provision of personal data by the user is optional, but in some cases necessary to use certain services offered on the site.

• Failure to provide the data requested in the contact forms will result in the Holder being unable to provide a response or deliver the requested service.
• Refusing to accept technical cookies necessary for site operation may impair the browsing experience and access to essential features.
• Refusing consent for analytical or profiling cookies does not affect site usability but limits the ability to improve content and services based on user behavior.

In all cases, the user retains the right to freely choose which data to provide, and failure to do so will result only in limitations related to the requested service.

Data Subject Rights

Pursuant to Articles 15 et seq. of Regulation (EU) 2016/679, users have the right to exercise the following rights at any time regarding their personal data:

• Right of access: to obtain confirmation as to whether or not personal data concerning him or her is being processed and, if so, to receive a copy of it;
• Right to rectification: to obtain the correction of inaccurate personal data or the integration of incomplete data;
• Right to erasure (“right to be forgotten”): to obtain the deletion of personal data in the cases provided for in Article 17 GDPR;
• Right to restriction of processing: to obtain the limitation of processing in the cases provided for in Article 18 GDPR;
• Right to data portability: to receive personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller, where technically feasible;
• Right to object: to object at any time, on grounds relating to their particular situation, to the processing of personal data based on the legitimate interest of the controller;
• Right to withdraw consent: where processing is based on consent, users may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

Users may exercise their rights by submitting a written request to the Data Controller using the contact details provided in this privacy notice.

Additionally, users have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) if they believe that the processing of their personal data violates applicable legislation.