Privacy notice.

1. Data controller

No data protection officer (DPO) has been appointed, as the conditions requiring one are not met.

2. Data processed

• Browsing data: IP addresses, logs and technical parameters automatically collected by the Site’s systems for its operation and security.
• Cookies and similar tools: please see the Cookie Policy, which can also be managed from the preferences banner.
• Data provided voluntarily: identification and contact data and any information communicated through the Site’s forms, e-mail, PEC (Italian certified e-mail), telephone or WhatsApp.
• AI assistant: the content of conversations with the virtual assistant, processed in order to provide a reply and, where appropriate, to hand the matter over to a professional of the firm.
• Documents submitted: documents and information sent for assessments, quotes or in the course of the engagement, which may include accounting, tax and social security data and, where strictly necessary, special categories of data (art. 9 GDPR).
• Client area: access credentials and data made available in the client area.
• Video calls and remote support: technical session data; sessions are not recorded, unless expressly agreed otherwise.
• Payments: data resulting from the bank transfers received (payer, payment reference), processed for accounting reconciliation.

3. Purposes and legal bases

• Replying to requests, assessments and quotes — pre-contractual measures at the data subject’s request (art. 6.1.b GDPR).
• Performance of the professional engagement and the related obligations (art. 6.1.b).
• Legal obligations, including tax and accounting obligations and anti-money-laundering customer due diligence under D.Lgs. 231/2007 (art. 6.1.c).
• Security of the Site and prevention of abuse; establishment, exercise or defence of legal claims — legitimate interest (art. 6.1.f).
• Statistics on use of the Site through analytics tools, and informational communications from the firm — consent (art. 6.1.a), which may be withdrawn at any time.

Providing data is voluntary, but the data marked as required is essential in order to act on the request; for engagements, some processing operations are imposed by law.

4. AI assistant: specific warnings

Conversations with the virtual assistant are processed, on behalf of the firm, by technology providers acting as data processors. The replies are generated automatically and serve only as an initial orientation; no decision producing legal effects concerning the data subject is taken solely by automated means (art. 22 GDPR). You are advised not to enter unnecessary personal data in the chat or data relating to third parties.

5. Recipients

The data may be processed by authorised staff of the firm and by external parties carrying out ancillary activities, such as hosting and IT service providers, e-mail and PEC platforms, providers of the AI assistant, videoconferencing and remote support services, banks and consultants; those parties act as independent controllers or as processors under art. 28 GDPR. The data may be disclosed to public administrations and public bodies where required by law. The data is not disseminated to the public.

6. Transfers outside the EU

Some providers (for example Google services or artificial intelligence platforms) may involve transfers of data to third countries. In such cases transfers take place on the basis of adequacy decisions of the European Commission (including the EU-US Data Privacy Framework) or of standard contractual clauses under art. 46 GDPR.

7. Retention

• Requests not followed by an engagement: up to 24 months from the reply.
• Data relating to professional engagements: 10 years from the end of the engagement, under art. 2220 of the Italian Civil Code and tax legislation; anti-money-laundering data for 10 years under D.Lgs. 231/2007.
• Technical browsing logs: for the time strictly necessary, save for security or legal requirements.
• Data processed on the basis of consent: until consent is withdrawn.

8. Rights of the data subject

Data subjects may exercise the rights under arts. 15-22 GDPR: access, rectification, erasure, restriction, portability and objection, and may withdraw their consent at any time without affecting the lawfulness of processing carried out beforehand. Requests should be addressed to the controller’s contact details given in point 1. It is always possible to lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority) (www.garanteprivacy.it).

9. Professional secrecy

The data is also processed in compliance with professional secrecy and with the rules of conduct of the Dottori Commercialisti (Italian chartered accountants), with technical and organisational measures adequate to ensure its confidentiality, integrity and availability.

10. Minors

The Site and the firm’s services are not intended for children under 14; the firm does not knowingly collect data relating to minors.

11. Updates

This notice may be updated: the version in force is always published on this page together with the date of the last update.

Last updated: 24 July 2026