Privacy notice

Privacy Policy

Last updated: July 2026

This notice is provided pursuant to Regulation (EU) 2016/679 (GDPR) and to Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, in relation to data processed through the website www.studionebbiolo.it.

1. Data Controller

The Data Controller is Studio Nebbiolo Società tra Avvocati S.r.l., with registered office at Via Alberico Albricci 9, 20122 Milan, Italy (VAT 00211030184). For any matter relating to personal data you may write to info@studionebbiolo.it.

2. Personal data processed

Browsing data: technical data whose transmission is implicit in the use of Internet protocols (e.g. IP addresses, browser type, request times), used solely to obtain anonymous statistical information on the use of the site and to ensure its correct functioning and security.
Data provided voluntarily: the data (full name, company, email address, telephone number, message content) that the data subject provides by completing the contact form or writing to the addresses indicated.

3. Purposes and legal basis

To respond to contact requests and provide the information requested — legal basis: performance of pre-contractual measures and the Controller's legitimate interest (Art. 6.1.b and 6.1.f GDPR).
To ensure the operation and security of the site — legitimate interest (Art. 6.1.f GDPR).
To comply with legal obligations — Art. 6.1.c GDPR.

4. Nature of the provision of data

Providing data via the contact form is optional; failure to provide it merely makes it impossible to respond to the request.

5. Method of processing and retention

Data is processed using electronic and paper means, adopting technical and organisational measures adequate to ensure its security and confidentiality. Data is retained for the time strictly necessary to handle the request and, thereafter, for the period required by any legal obligations.

6. Recipients of the data

Data may be processed, on behalf of the Controller and as data processors, by providers of technical, hosting and communication-management services. Data is not disclosed to the public.

7. Transfer to third countries

Should the technical providers involve a transfer of data to countries outside the European Economic Area, this will take place in compliance with the safeguards provided by Articles 44 et seq. of the GDPR (for example the standard contractual clauses adopted by the European Commission).

8. Rights of the data subject

The data subject may at any time exercise the rights provided by Articles 15-22 of the GDPR: access, rectification, erasure, restriction, objection to processing and data portability, by writing to the Controller's contacts indicated in point 1. They also have the right to lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — garanteprivacy.it).

9. Changes

The Controller reserves the right to update this notice; any changes will be published on this page with the date of update.