Last updated: 8 November 2026

1. Data Controller

The controller of personal data is Marzo Associati – Legal and Tax Firm, with its registered office at Via Ancona, 20 – 00198 Roma (RM), VAT No. 06397770964.

For any information concerning the processing of personal data, you may contact the Controller using the following contact details:

Email: segreteria@marzoassociati.it
Telephone: +39 06 894 109 29
Indirizzo: Via Ancona, 20 – 00198 Roma (RM)

2. Types of Data Collected

The Controller collects the following categories of personal data:

Browsing Data

The IT systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols (e.g. IP addresses, domain names, request times, parameters relating to the user's operating system and IT environment).

Data Provided Voluntarily

The optional, explicit and voluntary sending of messages through the contact forms on the website, as well as the sending of emails to the addresses provided, entails the subsequent collection of the sender's data, which are necessary to respond to requests, and any other personal data included in the communication. In particular:

First name and surname
Email address
Telephone number (if provided)
Company/Organisation (if provided)
Message content

3. Purposes of Processing

Personal data are processed for the following purposes:

Handling contact requests: to respond to requests for information or advice submitted through the contact forms or by email;
Compliance with legal obligations: to comply with obligations imposed by law, regulations, EU legislation or an order issued by an authority;
Difesa in giudizio: to protect the Controller's rights in legal proceedings;
Analisi statistiche: to compile anonymous statistics on the use of the website;
Service improvement: to improve the quality of the services offered and the browsing experience.

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds pursuant to art. 6 of the GDPR:

Consent of the data subject (art. 6, par. 1, lett. a): to send promotional communications and newsletters;
Taking pre-contractual steps (art. 6, par. 1, lett. b): to respond to requests for advice and quotations;
Compliance with legal obligations (art. 6, par. 1, lett. c): to comply with legal obligations;
Legitimate interest (art. 6, par. 1, lett. f): to ensure website security and prevent fraud.

5. Methods of Processing

Personal data are processed through operations, including automated operations, involving the collection, recording, organisation, storage, consultation, processing, alteration, selection, extraction, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data.

Personal data are processed using automated tools for no longer than is strictly necessary to achieve the purposes for which they were collected. Specific security measures are implemented to prevent data loss, unlawful or improper use and unauthorised access.

6. Retention Period

Personal data will be retained for no longer than is strictly necessary to fulfil the purposes for which they were collected, in accordance with the principles of data minimisation and storage limitation under art. 5 of the GDPR. In particular:

Browsing data: retained for a maximum of 24 months;
Contact data: retained for the time necessary to deal with the request and, subsequently, for the statutory limitation period (10 years);
Data for marketing purposes: retained until consent is withdrawn.

7. Data Recipients

Personal data may be disclosed to:

The Controller's collaborators and employees, as persons authorised to process personal data;
IT and hosting service providers;
Advisers and professionals appointed to protect the Controller's rights;
Judicial and administrative authorities, where provided for by law.

8. Trasferimento Dati Extra-UE

Personal data are stored on servers located within the European Union. Should it become necessary to transfer data to third countries, this will be done in compliance with the safeguards provided for in Chapter V of the GDPR (adequacy decisions, standard contractual clauses, binding corporate rules, approved certifications or other specific derogations).

9. Diritti dell'Interessato

Under Articles 15–22 of Regulation (EU) 679/2016, the data subject has the right to:

Access (art. 15): obtain confirmation as to whether data concerning them are being processed and access those data;
Rectification (art. 16): obtain the rectification of inaccurate data or the completion of incomplete data;
Erasure (art. 17): obtain the erasure of data where the relevant conditions are met;
Restriction (art. 18): obtain restriction of processing;
Portability (art. 20): receive the data in a structured, machine-readable format;
Objection (art. 21): object to processing on legitimate grounds;
Withdrawal of Consent (art. 7): withdraw consent at any time.

To exercise their rights, the data subject may send a written request to segreteria@marzoassociati.it.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority, whose offices are at Piazza Venezia n. 11 – 00187 Roma, email: protocollo@gpdp.it, PEC: protocollo@pec.gpdp.it.

10. Cookie

For information on this website's use of cookies, please see our Cookie Policy.

11. Changes to the Privacy Policy

The Controller reserves the right to amend, update, supplement or remove parts of this notice at its discretion and at any time. Users are invited to check this page periodically for any updates. Changes will take effect from the date of publication on the website.