Pursuant to and for the purposes of the aforementioned Regulation, concerning the “protection of natural persons with regard to the processing of personal data,” BSVA CORPORATE TAX – Professional Association, with headquarters in Milan, Via Borgonuovo 9, acting as Data Controller (hereinafter “BSVA” or “Controller”), is required to provide certain information regarding any personal data collected from the Customer concerning natural persons, acting as “Data Subjects.”

The data held by the Data Controller is normally collected directly from the Client and/or from the Data Subjects and occasionally also from third parties.
In the event that the data subject’s personal data is not collected directly from the data subject, the Controller, pursuant to Article 14(g) of the Regulation, hereby informs you that no automated decision-making processes are in place, including profiling as referred to in Article 22(1) and (4).

The data is processed as part of the Data Controller’s normal business activities, for the following purposes:

1. purposes strictly connected to and instrumental to the professional mandate in place between the parties and to the fulfillment of the obligations arising from said mandate;

2. purposes related to obligations established by national or supranational laws or regulations, as well as by measures issued by national or supranational bodies or authorities. These purposes include activities required for the fulfillment of obligations under anti-money laundering legislation, where applicable;

3. purposes related to the provision of information to Data Subjects by the Data Controller regarding specific professional matters and related services, as well as information on activities and/or events organized by BSVA, including via email.

In relation to the aforementioned purposes, the processing of personal data will be carried out in a manner that ensures its security and confidentiality, as well as respect for the rights and freedoms of the data subjects, and may be performed using manual, computerized, and telematic tools designed to store, manage, and transmit such data. The logic of the processing will be strictly related to the purposes described.
The provision of data for the purposes referred to in point 1) is optional; however, a refusal to do so would effectively make it impossible to manage existing pre-contractual and/or contractual relationships. The provision of data for the purposes referred to in point 2) is mandatory as it is necessary to comply with regulatory obligations.
The provision of data for the purposes referred to in point 3) is optional.
The processing of personal data for the purpose referred to in point 3) above requires the consent of the data subject.

Please note that, should the assignment entrusted to us necessarily also involve the processing of personal data of individuals other than the Client (such as its employees, customers, suppliers, consultants, or counterparties in general), it is the Client’s responsibility to inform the Data Subjects and obtain, where required, the necessary consents for the processing of their personal data by the Data Controller, it being understood that the request made to us to perform the assignment shall constitute a presumption, pursuant to Article 2729 of the Civil Code, that the Client has fulfilled the related duty to inform and has obtained consent (where required) from the Data Subjects in favor of the Data Controller.

The data of the Data Subjects may be disclosed to the following categories of third parties:

• public authorities in connection with the fulfillment of specific legal obligations or pursuant to legitimate measures;
• administrative, judicial, and tax authorities, in the cases and subject to the limitations provided for by law;
• the Data Controller’s consultants and/or insurers;
• Service providers.

The personal data we collect and process as described above may be disclosed to entities based or residing in the European Union, which are also subject to the Regulation.
The disclosure of data to the categories of entities listed above does not require the consent of the data subjects.
The data of the data subjects will be made available to the professionals responsible for carrying out the assignment, as well as to the relevant support staff, who are authorized to process the data pursuant to Article 29 of the Regulation.

Duration of processing and retention of personal data

The processing referred to in this policy will last for the period strictly necessary to fulfill the obligations imposed on the Data Controller by national and/or supranational laws, as well as by the laws of the countries to which the data may be transferred. By way of example, personal data will be processed and retained for the entire duration of the contractual relationship and, subsequently, for 10 years, which is the standard statute of limitations.

Contact details of the Data Controller

The Data Controller is BSVA CORPORATE TAX – Professional Association, with headquarters in Milan, Via Borgonuovo 9, which can be contacted at the email address studioviganocarrara@legalmail.it.

Rights of Data Subjects (Articles 15 to 22 of the Regulation)

Finally, we inform you that Articles 15 to 22 of the Regulation grant data subjects the exercise of specific rights. In particular, data subjects may obtain from the Data Controller, with regard to their personal data: access (Article 15); rectification (Article 16); erasure – the right to be forgotten – (Article 17); restriction of processing (Art. 18); notification in the event of rectification, erasure, or restriction (Art. 19); data portability (Art. 20); the right to object (Art. 21); and the right not to be subject to automated decision-making and profiling (Art. 22). Data subjects have the right to lodge a complaint with the Supervisory Authority.