Information on the processing of personal data
Please read this notice carefully. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and concerns the personal data processed while browsing the website www.arco.law (=Website).
1. Data controller
The data controller is Arco società tra avvocati a.s. di F. Cassera Di Marco (=Arco Avvocati), tax code, VAT number and Modena Companies Register no. 04061800365, with registered office at via Pietro Giardini, 139, 41124 Modena, registered with the Modena Bar Register, fax 059 210 962, certified email (PEC) arco@pec.arco.law.
2. Personal data processed
Arco Avvocati processes personal data provided or otherwise collected while browsing the website (for example IP address, domain names, browser type, device data, use of links), as well as data collected through cookies. Arco Avvocati also processes data voluntarily provided via the addresses arco@arco.law and lavoraconnoi@arco.law.
3. Purposes of processing and legal bases
(a) The processing of browsing data, including through cookies, is intended to ensure the proper functioning and security of the website and to defend the rights of Arco Avvocati; it is lawful as it is necessary for the purposes of a legitimate interest of Arco Avvocati (Art. 6(1)(f) GDPR).
(b) The processing of browsing data is intended to collect statistical data on use of the website through cookies and is lawful as it is based on the data subject’s consent given in the cookie banner (Art. 6(1)(a) GDPR).
(c) The processing of voluntarily provided data is intended to respond to the data subject’s contact requests or to assess their unsolicited job application; it is lawful as it is necessary to take steps prior to entering into a contract (Art. 6(1)(b) GDPR) or is necessary for exercising the data subject’s rights in the field of employment and social security and social protection law (Art. 9(2)(b) GDPR).
4. Processing methods
Arco Avvocati processes personal data in accordance with the principles of fairness, lawfulness, purpose limitation, quality, relevance, proportionality and transparency and, where applicable, in compliance with the rules of professional conduct and the Rules of Conduct set out in measure no. 512 of 19.12.2018 of the Italian Data Protection Authority (Garante per la protezione dei dati personali). To this end, Arco Avvocati adopts, among other things, appropriate security measures to prevent unauthorised processing of personal data or processing not consistent with the purposes stated above.
Arco Avvocati may also process personal data using artificial intelligence systems, solely for instrumental activities supporting its professional work in accordance with Article 13 of Law No. 132/2025 (by way of example only, organisational and secretarial tasks, legislative and case-law research, preliminary document analysis). The artificial intelligence systems used by Arco Avvocati ensure compliance with the GDPR and Regulation (EU) 2024/1689 (AI Act), safeguard professional secrecy and do not use personal data for training purposes.
5. Disclosure of personal data
In accordance with Arco Avvocati’s Privacy Policy, the personal data collected are processed by lawyers, employees and collaborators of Arco Avvocati who are authorised to do so and have received appropriate instructions, in particular regarding the security of processing.
Where required by law or necessary to achieve the stated purposes, personal data may be disclosed to other specifically identified recipients, in particular to service providers of Arco.
Browsing data (but not data provided via the addresses arco@arco.law and lavoraconnoi@arco.law) may be shared with Squarespace, Inc., which, as data processor for Arco Avvocati, hosts the website www.arco.law. Squarespace, Inc. is based in the United States and is certified under the EU-US Data Privacy Framework. Data are transferred on the basis of the safeguards provided for in Articles 45 and 46 GDPR (adequacy decision for companies certified under the EU-US Data Privacy Framework and standard contractual clauses approved by the European Commission).
6. Retention of personal data
The personal data collected are processed for as long as necessary to achieve the purposes stated above. Data collected through cookies are retained as indicated in the Cookie Policy. Data voluntarily provided via the addresses arco@arco.law and lavoraconnoi@arco.law are retained for 12 months.
7. Provision of personal data
The provision of personal data is necessary to achieve the stated purposes. Failure to provide them, or providing them only in part, as well as any subsequent request for their erasure, may prevent the professional engagement from being concluded or lead to its termination, or may compromise the performance of the professional mandate.
8. Rights of the data subject
The data subject may at any time exercise the rights set out in Articles 15 et seq. GDPR with regard to their personal data by sending a message to arco@pec.arco.law with the subject line “Esercizio diritti privacy”. In particular, the data subject has the right to obtain, among other things:
- confirmation as to whether their personal data are being processed, access to such data, and information on how the processing is carried out (Art. 15 GDPR);
- the updating of personal data, the rectification of inaccurate data and the completion of incomplete data (Art. 16 GDPR);
- the erasure of personal data that are no longer necessary for the stated purposes, unless Arco Avvocati needs them to comply with a legal obligation or to establish, exercise or defend its own legal claims (Art. 17 GDPR);
- the restriction of processing of personal data where they contest the accuracy of the data, for the period needed by Arco Avvocati to verify it, where the processing is unlawful, or where the data subject needs the personal data for the establishment, exercise or defence of legal claims (Art. 18 GDPR);
- the portability of the personal data provided, insofar as the processing is carried out by automated means (Art. 20 GDPR).
In addition, the data subject may withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Finally, the data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Art. 77 GDPR, as described on the website www.garanteprivacy.it.