Download and Newsletter Privacy Notice

Privacy Notice pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”)

1. Data Controller and Data Protection Officer
   The Data Controller is CBA Studio Legale e Tributario, with registered office in Milan (MI), Corso Europa no. 15, VAT no. IT08122350153 (“Controller” or “CBA”).
   The Controller has appointed a Data Protection Officer (DPO), who can be contacted by e-mail at dpo@cbalex.com or by telephone at +39 02 778061.
2. Legal Basis, Purposes and Methods of Processing
   The processing of personal data (the “Data”) by the Controller is carried out for the purpose of enabling the download of technical papers prepared by CBA Studio Legale e Tributario, for sending informational communications regarding CBA’s activities or legal and tax updates (newsletter), as well as for inviting you to training events promoted or organized by CBA.
   The Data may also be used for analytical purposes, to assess the topics of interest to users and the performance of the published content.
   No automated decision-making processes are involved in the processing of the Data.
   The legal basis for the processing of the Data is the consent provided by the data subject.
   In case of registration, the Data will be processed mainly by electronic means, in compliance with this notice and with the Privacy Policy available at the following link.
   The processing of the Data will be carried out in accordance with the principles of fairness, lawfulness and transparency, and in compliance with confidentiality and security obligations.
3. Data Retention
   The Data will be retained for a maximum period of 24 months, and in any case until the withdrawal of consent or the exercise of the right to object.
4. Scope of Data Communication
   Employees and/or collaborators of the Controller who have been specifically authorized and instructed pursuant to Article 29 of the GDPR may have access to the Data. Such individuals will process the Data exclusively for the purposes stated in this notice and in compliance with applicable legislation.
   In addition, third parties may have access to the Data and process them on behalf of the Controller as data processors, including, for example, providers of IT and logistics services, outsourcing or cloud computing service providers, professionals and consultants.
   The Data will not be disclosed to third parties, except where disclosure is required by law or necessary for the purposes provided by law, for which consent of the data subject is not required. In such cases, the Data may be made available to independent third parties who will process them solely for such purposes (for instance, in response to requests by law enforcement authorities, judicial bodies or other competent entities).
5. Data Transfers
   The Data will be processed within the European Economic Area (EEA).
   Should any transfer of Data outside the EEA be necessary due to the use of specific technologies (such as cloud systems or cookie tracking services), such processing will take place in accordance with adequacy decisions (Article 45 GDPR), appropriate safeguards adopted by the European Commission (Article 46 GDPR), or, where applicable, under the derogations provided for by Article 49 GDPR.
6. Data Subject Rights
   Data subjects have the right to:
   a) request from the Controller access to their Data, and the updating, rectification or erasure thereof, or restriction of processing, or to object to the processing;
   b) where the processing is based on consent, withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
   c) file a complaint to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
   To exercise the above rights, or for any request concerning the processing of Data and the security measures adopted, data subjects may contact the Controller by e-mail at privacy@cbalex.com.