LEXANT SOCIETÀ BENEFIT TRA AVVOCATI S.R.L., with registered office in Milan (MI), Via Pietro Cossa no. 2 (zip code 20122), Tax Code and registration number 06831650962, represented by the legal representative pro tempore, Avv. Anna Luisa CAIMMI (hereinafter also referred to as “LEXANT”) and in its capacity as DATA CONTROLLER of personal, sensitive or judicial data (the "Controller") pursuant to Article 13 of Regulation 679/2016, provides the following information referred to as the "Privacy Notice".

LEXANT has appointed a Data Protection Officer (DPO) who can be contacted by writing to LEXANT SOCIETÀ BENEFIT TRA AVVOCATI S.R.L., with registered office in Milan (MI), Via Pietro Cossa no. 2 (zip code 20122) or at the email address: dpo@lexant.it.

Processing of personal, sensitive or judicial data refers to any operation or set of operations, carried out with or without the aid of automated processes and applied to personal, sensitive or judicial data or sets of personal, sensitive or judicial data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, erasure or destruction.

The processing of personal, sensitive or judicial data is based on the principles of lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality and is carried out in compliance with the rights, fundamental freedoms and dignity of individuals.

Types of data processed, purposes and legal basis of processing
The personal, sensitive or judicial data provided, including through various means such as dedicated forms or documents, will be processed for all activities related to the request for professional support, for the resulting management of the established working relationship, and for the pursuit of the purposes set out in the request for a professional or contractual relationship.

The data provided may also be processed for the following purposes:
a) management of payments and any non-compliance (credit recovery and litigation);
b) to establish, exercise or defend our rights in court;
c) compliance with legal obligations, or requirements in fiscal or accounting matters (e.g. invoicing);
d) with specific and separate consent, for commercial and marketing activities.

The processing of the provided data is permitted because:

• it is necessary for the performance of the professional contract of which the data subject is an integral part;
• it is necessary to fulfil our legal and/or regulatory obligations, for example, communication to authorities, government or regulatory bodies;
• it is necessary to initiate, pursue or defend legal actions;
• to represent you in appropriate venues;
• to carry out various acts required and envisaged by the professional mandate;
• it is based on explicit consent.

Nature of data provision and consequences of refusal
The provision of data, although optional, is necessary in relation to the purposes indicated above. In the case of processing based on consent, such consent is considered necessary. Any total or partial refusal to provide data or to give consent where required will make it impossible to pursue the related purposes.

Methods of processing
The processing of data is carried out with or without the aid of electronic, automated, IT or telematic tools, using logic strictly related to the purposes mentioned above. Data processing will be carried out lawfully and fairly, and in compliance with the regulations mentioned above, using appropriate tools to guarantee its security and confidentiality. Processing may also be carried out through automated tools suitable for storing, managing and transmitting the data.

Retention period
Our company retains data for the period necessary to fulfill legal, contractual and/or regulatory obligations. The data retention period depends on the purpose for which the data is processed and on the tools used to process such information. The criteria used to define the retention period are: the time necessary to achieve the related purpose, the time needed to carry out the contractual relationship, the time required by applicable laws.

At the end of the retention period, the data will be deleted or destroyed securely where possible, or anonymized.

Communication and disclosure of data
Data will not be disclosed to unknown parties. However, it may be communicated, where such communication is necessary and/or functional to the performance of our activity, in the ways and for the purposes described above, to external parties, who carry out processing activities as autonomous data controllers or as processors, belonging to the following categories:

• professional firms, administrative, labor, tax, legal and notarial consultants for legal compliance or to establish, exercise or defend our rights in court;
• IT service providers;
• public and private bodies, also following inspections, audits, management, for compliance with legal obligations and/or provisions of public authorities (e.g. tax administration, law enforcement, judicial authorities).

Third parties that process data on behalf of the CONTROLLER have been carefully selected and evaluated and are proven to have experience, skills, and reliability, providing adequate guarantees of full compliance with current data protection regulations, including the aspect of data security. As required by the Regulation, these third parties have been formally appointed by specific contract or legal act in accordance with national law as processors under Article 28 of the European Regulation and are subject to contractual and regulatory obligations to maintain and ensure the confidentiality of the data. Our company periodically verifies that the PROCESSORS have properly fulfilled the tasks assigned and continue to provide adequate guarantees of full compliance with data protection provisions. Furthermore, they will only have access to the information necessary to perform their duties.

Data may be communicated to external companies, formally appointed as DATA PROCESSORS, responsible for providing support services involving the processing of such data, such as professional IT services, legal, credit recovery, IT system and database management and maintenance (including customer data), administrative and accounting services, member assistance services.

A list of these data processors is always available and can be requested by contacting our organization via email at privacy@lexant.it.

Employees and collaborators of the Controller may also access and process the data, duly authorized, each within the limits of their functions and duties, and according to the instructions provided in the designation act.

Rights
The European Regulation specifically provides that data subjects have the following rights:

Rights of the data subject

• Right to access and obtain a copy of the data: the data subject has the right to request confirmation of the processing of the data. In some cases, an electronic copy of the data may be requested.
• Right to rectification of data: if the data in our possession is incorrect, there is always the possibility to request its update or correction, which will be carried out as soon as possible.
• Right to restriction of processing and right to erasure ("right to be forgotten"): in some cases, there is the right to request a restriction of the processing of data and/or the deletion of the same. A request can be submitted at any time; however, such right may in some cases be subject to legal rights or obligations, and therefore we may be required to retain the data for an appropriate period. If the request for deletion is found to be legitimate under the law, we will proceed immediately with the deletion of the data.
• Right to object: the data subject has the right to object at any time, for reasons related to their particular situation, to the processing of data concerning them. In such a case, we will refrain from further processing the data unless there are compelling legitimate grounds to proceed with the processing which override the data subject’s interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. At any time, one may object to processing for marketing purposes.
• Right to data portability: under certain conditions, the data subject has the right to receive their data in a structured, commonly used and machine-readable format, and to transmit those data to another controller. The types of formats are those commonly recognized by competent authorities.
• Right to lodge a complaint with a supervisory authority: one may lodge a complaint with the Italian supervisory authority, including for the purpose of requesting information regarding the exercise of one's rights.
• Withdrawal of consent: consent previously given may be withdrawn at any time. Consent for the processing of one’s personal, sensitive or judicial data, or for commercial or marketing purposes, may be revoked at any time using the methods provided or by sending an email to privacy@lexant.it. Any such withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal.

Methods of exercising rights
You may exercise your rights at any time by sending an email to: privacy@lexant.it.

Please note that, in the event of exercising your rights, we may ask you to verify your identity before proceeding with your request.

For any request, information or doubts, please contact us via email at: privacy@lexant.it.

Review clause
We reserve the right to review, modify and/or simply update, in whole and/or in part, in any way and/or at any time, without prior notice, this Privacy Notice, also in consideration of changes in laws and/or regulations regarding the protection of personal, sensitive or judicial data. In such case, we will take care to publish any significant changes made to this Privacy Notice by sending the updated notices to the addresses in our database or by contacting you directly through other available communication channels.

Consent
The consent requested concerns two specific types of data and purposes:

• Consent to the processing of personal, sensitive or judicial data necessary to carry out the assignment entrusted to us. In the absence of consent, we will not be able to proceed with our professional activity. The consent will also extend, if involved, to other individuals whose data is necessary for the professional activities. In the case of minors (under 16 years of age), additional consent from a responsible guardian will be required.
• Processing of data for making offers, commercial communications, subsequent sending of promotional and/or advertising materials, marketing activities.

Specifically, the processing for commercial and marketing activities may be carried out through "traditional" methods (postal mail, direct contacts) or through "automated" communication systems (SMS, phone calls without operator intervention, email, social networks, or other interactive applications).

The consent given for marketing activities through automated tools also extends to traditional contact methods. Consent is optional and in the absence of it, the Controller will not be able to process the data for the purposes indicated above without, however, affecting the Main Purpose.

We also reserve the right to process personal, sensitive or judicial data for further reasons than those stated in this notice, provided such processing is compatible with the purposes for which the data was originally collected or based on provided consent and in any case, after the issuance of an appropriate information notice.