Information on the protection of personal data
Pursuant to Article 13 of European Regulation 2016/679
In compliance with and for the purposes of Article 13 of EU Regulation 2016/679, Studio Fedeli & Olivotto Associati STP S.r.l., in its capacity as Data Controller and represented by its Chairman pro tempore, provides information on the purposes and methods of processing the personal data collected, the scope of their communication and dissemination, and whether providing them is mandatory or optional.
1) Data Controller
The Data Controller is Studio Fedeli & Olivotto Associati STP S.r.l., with registered office at Via Caravaggio, 3 – 20144 Milan, Italy, who can be contacted at the following email address: info@fedeliolivotto.it – certified email (PEC): infocert@pec.fedeliolivotto.it
2) Data Protection Officer
The Data Controller has appointed a Data Protection Contact, who can be reached by email at info@fedeliolivotto.it for any matter relating to the processing of personal data.
3) Purposes of processing the data collected
User Data are collected to allow the Data Controller to provide the Service, comply with legal obligations, respond to requests or enforcement actions, protect its rights and interests (or those of Users or third parties), and detect any malicious or fraudulent activity, as well as for the following purposes: information requests through the contact form, the “Work with us” form, the “Request a consultation” form, and newsletter subscription.
4) Types of data collected
The IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response (successful, error, etc.), other parameters relating to the user’s operating system and IT environment, information on the user’s behaviour on the Site and on the pages visited, as well as data on browsing behaviour on the Site, for example through the technical cookies and, only with consent, the statistics cookies described in the Cookie Policy. When processing personal data that may directly or indirectly identify you, we strive to respect the principle of strict necessity. For this reason, we have configured the Site so that the use of personal data is kept to a minimum, and so as to limit the processing of personal data that allow you to be identified to cases of necessity or to requests from the authorities and police forces (for example, for data relating to traffic and your time spent on the Site or your IP address), or to establish liability in the event of possible computer crimes against the Site.
Some sections of the Site will ask for certain personal data. The data collected and processed will be used solely for the purpose for which they were provided (for example, to reply to requests received or for newsletter subscription).
5) Processing methods
Personal data will be processed using automated tools in accordance with the principles of necessity and proportionality, avoiding the processing of personal data where operations can be carried out using anonymous data or by other means. We have adopted specific security measures to prevent the loss of personal data, unlawful or incorrect use and unauthorised access; however, please remember that, for the security of your data, it is essential that your device is equipped with tools such as constantly updated antivirus software and that the provider supplying your Internet connection guarantees secure data transmission through firewalls, anti-spam filters and similar safeguards.
6) Communication and dissemination
Data may be communicated to third parties for activities functional to the organisation, such as the maintenance and management of the website, and more generally to all employees, including those of Third Parties (providers of services, infrastructure, IT and similar), who are involved in its management and supervision and have been duly appointed as data processors. In such cases, the use of the data by third parties will fully comply with the principles of fairness and lawfulness.
Data are processed within EU countries and by non-EU countries that comply with the GDPR. Should this not be the case, data subjects will be informed pursuant to Article 13(1)(f) of European Regulation 2016/679, as required by the Regulation itself.
Data will not be disseminated.
To ensure the security of the Site and to manage the contact and newsletter services, we use the following third-party providers:
- Cloudflare, Inc. — “Turnstile” anti-spam verification service on the contact form. Data processed: IP address, technical information about the device and browser. Cloudflare is based in the United States; data transfers take place in accordance with the safeguards provided by the GDPR (standard contractual clauses / EU-US Data Privacy Framework). Privacy policy: cloudflare.com/privacypolicy
- The Rocket Science Group LLC (Mailchimp) — management of newsletter subscriptions. Data processed: email address. Mailchimp is based in the United States; data transfers take place in accordance with the safeguards provided by the GDPR (standard contractual clauses / EU-US Data Privacy Framework). Privacy policy: mailchimp.com/legal/privacy
- Google Ireland Limited (Google Analytics 4) — aggregate statistics on visits to the Site, active only with consent to statistics cookies. Data processed: browsing data and cookie identifiers; IP addresses are not stored. Any transfers to the United States take place in accordance with the safeguards provided by the GDPR (standard contractual clauses / EU-US Data Privacy Framework). Privacy policy: policies.google.com/privacy
7) Retention period
Data will be kept for the duration of the browsing session on the Site and for the time necessary to fulfil the purposes listed above, in compliance with the terms provided by law. After these periods, personal data will be destroyed, deleted or anonymised (unless already collected in anonymous form).
Requests sent through the website’s contact forms are also stored in an internal archive within the website, accessible only to authorised staff of the Studio, for a maximum of 12 months from receipt, after which they are automatically deleted.
8) Rights of the data subject
Rights under Articles 15, 16, 17, 18, 20, 21 and 22 of EU Regulation 2016/679.
As a data subject, in addition to the right to lodge a complaint with a supervisory authority, you also have the rights listed below, which you may exercise by sending a written request to the Data Controller as indicated in point 1.
- Art. 15 – Right of access
- Art. 16 – Right to rectification
- Art. 17 – Right to erasure (“right to be forgotten”)
- Art. 18 – Right to restriction of processing
- Art. 19 – Notification obligation regarding rectification or erasure of personal data or restriction of processing
- Art. 20 – Right to data portability
- Art. 21 – Right to object
- Art. 22 – Right not to be subject to a decision based solely on automated processing, including profiling
To exercise the rights provided for by Articles 15 et seq. of European Regulation 2016/679, please write to the email address indicated at the beginning of this document, for the attention of the Data Controller and of the formally appointed Data Protection Officer.
9) Nature of the provision of data, legal basis and consequences of refusal
Providing your data for processing is optional; however, if you do not provide the data marked as mandatory in the forms, we will not be able to follow up on your request. The legal bases for processing are as follows:
- requests sent through the contact form and the “Request a consultation” form: performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of EU Regulation 2016/679);
- applications sent through the “Work with us” form: performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b));
- newsletter subscription: consent of the data subject (Article 6(1)(a)), which may be withdrawn at any time through the unsubscribe link included in every email;
- Site security and abuse prevention (for example, anti-spam verification of the forms): legitimate interest of the Data Controller (Article 6(1)(f)).
For any processing of your personal data falling within Article 6 of Regulation 2016/679, you will be asked, as required by applicable law, for explicit consent for each specific type of processing.
For any processing of your personal data falling within Article 7 of EU Regulation 2016/679, you will be asked each time, as required by applicable law, for explicit consent for each specific type of processing.
Images and videos on the Site
Some images and videos on the Site, portraying the Studio’s professionals and staff, were processed with artificial intelligence tools starting from real photographs: the images were retouched to improve their quality and some were animated to create short videos. The people portrayed have consented to this use.
This English version is provided for convenience only; in case of discrepancy, the Italian version prevails.
Last updated: 03/10/2026