/ Notice
Privacy & Cookies
Information notice on personal data processing pursuant to Reg. (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended, with full disclosure of the cookies actually used by this website.
1. Data Controller
Studio Legale Mittone, in the person of Avv. Marco Mittone, member of the Bar Association of Turin (Ordine degli Avvocati di Torino).
Main office: Via Morghen 22 — 10143 Turin (Italy). Secondary office: Cascina dall'Osta 2 — 10051 Avigliana (TO), Italy.
Email: segreteria@mittone.it · Certified email (PEC): marco.mittone@pec.ordineavvocatitorino.it (to be confirmed).
2. Categories of data processed
Data provided by the client
- Identification and contact data (name, surname, tax code, residential address, email, telephone, certified email).
- Identity document and tax code card data (verified and retained pursuant to Italian Legislative Decree 231/2007 — AML).
- For legal entities: company name, VAT number, registered office, data of the legal representative and the beneficial owner, chamber of commerce extract, by-laws.
- Data relating to the professional engagement and case file (deeds, contracts, correspondence, expert reports).
- Any data of counterparties and parties involved, collected for the performance of the engagement.
- AML adequate verification data (purpose of the engagement, source of funds, PEP profile, estimated volume of operations).
Data automatically collected by the website
- IP address and technical browsing data contained in server logs (hosting provider), retained for the time strictly necessary for technical security purposes and then deleted.
- User preference on the cookie banner (see section 8).
3. Purposes and legal bases
- Performance of the professional engagement awarded by the client — legal basis: art. 6(1)(b) GDPR (performance of contract).
- Compliance with anti-money-laundering obligations — legal basis: art. 6(1)(c) GDPR and Italian Legislative Decree 231/2007 (legal obligation).
- Tax, accounting and professional bookkeeping obligations — legal basis: legal obligation.
- Operational communications on the case file (document requests, deadlines, confirmations) — performance of contract.
- Possible internal use of artificial intelligence tools to support drafting, research and document analysis — legal basis: optional consent of the data subject (art. 6(1)(a) GDPR), revocable at any time.
4. Processing methods
Processing is carried out using electronic tools and, limited to case-file documents, paper supports, in such a way as to ensure security, confidentiality and integrity. Data is stored on systems under the Firm's control (Google Workspace for email and operational documents, locally encrypted archive for case files). At-rest encryption, controlled access with multi-factor authentication, immutable audit log.
5. Retention
- 10 years from closing of the engagement for AML adequate verification data (art. 31 of Italian Legislative Decree 231/2007).
- 10 years for professional accounting and engagement-related deeds (art. 2220 of the Italian Civil Code).
- Longer periods if required by specific limitation periods or legal obligations.
- Technical browsing data is retained for the time strictly necessary for IT security.
6. Disclosure and transfer
Data may be disclosed to third parties only when necessary for the performance of the engagement or to comply with a legal obligation: opposing parties, judicial and administrative authorities, appointed technical consultants, court-appointed experts, the Firm's accountants. All such parties act under professional confidentiality or specific data processing agreements.
Transfers outside the EU: not envisaged in the ordinary course. Any technical transfers (e.g. IT providers using cloud services) take place only towards countries with an EU adequacy decision, or on the basis of Standard Contractual Clauses with a transfer impact assessment.
7. Rights of the data subject
The data subject has the right to:
- access their data (art. 15 GDPR);
- request rectification (art. 16) or erasure (art. 17, within the limits compatible with engagement-related and AML retention obligations);
- request restriction of processing (art. 18);
- exercise data portability (art. 20) for data provided on a contractual or consensual basis;
- object to the processing (art. 21);
- withdraw at any time any optional consent given (e.g. use of AI tools).
Requests may be addressed to segreteria@mittone.it. The right to lodge a complaint with the Italian Data Protection Authority remains unaffected (www.garanteprivacy.it).
8. Cookies
The website mittone.it uses exclusively technical and necessary cookies and browser-storage technologies, i.e. strictly functional to the operation of the site itself. There are no profiling, analytics, marketing or third-party cookies.
Full list of cookies / local data used
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
slm-cookie-consent |
Browser localStorage | Stores the user's preference on the cookie banner (acceptance / refusal). Required so the banner is not shown again at every visit. | 12 months | Technical — necessary, no consent required |
External resources
The site loads only self-hosted fonts (Mittone Sans Prototype) and inline SVG icons. No requests are made to third-party CDNs that could set cookies. External links (Google Maps, institutional sources in the news section) open in a new tab and do not share cookies with the mittone.it domain.
How to change your preference
The user may withdraw their consent by deleting the site's storage data from the browser (localStorage), or by using the browser's site-data clearing function. On the next visit the cookie banner will be shown again.
9. Security
The Firm adopts technical and organisational measures appropriate to the risk: at-rest and in-transit encryption (TLS 1.3 + Let's Encrypt), multi-factor authentication on critical systems, access audit log, environment segregation, retention coded by data category, periodic staff training.
10. Automated decisions and profiling
The Firm does not carry out automated decision-making or profiling within the meaning of art. 22 GDPR. Any internal use of artificial intelligence tools is always subject to qualified human review and does not produce automated decisions with effects on the data subject.
11. Changes
This notice may be updated. The current version is always the one published at https://mittone.it/privacy-en.html. Material changes will be notified to the client through the existing contact channels.
12. Contacts
For any request regarding data processing: segreteria@mittone.it. The Firm has not appointed a Data Protection Officer (DPO) since the conditions for mandatory designation under art. 37 GDPR are not met; the controller responds directly.