Privacy Policy

Information on the processing of personal data

pursuant to Articles 13 and 14 of EU Regulation 2016/679

Last updated: June 9, 2026

1. Data Controller

The Data Controller is:

ARIA Legal & Compliance

Milan Office: Via Larga 2, Milan
Florence Office: Corso Italia 29, Florence

Firm Representatives:

Avv. Paola Casaccino – pcasaccino@arialc.it
Avv. Alessandro Legnante – alegnante@arialc.it

For any request relating to the processing of personal data, the exercise of privacy rights, or this privacy policy, you may contact the Data Controller at the following address: segreteria@arialc.it

This privacy policy describes how Aria Legal & Compliance processes the personal data of users who visit the website, submit contact requests, request information about the Firm’s services, participate in events or training activities, or engage with the Firm in the context of professional, consultancy, or contractual relationships.

2. Personal data processed

Depending on the manner of interaction with the Firm, the following categories of personal data may be processed:

identification and contact data, such as name, surname, email address, telephone number, company or organization, role or business function;
data contained in communications sent to the Firm via email, contact forms, or other channels;
data necessary for managing consultancy requests, quotations, professional engagements, contractual, administrative, and accounting relationships;
data relating to participation in webinars, courses, events, meetings, or informational initiatives;
data contained in documentation transmitted to the Firm in the context of professional engagements, consultancy activities, audits, compliance, privacy, data protection, Model 231, anti-corruption, anti-money laundering, KYC, third-party verifications, supply chain audits, or other legal and consultancy activities;
browsing data automatically collected by the website’s IT systems, such as IP address, browser technical data, access logs, and information relating to website usage;
any data contained in CVs or unsolicited applications.

In the context of specific professional engagements, the Firm may also process data belonging to special categories pursuant to Article 9 GDPR or data relating to criminal convictions and offenses pursuant to Article 10 GDPR, exclusively when this is necessary for the performance of the engagement, for compliance with legal obligations, for the establishment, exercise, or defense of a legal claim, or within the limits permitted by applicable law.

Users are invited not to transmit data that is unnecessary, excessive, or not relevant to the request submitted.

3. Purposes and legal bases of processing

Personal data is processed for the following purposes:

to enable website navigation and ensure its proper technical functioning and security;
to respond to requests for information, contact, consultancy, appointments, or quotations;
to establish, manage, and perform professional, contractual, consultancy, or pre-contractual relationships;
to carry out legal and consultancy activities in the field of integrated compliance, privacy and data protection, GDPR, Model 231, anti-corruption, anti-money laundering, whistleblowing, gender equality, KYC, audits, training, cybersecurity, NIS2, AI governance, and other areas related to the Firm’s services;
to comply with legal, tax, accounting, professional, and ethical obligations;
to organize and manage events, webinars, courses, and training initiatives;
to send, where requested or permitted, regulatory updates, professional communications, event invitations, or informational content relating to the Firm’s activities;
to evaluate any unsolicited applications;
to protect the rights of the Firm, clients, or third parties in judicial, extrajudicial, administrative proceedings, or before competent authorities;
to prevent abuse, unauthorized access, IT fraud, or improper use of the website and the Firm’s systems.

The legal bases of processing are, as applicable: performance of a contract or pre-contractual measures; compliance with legal obligations; legitimate interest of the Data Controller; consent of the data subject, where required; establishment, exercise, or defense of a legal claim; additional lawfulness conditions provided by Articles 9 and 10 GDPR, where applicable.

4. Processing methods, security, and retention

The processing of personal data is carried out using manual, IT, and electronic tools, in compliance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability provided by the GDPR.

The Firm adopts appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, alteration, disclosure, or unlawful processing.

Personal data is retained for the time necessary to achieve the purposes for which it was collected and, subsequently, for the period required by legal, tax, accounting, professional, or ethical obligations, as well as for the time necessary to protect the rights of the Firm, clients, or third parties.

In particular: data collected through contact requests is retained for the time necessary to manage the request; data relating to professional engagements is retained for the duration of the engagement and subsequently for applicable terms; administrative, tax, and accounting data is retained for the terms provided by law; data for informational communications or newsletters is retained until consent is withdrawn or objection is raised; data relating to unsolicited applications is retained for a maximum period of 24 months, unless otherwise necessary or with specific consent; browsing data is retained for the time strictly necessary for the functioning and security of the website.

5. Data disclosure, processors, and transfers outside the EU

Personal data may be processed by partners, professionals, collaborators, employees, or persons authorized by the Firm, within the limits of their respective duties and in compliance with confidentiality obligations.

Data may also be disclosed to third parties when this is necessary for the purposes indicated in this privacy policy, including providers of IT services, hosting, cloud, email, security, website maintenance, and digital tools; tax, accounting, administrative, and other professional consultants; professional partners involved in the performance of engagements; clients, counterparties, technical consultants, experts, certification bodies, or supervisory bodies; judicial, administrative, tax, supervisory, or regulatory authorities.

Parties that process personal data on behalf of the Firm are appointed, where necessary, as Data Processors pursuant to Article 28 GDPR.

Personal data is not subject to public disclosure, unless this is required by law or necessary in the context of specific activities for which adequate information has been provided.

Data is processed primarily within the European Economic Area. Should it become necessary to transfer personal data to third countries or international organizations, the transfer will take place in compliance with Articles 44 et seq. GDPR, on the basis of adequacy decisions, Standard Contractual Clauses, or other safeguards provided by applicable law.

6. Cookies and tracking tools

The website may use technical cookies necessary for the functioning of the website and, where activated, analytical, functional, profiling cookies, or other tracking tools.

Technical cookies do not require user consent. The use of non-technical cookies or tracking tools that are not strictly necessary occurs only with the user’s prior consent, where required by applicable law.

Users may manage or withdraw their preferences through the tools made available on the website.

For more information on the types of cookies used, purposes, duration, third parties involved, and consent management methods, please refer to the specific Cookie Policy published on the website.

7. Processing carried out in the context of professional engagements

In the context of professional engagements entrusted to the Firm, Aria Legal & Compliance may process personal data as an independent Data Controller, when it determines the purposes and means of processing in relation to the professional activity carried out, or as a Data Processor pursuant to Article 28 GDPR, when it processes personal data on behalf of a client acting as Data Controller.

In such cases, the Firm’s privacy role is assessed based on the nature of the engagement, the activities actually carried out, and the agreements reached with the client.

When the Firm operates as a Data Processor, processing takes place on the basis of specific documented instructions from the client and a specific agreement pursuant to Article 28 GDPR.

Information and documentation acquired in the context of professional engagements is processed in compliance with confidentiality obligations, professional secrecy, legal regulations, and applicable data protection principles.

8. Newsletters, regulatory updates, and events

The Firm may send informational communications, regulatory updates, invitations to webinars, events, courses, or in-depth content relating to its areas of activity.

Such communications are sent on the basis of the data subject’s consent, where required, or on the basis of the legitimate interest of the Data Controller within the limits permitted by applicable law and in relation to professional relationships or contacts already established.

The data subject may object at any time to receiving such communications by writing to segretaria@arialc.it or by using the unsubscribe tools that may be present in the communications received.

9. Data subject rights

The data subject may exercise, within the limits and under the conditions provided by the GDPR, the following rights:

right of access to personal data;
right to rectification of inaccurate or incomplete data;
right to erasure of personal data;
right to restriction of processing;
right to data portability, where applicable;
right to object to processing;
right to withdraw consent at any time, where processing is based on consent;
right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect the individual;
right to lodge a complaint with the Supervisory Authority for the protection of personal data.

To exercise their rights, the data subject may write to: segretaria@arialc.it

The Data Controller will respond to requests within the timeframes provided by applicable law.

10. Complaint to the Supervisory Authority

Data subjects who believe that the processing of their personal data is in violation of applicable law have the right to lodge a complaint with the Supervisory Authority for the protection of personal data.

Supervisory Authority for the protection of personal data

Piazza Venezia 11
00187 Rome

www.garanteprivacy.it

The data subject’s right to bring proceedings before the competent courts remains unaffected.

11. Updates to this privacy policy

This privacy policy may be modified or updated over time, including due to regulatory changes, measures by competent authorities, updates to the services offered, technical changes to the website, or organizational changes within the Firm.

The updated version will be published on the website with an indication of the date of last update.