Latest update: May 2025

This privacy notice (“Notice”), provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 General Data Protection Regulation (“Regulation” or “GDPR”), describes the processing of your personal data carried out by emlex – Eva Maschietto Massimo Maggiore (“emlex”, the “Law Firm”, “we”, “us”, “our”) as data controller and provides information regarding the use of artificial intelligence systems by emlex.

1. Data controller

For the purposes of this Notice and the processing activities described herein, the data controller (Article 4, n° 7 GDPR) is emlex – Eva Maschietto Massimo Maggiore, represented by each of its Partners shareholders, with registered office in Via Santo Spirito 3, 2021, Milano. emlex is a professional association provided by Law 31 December 2012, n.247 (regulation of the legal profession).

2. What personal data we process and legal basing of the processing

In the performance of its professional activities in legal assistance and consultancy – both in judicial and out-of-court matters – emlex may process various categories of personal data concerning the data subjects mentioned in this section.

2.1. Data related to candidates for job positions within the Law Firm

• Data processed

emlex may process the following personal data relating to persons applying for job positions within the Law Firm, both as professionals and employees (the “Candidates”), by contacting the Law Firm through the appropriate form on the website www.emlex.it (the “Website”) or through other channels (e.g. following job advertisements published on a Bar Association page or on social media platforms):

• Identification details (e.g. name, surname, date of birth, place of residence);

• Contact information (e.g. telephone number, e-mail address, mailing address);

• Personal image/portrait, when voluntarily provided by Candidates;

• Data relating to the candidate’s qualifications, education and professional career;

• Any additional information (including information related to financial or asset situation, as well as special categories of data) that Candidates may provide to emlex when submitting their application or during the selection process.

• Purposes of the processing

emlex processes Candidates’ personal data to assess whether their profiles match the Firm’s professional needs, to carry out the related selection procedures, and to facilitate potential hiring or collaboration.

• Legal basis for processing

The legal basis on which the processing of Candidates’ personal data by emlex is based is the need to perform a contract to which the data subject is party as well as to take steps at the request of the data subject prior to entering into a contract. In the event that, at the time of the application or during the subsequent selection process, a Candidate provides the Law Firm with special categories of data pursuant to Article 9 GDPR, the relevant legal basis will be the consent of the data subject.

• Source of data

emlex will receive the personal data of the Candidates directly from the Candidates- both within specific application process and spontaneous applications- or through third parties as Universities, Bar associations, research and recruitment companies and any other subject assigned to match job demand and offer. This data may be collected on the occasion of Law firm’s ordinary professional activity or contacts established during events, workshops, conventions, in particular by exchanging business cards.

• Retention period

In general, every Candidate’s personal data will not be stored for longer than 12 months after the end of the specific application the Candidate has applied for, except for the case of establishment of an employment relation and/or collaboration with the Law Firm. emlex may extend storage period with Candidate consent.

emlex may, also, extend Candidate’s personal data storage period if it is necessary to comply with a legal obligation or to protect its own right before a judicial, administrative or any other authority

2.2. Data relating to clients or prospects of the Law Firm

• Data processed

Within its professional activities, the Law Firm may process the following categories of personal data relating both to clients and prospects natural persons, as well as to employees, collaborators, representatives or contact persons of the Firm’s clients or of prospects that qualify as legal persons (hereinafter referred to as “Clients” and “Clients’ Contacts”):

• Personal identifiable information (e.g. name, surname, date of birth, residence);

• Contact details (e.g. telephone number, e-mail address, postal address);

• Data relating to economic situation;

• Data relating tocriminal convictions and offences, to the extent that its processing is necessary for the proper performance of the professional duties conferred to the Law Firm or to comply with legal obligations;

• Special categories of personal data pursuant to Article 9 GDPR;

• Any other personal data provided to the Law Firm by a Client and the processing of which is necessary for the proper performance of the professional duties assigned to the Law Firm or to comply with a legal obligation to which the Law Firm is subject.

• Purposes of the proceeding

The processing of Clients’ personal data is aimed at the proper performance of the professional duties assigned to the Law Firm and, where necessary, to comply with legal obligations to which the Law Firm is subject, including the know-your-customer obligations provided for by applicable legislation against money laundering and terrorist financing.

• Legal basis of the processing

The legal basis on which the processing of Clients’ personal data by the Law Firm is based is the need to perform a contract to which the data subject is party as well as to take steps at the request of the data subject prior to entering into a contract. For Clients’ Contacts, the legal basis is the legitimate interest of the Law Firm for the performance of the duties assigned by each Client for which the data subject works.

With regard to the processing of personal data relating to criminal convictions and crimes of Clients, the relevant processing is based on the need to comply with legal obligations to which the Law Firm is subject, including the know-your-customer obligations provided for by the applicable legislation against money laundering and terrorist financing.

The processing of special categories of personal data provided by the data subjects may be based either on the consent of the data subjects or on the need to ascertain, exercise or defend a right before a competent court. This is without prejudice to the case in which the data subject has made his or her data manifestly public.

• Source of data

emlex riceverà i dati personali dei propri Clienti direttamente dai Clienti o per il tramite di Referenti dei Clienti. Questi dati potrebbero, tra l’altro, essere raccolti in occasione dello svolgimento della ordinaria attività professionale ovvero di contatti instaurati in occasione di eventi, seminari, convegni, in particolare attraverso lo scambio di biglietti da visita.

• Retention period

emlex will store the personal data of its Clients for the period strictly necessary for purposes for which such data has been collected. In particular, emlex will store the data of Clients who contact the Law Firm for extra-judicial consulting activities for a maximum of 10 years after the end of the professional relationship established with the Law Firm.

The Law Firm will retain the personal data of Clients to whom it provides assistance in court for the entire duration of the relevant proceedings and, at the end of the proceedings, for as long as necessary for the performance of ancillary activities (e.g. lodging appeals, starting enforcing proceedings, etc.).

emlex may extend the storage period of Clients’ personal data where this is necessary to comply with a legal obligation or to defend a right of its own before a judicial, administrative or other authority.

2.3. Data relating to Clients’s counterparties and/or to third parties in judicial and extra-judicial matters

• Data processed

Within its professional activities, the Law Firm may process the following categories of personal data relating both to any counterparties of the Clients and/or third parties in judicial or extra-judicial matters, as natural persons, as well as to employees, collaborators, representatives or contact persons of the counterparty that qualify as legal person (hereinafter referred to as “Counterparties” and “Third Parties”):

• Identification data (e.g. name, surname, date of birth, residence);

• Contact details (e.g. telephone number, e-mail address, postal address);

• Data relating to the economic situation;

• Data relating to criminal convictions and offences, to the extent that its processing is necessary for the proper performance of the professional duties conferred to the Law Firm or to comply with legal obligations;

• Special categories of personal data pursuant to Article 9 GDPR;

• Any other personal data provided to the Law Firm by a Client and the processing of which is necessary for the proper performance of the professional duties assigned to the Law Firm or to comply with a legal obligation to which the Law Firm is subject.

• Purposes of the proceeding

The processing of the Counterparties or Third Parties’ personal data is aimed at the proper performance of the professional duties assigned to the Law Firm.

• Legal basis of the processing

The processing of Counterparties’ personal data is based on the legitimate interest of the Firm in carrying out its professional activities and the legitimate interest of its Clients in protecting their rights and lawful interests, both in judicial and out-of-court context.

The processing of any special categories of personal data of Counterparties and Third Parties will be conducted in compliance with the duty of professional secrecy – as provided under Article 13 of the Italian Code of Conduct for Lawyers – and may also be based on the necessity of establishing, exercising, or defending a legal claim, whether in court or out of court. This is without prejudice to the case where the data subject has made the data manifestly public.

• Source of data

emlex normally will receive the personal data of Counterparties or Third Parties from its Clients or through the Clients’ Contacts.

• Retention period

emlex will store the personal data of Counterparties or Third Parties for the period strictly necessary for purposes for which such data has been collected.

In particular, emlex will store the data of Clients’ Counterparties or of Third Parties for extra-judicial consulting activities for a maximum of 10 years after the end of the professional relationship established between the Law Firm and the Client that provided the data to emlex.

With regard to personal data of counterparts of clients to whom the Law Firm provides legal assistance, it will be retained for the duration of the relationship and, upon its termination, for as long as necessary to perform ancillary activities (e.g. lodging appeals, starting enforcing proceedings, etc.).

emlex may extend the storage period of Clients’ Counterparties or of Third Parties personal data where this is necessary to comply with a legal obligation or to defend a right of its own before a judicial, administrative or other authority.

2.4. Data relating to suppliers of the Law Firm

• Data processed

Within its professional activities, the Law Firm may process the following categories of personal data relating to suppliers, as natural persons, as well as to employees, collaborators, representatives or contact persons of the suppliers that qualify as legal person (hereinafter referred to as “Suppliers” and “Supplier’s Contacts”):

• Identification data (e.g. name, surname, date of birth, residence);

• Contact details (e.g. telephone number, e-mail address, postal address);

• Any other personal data provided to the Law Firm by a supplier and the processing of which is necessary for the proper performance of the obligations arising from the existing contract between the Law Firm and the supplier.

• Purposes of the proceeding

The processing of the personal data of the Suppliers and the Supplier’s Contacts is carried out to manage the existing contractual relationships between the Law Firm and the Supplier and the Supplier’s Contacts.

• Legal base of the proceeding

The legal basis on which the processing of Supplier’s personal data by the Law Firm is based is the need to perform the contract to which the Law Firm is subject, including related pre-contractual measures. For Supplier’s Contacts, the legal basis is the legitimate interest of the Law Firm for the performance of the contract between the Law Firm and each Supplier for which the data subject works for.

• Source of data

emlex normally receive the personal data of Supplier and Supplier’s Contacts directly by themselves, during the ordinary professional activities or thanks to contacts established during events, seminaries, conventions, in particular through the exchange of business cards.

• Retention period

emlex will store the personal data of its Suppliers or of the Referents of the Suppliers up to a maximum of 10 years after the end of the contractual relationship with each Supplier, except for the case it is necessary to extend this period to comply with a legal obligation emlex is subject to or to defend a right of its own before a judicial, administrative or other authority.

2.5. Data collected through the use of the Website

When you visit our Website, we collect the following navigation data in anonymized form:

• Technical information, including IP address, information on the device you use, browser and software, etc.
• Information on the navigation on Website, including URL of pages browsed and activities carried out on those pages, date and time of navigation, time spent on the Website, clickstream.

This information is collected for the proper functioning, managing, maintenance and the improvement of the Website, as well as to ensure safe navigation and to ascertain the liability in case of cybersecurity violation. Information is analysed, also in aggregated form, to enable us to obtain statistical analysis on the use of the Website.

You are completely free to decide whether to provide us with navigation data, e.g. disabling cookies through the settlement of your browser. However, refusal to provide information necessary for the purpose of navigation may make it impossible to carry out activities closely related to navigation and, therefore, consultation and interaction with our Website.

We will store those data as long as it is necessary for the purposes they are collected.

Browsing data are collected through the use of cookie. To learn more about cookie functioning, how to enable and disable them, see our cookie policy.

2.6. Social network Plug-in and interactions with third parties’ websites

The Website allows you to interact with third parties’ website as social network (e.g. Instagram, Twitter, LinkedIn, YouTube) or other connections through hyperlink, share button, social plug-in and other similar tools.

By logging an area of the Website with such tools, browser will connect users of the Website directly to third parties ‘server, transferring their personal data to the website providers of such websites.

The transfer at issue will be made on the basis of users’ consent, expressed through an affirmative unambiguous action, pursuant to Article 4, n.11) GDPR, when each user clicks on a specific hyperlink, plug-in button or any other similar tool.

According to specific agreements with providers of these services, the Data Controller may act as autonomous data controller or as data co-controller in relation to such data transfer. Regarding privacy protection methods and the processing of the personal data collected by websites providers with whom direct interactions take place, please refer to the related websites.

2.7. Processing for direct marketing purposes

• • Data processed

In addition to processing personal data as described in the previous sections, the Law Firm may process the following categories of personal data to carry out direct marketing activities for the promotion of its services and professional activities:

• Identification data (e.g. name, surname);

• Contact details (e.g. telephone number, e-mail address);

• Social network addresses/pages (e.g. LinkedIn);

• Data relating to qualifications and/or professional career.

• Purpose of processing

The purpose of the processing described in this section is to allow emlex to carry out direct marketing activities, including sending promotional communications via email or social media to contacts held by emlex for this purpose.

• Legal basis for processing

The processing of personal data for direct marketing purposes relies on the consent of the data subjects, if they are not Clients of the Law Firm. The circumstance that a data subject deposits or consigns his or her business card or otherwise provides his or her professional contact details to representatives or collaborators of the Law Firm during events (as conventions, seminars or other events aimed at networking) at which the Law Firm is present or organized by the Law Firm itself, or provides his or her data during networking meetings, also on-line, will be considered by the Law Firm an “affirmative unambiguous action” equivalent to a statement of consent.

In case the data subject is a Client or a Clients’ Contact, the legal base shall be the legitimate interest of the Law Firm to promote its activities.

• Source of Data and Consequences of Refusal to provide data

emlex obtains personal data for direct marketing purposes directly from the data subjects. The provision of such data is optional. Refusal to provide personal data, or to give consent where required, will prevent the Firm from sending promotional communications about its services and activities.

• Retention period

The personal data processed by the Law Firm for the performance of direct marketing activities will be stored up to a maximum of 60 (sixty) months from the time they are obtained or, if later, from the time of the last interaction. emlex may extend the mentioned storage period where it is necessary to comply with a legal obligation or to defend its own right before a judicial, administrative, or other authority.

3. Methods of processing and data protection

The personal data of data subjects will be processed through computerized, telematic and/or paper tools in accordance with the principles of fairness, legality, transparency, accuracy, integrity, data minimization and limitation of purposes and storage, as well as in accordance with the provisions of GDPR and current legislation on personal data protection, with the adoption of appropriate security measures.

Personal data processing and storage of the data subjects will be done in a manner and with appropriate tolls to ensure the security and privacy of data itself. In particular, appropriate technical, information technology, organizational, logistical and procedural security measures will be taken, and access will be allowed only to persons authorized to process the personal data by the data controller or data controllers’ designees.

The processing of data concerning you is done through both electronic (including telefax, telephone, even without operator assistance, e-mail, SMS, and other computerized and/or automated systems) and manual means and tools made available to persons acting under the authority of the Data controller and authorized and trained for this purpose. They are allowed access to your personal data to the extent and within the limits that it is necessary for the performance of the processing activities concerning you.

The Data controller provides for the periodic and constant verification of the measures taken to ensure the privacy of personal data processed, stored and preserved through them.

The Data controller periodically verify the means by which its data are processed and the security measures provided for them for which it provides constant updating; verifies, including through the persons authorized to the processing , that no personal data are collected, processed, stored or retained that do not need to be processed; verifies that data are stored with assurance of integrity and authenticity and that they are used for the purposes of the processing actually carried out.

Exhausted the purposes that legitimize the storage of your personal data, the Data controller will take care to delete them or make them anonymous.

4. Use of artificial intelligence system

emlex, in compliance with the principles of transparency, confidentiality, privacy, and data protection, informs you that its professionals may use supportive artificial intelligence tools — such as automatic translation software (e.g., DeepL) and virtual assistants (e.g., ChatGPT by OpenAI, Gemini by Google, Copilot by Microsoft) — exclusively for ancillary and support activities related to their professional practice.

The use of such AI tools is always subject to human oversight and does not replace the critical judgment, independent analysis, or internal discussion among emlex professionals, which are essential elements of the Firm’s professional approach.

emlex adopts adequate technical and organizational measures to ensure that the use of these technologies complies with applicable laws, safeguards the confidentiality of individuals and the information processed, and preserves professional secrecy.

5. To whom we disclose personal data of the data subject

As a law firm, emlex and its professionals and collaborators are subject to professional secrecy, which substantially limits the disclosure of Clients’ personal data to third parties.

Therefore, personal data may be disclosed to third parties such as judicial or administrative authorities only when necessary to comply with a legal obligation to which emlex is subject, or to defend a right of emlex before a court, public authority, or other competent body.

To ensure that personal data processing is as accurate and secure as possible, the Firm has appointed certain data processors who may receive personal data. These entities have been selected for their ability to implement appropriate technical and organizational measures, ensuring that all processing is conducted in compliance with applicable data protection laws and that data subjects’ rights are fully protected.

In this regard, the Firm makes use of cloud computing systems for storing and processing personal data. The cloud services used are those generally recognized as secure and reliable by the market, including by public authorities. These cloud providers act in the capacity of data processors.

6. Transfer of Personal Data Outside the European Economic Area (EEA)

The transfer of personal data outside of the EEA may occur in specific and particular cases, strictly connected to the performance of the typical professional activity of the law firm. In particular, this transfer may occur if the Law Firm should interact with jurisdiction outside of EEA to provide assistance in both judicial and extrajudicial matters.

7. How we protect personal data of the data subject

The personal data of the data subjects are collected, processed, transmitted and stored by taking appropriate security measures (physical, logical and organizational) to protect them from possible violations (as destruction, loss, modification, unauthorized disclosure or access, either accidentally or unlawfully, to the personal data in question) and to ensure that the processing is carried out solely for the purposes described in this Notice.

8. What are the rights of the data subject and how and how to exercise them

In accordance with applicable law, and in particular with the provisions of the GDPR, the data subjects have the following rights with regard to personal data processed by emlex:

• Access: the data subjects can obtain information about the processing of their personal data and a copy of that data;
• Rectification: if the data subjects believe that their personal data are incomplete or inaccurate, they may request that such data be corrected or modified following their instructions;
• Erasure: except in cases provided by the applicable law, data subjects have the right to request the erasure of their personal data, when: (i) personal data are no longer necessary for the purposes of which they were collected and processed; (ii) data subjects withdraw their consent; (iii) data subjects object to the processing aimed at direct marketing or to the processing carried out to achieve other purposes and there are no overriding legitimate grounds to continue with the processing; (iv) personal data of the data subject are processed unlawfully; (v) erasure is required by law;
• Limitation: data subjects may request the limitation of the processing of their personal data pursuant to Article 18 GDPR;
• Object: in pursuant to Article 21 GDPR, data subjects have the right to object to the processing of their personal data at any time in relation to their particular situation. Upon receipt of the object, emlex will continue with the processing only if there are legitimate and compelling reasons that can be demonstrated to prevail over rights, interests and freedom of the data subject. The right to object to the processing of personal data for direct marketing purposes is absolute and can be exercised at any time in the manner indicated in the section “How to contact us”. The object to the processing provided with automated instruments also applies to processing provided with traditional instruments.
• Withdraw of consent: in case the processing of personal data is based on consent, data subjects have the right to withdraw their consent at any time;

Data portability: Where the processing is based on consent, data subjects have the right to receive in a structured format, commonly used and readable by automatic device personal data they have provided to the Law Firm and, where technically feasible, to the secure transmission of their personal data to another data controller.

9. How to contact us

To exercise your rights, and for any question or clarification on how their personal data are processed and used in accordance with this Notice , data subjects can contact the Law Firm through mail at the address Via Santo Spirito 3, 20121, Milano, through e-mail at the address info@emlex.it or at the telephone number +39 0287239400.

10. Protection of data subjects’ rights

To protect your rights and to protect your personal data you may, at any time, decide to lodge a complaint with the competent supervisory authority, i.e. the Garante per la Protezione dei Dati Personali (tel. +39 06.696771, e-mail address: garante@gpdp.it or urp@gpdp.it) or to take action before the competent national courts.

11. Changes of the Notice

We reserve the right to update this Notice at any time. For this purpose, we quote the last update at the beginning of this Notice.

Where possible, any change that substantially affects the processing of personal data will be communicated to the data subjects through appropriate channels, always in such a way that ensures effective knowledge of the modalities of processing, with the aim to guarantee full transparency of the processing and a full and appropriate protection of the rights of the data subjects.

In case of impossibility or excessive burden to contact every data subject individually, emlex will just update the Notice by publishing it on its website, in the proper section.