Privacy policy

The purpose of this privacy policy is to inform you, with full transparency, about the processing of personal data performed by Paolo Creta, attorney at law, in the context of the activities of the Costa-Creta Law Firm (hereinafter also the "Firm").

It is important for us to clarify how and for what reasons the Firm processes personal data that you provide to us, or that we collect due to the task entrusted to us and/or in the context of the business relationship between you and the Firm and/or in connection with the use of our website www.costacreta.it (hereinafter also the "Website"). Therefore, we kindly invite you to read this privacy policy carefully before providing us with any kind of information and/or personal data.

Your personal data shall be processed in compliance with the relevant applicable provisions, including Regulation (EU) 2016/679 (hereinafter "GDPR") and Legislative Decree no. 196/2003, as modified pursuant to Legislative Decree no. 101/2018.

This privacy policy might be updated over time, both to comply with any new legal requirements and to meet the needs of the Firm: please check the date of last revision at the bottom of this document. Any amendments to the privacy policy will be effective from the date of their publication on the Website.

Data controller

For the purposes of the GDPR, the Data Controller is Mr. Paolo Creta, attorney at law, with office in Bologna, Palazzo Strazzaroli, Piazza di Porta Ravegnana n. 1, who may be reached at the email address segreteria@costalex.it (as well as at the other contacts that you may find at the bottom of any page of the Website) for any information relating to the processing of personal data by the Firm.

Purpose of personal data processing

Your personal data shall be processed exclusively for the following purposes:

• Replying to your queries and requests (including requests for estimates) and/or carrying out the task entrusted to us, as well as fulfilling any fiscal and accounting duties relating or connected thereto;
• Carrying out networking activities involving other professionals, also for the purpose of establishing new collaborations;
• Managing the business relationships between the Firm and its suppliers, as well as processing the relating payments;
• Assessing unsolicited applications, also by reviewing the profile of those applicants who sent their resume (as well as any attachments thereto) through the “work with us” form on the Website, and getting in touch with any applicant who may be of interest for the Firm;
• Ensuring that the Firm complies with any binding legal obligations for the Firm;
• Claiming or establishing rights in a judicial context (including in connection to the recovery of credits), or complying with obligations imposed by the competent authorities and/or replying to their requests;
• Organizing and promoting events, also with educational purposes.

You are not obliged to provide your personal data for any of the above-mentioned purposes. However, if you do not provide your personal data, it might be impossible for the Firm to reply to your queries and/or establish a relationship with you, including for the purpose of performing the task entrusted to us.

Legal basis for data processing

The processing of personal data carried out by the Firm to reply to your queries (including requests for estimates) and to perform the task entrusted to the Firm, is necessary for carrying out pre-contractual duties and/or for the performance of a contract to which you are a party (art. 6, point b) GDPR).

The processing of personal data based on the above mentioned legal basis might be necessary also for carrying out pre-contractual duties and/or for the performance of a contract between the Firm and its suppliers (art. 6, point b) GDPR).

The Firm processes personal data while carrying out its activity on the basis of the Firm’s own legitimate interest in performing the task entrusted to the Firm, in efficiently managing its activity, in establishing business relationships with other professionals, as well as in defending and asserting the prerogative of the Firm before the competent courts and/or authorities (art. 6, point f) GDPR).

The Firm processes the data provided through the “work with us” form on the basis of its legitimate interest carrying out the selection of personnel (art. 6, point f) GDPR).

All personal data might be processed also for ensuring that the Firm complies with any binding legal obligations on the Firm. (art. 6, point c) GDPR).

Means of data processing and circulation of personal data

Your personal data may be provided directly by you when requesting legal advice or assistance, due to your attendance to events organized by the Firm, or due to your interactions with our Website, including the filling of the "contacts" and "work with us" forms on the Website.

Furthermore, the IT systems of the Website collect some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with you, but by its very nature could, through further processing and association with data held by third parties, allow to identify you.

The Firm processes personal data by physical and automated means, within the limits of the purposes indicated above and adopting measures aimed at ensuring the security and confidentiality of the data.

The Firm pays great attention to the protection and confidentiality of personal data and, therefore, does not disseminate nor commercialize personal data.

The transfer of personal data outside the European Union could be indispensable in cases where this is necessary for performing the assignment entrusted to the Firm, as, for instance, in the event that for managing litigation or providing legal advice or assistance it is necessary the support of professionals established in non-EU countries.

In such cases you will be specifically informed, every time, about the territory where your personal data will be transferred and about the existence of adequacy decisions of the Commission (pursuant to art. 45 of the GDPR),or any other safeguard concretely implemented to ensure the protection of your personal data pursuant to the applicable provisions.

Subjects accessing your personal data

The Firm limits the access to personal data as much as possible, making them available to employees and collaborators duly authorized to access them and only to the extent that they have a reason to process them to perform their duties and tasks.

In addition to personnel within the Firm, also those who assist the Firm in managing its IT infrastructure and/or the Website may also access personal data.

In any event, the Firm limits the access by these subjects to those personal data that are necessary for the correct performance of the services that they provide to the Firm; furthermore, these subjects process said personal data as Data Processors, according to the instructions provided by the Firm.

In addition, your personal data may be communicated to subjects who need to process them in order to put us in the conditions of replying to your queries (including requests for estimates) and / or to perform the assignment entrusted to us, including for instance third-party professionals and package delivery service providers.

Outside of the above-mentioned cases, personal data processed by the Firm are not communicated to any other third parties, unless the communication thereof is necessary in order to fulfill and/or comply with legal obligations.

Data retention periods

Personal data processed in the context of the activity of the Firm are stored for the time necessary to pursue the specific purposes of each processing, as well as to ensure the compliance with any relevant applicable provisions.

In particular, personal data processed for the purpose of replying to your queries (including requests for estimates) and/or carrying out the task entrusted to us are stored for the time that lawyers are required to satisfy the requests of their clients, and, in any event, for no longer than 10 years from the termination of the task.

Personal data included in fiscal and/or accounting documents resulting from the performance of the task entrusted to us, as well as those resulting from the payment of suppliers and business partners of the Firm, are stored for the time necessary to fulfill the legal obligations of the Firm, and, in any event, for no longer than 10 years from the date of registration of such documents.

Personal data processed in the context of managing business relationships with suppliers are stored for the entire duration of said relationships, and, in any event, for no longer than 10 years from the termination of the relationship. Personal data included in the applications (and in any document attached or related thereto) provided through the "work with us" form is stored for the time necessary to review the relevant application, and, in any event, for no longer than 6 months from their receipt.

In any event, personal data processed in carrying out the activity of the Firm are stored for the time necessary to ensure the protection of the prerogatives of the Firm and an efficient management of the Firm's resources.

Data subjects’ rights

At any time, you may contact the Firm at the contacts indicated above for exercising the rights provided to data subjects under articles 15 to 22 of the GDPR, and, in particular for:

• Receiving confirmation that the Firm is processing your personal data, and reviewing the content of said data, their origin and accuracy;
• Requesting the integration, update, rectification, cancellation or anonymization of your personal data, as well as that their processing is blocked;
• Objecting, for reasons connected to a particular situation, to the processing of personal data performed on the basis of a legitimate interest of the Firm, on condition that no legitimate interests of the Firm for processing said data prevail (for instance, the need to protect one's rights and prerogatives in court);
• Lodge a complaint to the competent Data Protection Authority (in Italy, the competent Data Protection Authority is “Garante per la protezione dei dati personali”).

(date of last update 1 April 2019)