How we holdthe file you give us.

We hold the smallest set of personal data required to do the work. Categories include: identification data (name, role, organisation), contact data (email, phone, physical address), engagement data (correspondence, instructions, deliverables), and technical data (IP address, browser metadata, log timestamps).

• Identification & contact — to convene the engagement and respond to enquiries.
• Engagement record — to discharge our professional duties and meet regulatory record-keeping obligations.
• Technical & log data — to operate the site, prevent abuse and audit access to confidential materials.

We do not buy personal data from third parties. We do not enrich profiles from social platforms.

We rely on four bases under Regulation (EU) 2016/679 (GDPR): the performance of a contract with you or your organisation; compliance with legal obligations imposed on the firm; our legitimate interest in operating a confidential professional practice; and your explicit consent, where consent is the only available basis.

Where consent is the basis, you may withdraw it at any time through the contact channel below. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Personal data is accessed only by the constituency members assigned to the file and by a short list of operational processors that we contract under written terms equivalent to this policy.

• Lequent personnel assigned to the engagement.
• Sub-processors for hosting, mail delivery, calendaring and secure document exchange. Current list available on request.
• Regulators and courts where the law requires disclosure. We notify you unless the law forbids it.

We do not sell personal data, and we do not transfer it for advertising profiling under any condition.

The firm operates from the European Union. Where a sub-processor is located outside the EEA, transfers are covered by Standard Contractual Clauses (SCCs) or an adequacy decision adopted by the European Commission. We carry out transfer-impact assessments before engaging any non-EEA processor.

Engagement records are retained for ten years after closure, in line with professional record-keeping obligations under Italian and EU law. Marketing and newsletter data is retained until you unsubscribe. Technical logs are rotated within ninety days unless retained for security investigation.

Under the GDPR you may exercise the rights of access, rectification, erasure, restriction, portability and objection, and you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

We answer rights requests within thirty days. Where a request cannot be fulfilled because of an overriding legal obligation, we explain the basis on which it is held.

Confidentiality is the operational premise of the firm. Access to the engagement record is role-scoped and audited. Documents are encrypted in transit and at rest. Devices are managed under a written policy and remote wipe is available on every personnel device.

A breach involving personal data is reported to the relevant authority within 72 hours of detection and to affected subjects without undue delay where the risk threshold is met.

Material changes are recorded in the change log and dated at the head of this file. We do not change the policy retroactively. Material changes to an active engagement are notified to you directly.