1. Purposes of data processing
Personal data, including data obtained by third parties in performing the retainer, are processed by the professional association Di Stefano/Auer/Partner, the controller pursuant to sect. 13 of Legislative Decree 196/2003 (Privacy Code) for the purpose of performing the retainer and fulfilling the obligations of clients’ due diligence and data storage pursuant to the anti-money laundering provisions (Legislative Decree no. 231/2007 and the Ministry of Finance Decree no. 141 of February 3, 2006).


2. Means of data processing
2.1 Di Stefano/Auer/Partner may process personal data on paper as well as by means of computerized and/or electronic or anyhow automated equipment, using suitable procedures to protect their confidential nature and respect the minimum security measures set by the Privacy Code. In particular, Di Stefano/Auer/Partner adopts the technical, computerized, organizational, logistic and procedural security measures suitable to guarantee the minimum standard of protection of the data statutorily provided. Data processing consists in the collection, filing, management, storage, referencing, processing, modification, selection, screening, retrieval, comparison, use, interconnection, blockage, disclosure, erasure and destruction of data.
2.2 Data will be processed by Di Stefano/Auer/Partner and/or by the associates of Di Stefano/Auer/Partner appointed as processors and, where necessary for the performance of the retainer, also by external consultants of Di Stefano/Auer/Partner appointed as processors.


3. Nature of data disclosure
The disclosure of ordinary and sensitive personal data is strictly necessary in order to guarantee the full and exact fulfilment of the retainer and/or to perform related obligations. Pursuant to section 11 paragraph 1 lett. e) of the Privacy Code personal data are collected taking into account their effective necessity and data are stored for a period no longer than necessary for the purposes they were collected for or subsequently processed.


4. Refusal of data disclosure
In the event the data subject refuses to disclose the personal data, Di Stefano/Auer/Partner will not be able to perform the activities required in order to guarantee the full and exact fulfilment of the retainer.


5. Data sharing and dissemination
5.1 The disclosed personal data might be communicated to processors and to external collaborators and, in general, to all those subjects who might need such disclosure in order to guarantee full and exact fulfilment of the retainer.
5.2 The disclosed personal data will not be disseminated.


6. Transfer of personal data to third countries
Where necessary for the performance of the retainer, the disclosed personal data may be transferred to EU Member States and to third countries even if they do not guarantee a standard of protection equal to the Italian one.


7. Rights of the data subject
Sect. 7 of the Privacy Code grants the data subject specific rights:
1. to obtain from Di Stefano/Auer/Partner confirmation of the existence or non-existence of his/her personal data and its availability in an intelligible manner;
2. to know the source of the data, the purposes and the procedures of data processing, the rules applicable to the processing, the elements needed for identifying the data controller and the subjects to whom the data might be disclosed;
3. to obtain the update, correction and integration of the personal data, their cancellation, their anonymisation or the blockage of data processed in breach of the law;
4. on legitimate grounds, to oppose to the data processing, exception made for the mandatory processing set forth by the law.