On 25 May 2018 the new European General Regulation on data protection (“GDPR”) 679/2016 came into force, concerning the protection of personal data. To ensure transparency and compliance with the GDPR, we ask you to read this data protection policy.

Boscolo & Partners S.T.P. a R.L. (“B&P”), headquartered in Trieste, at Via Dante Alighieri no. 5, through its pro tempore legal representative, as the Data Controller of personal data disclosed voluntarily, now provides this data protection policy in accordance with article 13 of the GDPR (the “Policy”).

(a) Identity and contact details of the Data Controller

Boscolo & Partners S.T.P. a R.L.
Via Dante Alighieri n. 5 – 34122 Trieste
Tax code / VAT no.: IT00757100326
Tel. +39 040 0642411 - Certified email address: studioboscolo@legalmail.it

b) Purpose of the data processing and legal basis

The personal data will be processed:

(i) without consent (article 6, paragraphs b, c, f of the GDPR), for the following purposes:
⋅ to comply with pre-contractual and contractual obligations deriving from a professional mandate;
⋅ to comply with the provisions of Italian or EC laws and regulations, or to execute an order made by the courts, or by regulatory bodies by which the Data Controller is bound;
⋅ to exercise the rights of the data controller, in particular, the right of defence and legal proceedings;


(ii) with consent (Article 7 of the GDPR), for the following purpose
⋅ the organisation of events, meetings, conventions and seminars, also for professional training purposes;
⋅ marketing activities of various types, including the promotion of professional services, the distribution of informative or promotional material and the sending of newsletters and publications;
⋅ the management of surveys and questionnaires, including customer satisfaction surveys.

The provision of the data for the purposes indicated in paragraph (i) is obligatory. Failure to provide data and/or any express refusal of data processing will mean that the Data Controller is unable to perform the mandate, and will result in a possible violation of requests by the Authorities.
The provision of the data necessary for the purpose indicated in (ii) is optional; you may decide not to give consent, or you may revoke consent at any time.

(c) Categories of personal data

In the context of the purposes of the processing mentioned in paragraph (b), only personal data that relates, for example, to the following categories will be processed: name and surname, tax code, VAT number, residence, domicile, place of work, email or certified email address, telephone and fax numbers, employer, role and/or position within the company, etc.
For the purposes of execution of the mandate, subject to the principle of minimisation as provided for in Article 5 paragraph 1(c) of the GDPR, taking into account the type of services performed by the professionals designated to perform them, the processing of particular categories of data may be necessary in certain cases. These categories may include, but are not limited to, those indicated in Article 9 of the GDPR (for example medical and health data) or data relating to criminal convictions and crimes or connected to security measures as defined in Article 10 of the GDPR.

(d) Categories of data recipients

For the purposes referred to in the foregoing paragraph (b), section (i), the personal data to be supplied may be made accessible:
1. to employees and contractors of the Data Controller in their capacity as authorised persons (“ Authorised Persons”),
2. to third parties performing outsourcing activities on behalf of the Data Controller, in their capacity as data processors,
3. to legal or regulatory authorities, administrations, public bodies and organisations (both national and foreign);
4. to other legal entities in the international network of which the data controller forms a part.
Where consent has been given to the use of personal data for the purposes indicated in (b), section (ii), the data may be made accessible to the persons indicated in the foregoing paragraphs (1), (2), and (3).

(e) Conservation and transfer of personal data abroad

The personal data will be managed and stored in the cloud and on servers located inside and outside the European Union, which are owned by and/or available to the Data Controller and/or by authorised third parties who have been duly appointed as data processors.
The transfer of data to non-EU countries will take place in accordance with the provisions of Chapter V of the GDPR (Article 46), with the use of the standard clauses prepared on the basis of the versions numbered 2004/915/EC and 2010/87/EU as elaborated by the European Commission.
Your personal data will not be circulated.

(f) Data conservation period

The personal data collected for the purposes indicated in the foregoing paragraph (b) section (i) will be processed and stored for the duration of any professional relationship.
On termination of the professional relationship for any reasonable cause, the data will be stored for the duration of the legal conservation periods, also for the purposes of proving due execution of the professional services.
The personal data collected for the purposes indicated in the foregoing paragraph (b) section (ii) will be processed and stored for the time necessary to fulfil such purposes.

(g) Exercisable rights

In accordance with the provisions of Chapter III, Section I GDPR, the data subject may exercise the rights indicated therein, in particular:

⋅ Right of access – the right to obtain confirmation of whether or not the personal data of the data subject is being processed and if so, the right to receive information relating, in particular, to: the purpose of the data processing, the categories of personal data processed, the conservation period and the recipients to whom the data may be communicated (Article 15 GDPR);
⋅ Right of rectification – the right to obtain the amendment of any inaccurate personal details regarding the data subject, without unjustified delay and to obtain the integration of incomplete data (Article 16 GDPR);
⋅ Right of erasure – to obtain the erasure of any personal details regarding the data subject, without unjustified delay, in the cases provided for in the GDPR (Article 17 GDPR);
⋅ Right of limitation – to obtain from the Data Controller the limitation of the data processing, in the cases provided for in the GDPR (Article 18 GDPR);
⋅ Right to portability - the right to receive the personal data of the data subject as supplied to the Data Controller, in a structured, commonly used, machine-readable format, and the right to obtain the transfer of personal data to another data controller without impediment, in the cases provided for in the GDPR (Article 20, GDPR);
⋅ Right of objection – the right to object to the processing of personal data relating to the data subject, except where there are legitimate grounds for the data controller to continue the processing (Article 21 GDPR);
⋅ Right to complain to a regulatory authority - the right to make a complaint to the Italian Data Protection Authority, Piazza di Montecitorio no. 121, 00186, Rome (Province of Rome).
The data subjects may exercise their rights by sending a request by email, to the certified email address of B&P.

(h) Modalità del trattamento

Il trattamento dei dati personali è realizzato per mezzo delle operazioni indicate all’articolo 4, n. 2), GDPR - compiute con o senza l’ausilio di sistemi informatici - e precisamente: raccolta, registrazione, organizzazione, strutturazione, aggiornamento, conservazione, adattamento o modifica, estrazione ed analisi, consultazione, uso, comunicazione mediante trasmissione, raffronto, interconnessione, limitazione, cancellazione o distruzione.
In ogni caso, sarà garantita la sicurezza logica e fisica dei dati e, in generale, la riservatezza dei dati personali trattati, mettendo in atto tutte le necessarie misure tecniche e organizzative adeguate a garantire la loro sicurezza.

Boscolo & Partners S.T.P. a r.l.
Member Crowe Global
Via Dante Alighieri, 5
34122 Trieste - Italy
Share capital € 158.820,00 fully paid
Companies Register of Venezia Giulia no. 00757100326
Main +39 040 0642411
Fax +39 040 369124
www.crowe-boscolo.it