Privacy policy

Last update: April 2022

This privacy policy (“Disclosure“), provided pursuant to art. 13 and 14 General Regulation (EU) 2016/679 on the Protection of Personal Data (“Regulation” or “GDPR“), describes the processing of your personal data carried out by Leexè Studio Associato as the data controller.

1. Data Controller

Pursuant to this Disclosure and the processing it takes into consideration, the data controller (pursuant to Article 4, No. 7 of the Regulation) is Leexè Studio Associato with registered office in Via Podgora 10, 20122, Milan, (“Leexè“, “Firm“).

2. What kind of personal data we process and legal basis for the processing

In carrying out its professional activities, Leexè may process various categories of personal data referring to the data subjects indicated in this paragraph.

I . Data relating to candidates for job positions within the Firm

Data processed

Leexè may process the following personal data referring to subjects applying for job positions within the Firm, both as a professional and as an employee (the “Candidates“), by contacting the Firm using the appropriate form on the website www.leexe.it (the “Site“) or through other channels:

Personal data (e.g. name, surname, date of birth, residence);
Contact details (e.g. telephone number, e-mail address, postal address);
Personal image / portrait;
Data relating to the candidate’s qualifications, training and career;
Any information (also relating to income or assets, as well as particular categories of data) that Candidates will provide to Leexè when they submit their application or during the selection process.

Purpose of the processing

Leexè will process the personal data of Candidates to assess whether their profiles are in line with their professional needs, as well as to make selections in this sense among the various Candidates and to refine any recruitment and / or inclusion in the staff of collaborators.

Legal basis of the processing

The legal basis on which the processing of Candidates’ personal data by Leexè is based is the need to fulfill contractual obligations or to perform pre-contractual measures at the request of the interested party to whom Leexè is subject. In the event that, during the application or during the subsequent selection process, a Candidate provides Leexè with data constituting particular categories of data pursuant to art. 9 of the GDPR, the related legal basis will be the consent of the interested party.

Retention period

In general, the personal data of each Candidate will not be kept for a period exceeding 12 months from the end of the specific selection for which he / she sent his application, except in the case of establishment of a working relationship and / or collaboration with Leexè. With the specific consent of the Candidate, Leexè may extend the aforementioned retention period.

Leexè may also extend the retention period of Candidates’ personal data where this is necessary to fulfill a legal obligation or to protect one’s right before a judicial, administrative or other authority.

II. Data relating to clients or potential clients of Leexè

Data processed

In carrying out its professional activities, Leexè may process the following categories of personal data referring both to clients and potential clients, individuals, and to employees, collaborators, representatives or contact persons of clients or potential clients legal persons of Leexè (hereinafter respectively the “Clients” and “Clients Referrals“):

Personal data (e.g. name, surname, date of birth, residence);
Contact details (e.g. telephone number, e-mail address, postal address);
Data relating to income and / or assets;

Data relating to crimes and criminal convictions, where this is necessary for the correct fulfillment of the professional duties assigned to Leexè or to comply with legal obligations;
Special categories of data, as defined by art. 9 of the GDPR;
Any other personal data that is provided to Leexè by one of its clients and whose processing is necessary for the proper performance of the professional assignment given to the Firm or to fulfill a legal obligation to which Leexè is subject.

Purpose of the processing

The processing of Clients’ personal data is aimed at the correct fulfillment of the professional assignments conferred on Leexè and, where this is necessary, the fulfillment of legal obligations to which Leexè is subject, including the client due diligence obligations deriving from the legislation on combating money laundering and terrorist financing.

Legal basis of the processing

The processing of our Clients’ personal data is based on the need to fulfill the contractual obligations deriving from the various relationships established between Leexè and its Clients, including the related pre-contractual measures. For Client Referrals, the legal basis is the lawful interest of the Firm in the execution of relations with the specific Client of which the interested party is a member.

With regard to the processing of personal data relating to criminal convictions and crimes of Clients, the related processing is based on the need to comply with legal obligations to which Leexè is subject, including the obligation of due diligence of client in the field of anti-money laundering and countering the financing of terrorism.

The processing of any particular categories of personal data provided by the interested parties may be based either on the consent of the interested parties or on the need to ascertain, exercise or defend a right in court. The hypothesis in which the interested party has made their data manifestly public is reserved.

Source of data

Leexè will receive the personal data of its Clients directly from the Clients or through Client Referrals. These data could, among other things, be collected on the occasion of ordinary professional activities or contacts established at events, seminars, conferences, in particular through the exchange of business cards.

Retention period

Leexè will keep the personal data of its Clients for the period strictly necessary to pursue the purposes for which such data were collected. In particular, Leexè will keep the data of Clients who turn to the Firm for out-of-court consultancy activities for a maximum of 10 years from the end of the professional relationship established on the occasion with the Firm.

Leexè may extend the period of retention of its Clients’ data where this is necessary to comply with a legal obligation or to defend its rights before a judicial, administrative or other authority.

III. Data relating to the Firm’s suppliers

Data processed

In carrying out its professional activities, Leexè may process the following categories of personal data referring both to natural persons suppliers, and to employees, collaborators, representatives or contact persons of legal entity suppliers of Leexè (hereinafter respectively the “Suppliers” and “Referrals of Suppliers “):

Personal data (e.g. name, surname, date of birth, residence);

Contact details (e.g. telephone number, e-mail address, postal address);
Any other personal data that is provided to Leexè by one of its suppliers and whose processing is necessary for the correct fulfillment of the obligations deriving from the contract between Leexè and the supplier itself.

Purpose of the processing

The processing of the personal data of Suppliers and Referrals of the Suppliers is carried out in order to manage the contractual relationships in place between Leexè and the Suppliers and the Referrals of the Suppliers.

Legal basis of the processing

The processing of Suppliers’ personal data is based on the need to fulfill contractual obligations to which Leexè is subject, including the related pre-contractual measures. For the Referrals of the Suppliers, the legal basis is constituted by the legitimate interest of the Firm in the execution of relations with the specific Supplier of which the person concerned belongs.

Source of data

Leexè normally receives the personal data of its Suppliers or of the Referrals of the Suppliers directly from the same, on the occasion of the performance of ordinary professional activity or of contacts established during events, seminars, conferences, in particular through the exchange of business cards.

Retention period

Leexè will keep the personal data of its Suppliers or of the Referrals of the Suppliers up to a maximum of 10 years from the end of the contractual relationship with the Supplier in question, unless it is necessary to extend this period to fulfill a legal obligation or to protect a Leexè’s right before a judicial, administrative or other authority.

IV. Data collected while using the Site

When you visit the Site, we collect the following navigation data anonymously:

echnical information, including IP address, information on the devices used by visitors to the Site, on the browser and operating systems, etc.
Information on navigation on the Site, including URLs of pages visited and activities that are carried out on the page, browsing dates and times, time spent on the Site, clickstream.

This information is collected for the correct functioning, management, maintenance and improvement of the Site, as well as to ensure that your navigation takes place safely and to be able to ascertain responsibility in case of cyber-security violations. They are also used to allow us to obtain statistical analysis on the use of the Site with the possibility of analyzing the data also in aggregate form.

You are always free to decide whether to provide us with your browsing data, for example by choosing to disable cookies through your browser settings. However, the refusal to provide information necessary for navigation purposes could make it impossible to carry out activities strictly connected with the navigation itself and, therefore, also the consultation and interaction with our Site.

We keep such data only for the time strictly necessary for the purposes for which it is collected.

Navigation data is collected through the use of cookies. To learn more about how cookies work, how to activate and deactivate them, consult our cookie policy.

V. Processing for direct marketing purposes

Data processed

In addition to processing the personal data of the interested parties in the manner and for the purposes described in paragraphs I, II, III and IV above, Leexè may process the following categories of personal data to carry out direct marketing activities to promote its services and its own professional activities:

Personal data (e.g. name, surname);

Contact details (e.g. telephone number, e-mail addresses);
Social network addresses / pages (eg LinkedIn);
Data relating to qualifications and / or professional career.

Purpose of the processing

The processing of personal data described in this section is aimed at carrying out direct marketing activities by Leexè, which can take the form of sending promotional communications via e-mail or social media to the contacts held for this purpose by Leexè.

Legal basis of the processing

The processing of personal data of interested parties for direct marketing purposes is based on their consent, where they are not Clients of the Firm. The circumstance that an interested party deposits or delivers his ticket to representatives or collaborators of the Firm on the occasion of events (such as conferences, seminars or other types of events aimed at networking) at which Leexè is present will be considered by the Firm “unequivocal positive action” equivalent to a declaration of consent.

In the case of Clients or Client Referrals, the legal basis will be the legitimate interest of Leexè in promoting its activities.

Similarly, Leexè may invoke its legitimate interest in promoting its activities in the case of contacts established at events, seminars, conferences, in particular through the exchange of business cards, which were attended by Leexè’s professionals.

Source of data and consequences of failure to provide data

Leexè receives the personal data of its contacts on which it carries out direct marketing directly from the interested parties. The provision of personal data by the interested parties is optional. Refusal to provide personal data, as well as to give consent to the processing – where required – will also make it impossible for Leexè to send promotional communications relating to its services and activities.

Retention period

The personal data processed by Leexè for the performance of direct marketing activities will be kept for a maximum period of 60 (sixty) months from the time of their obtaining or, if later, from the last interaction. Leexè may extend the retention period of the same where this is necessary to fulfill a legal obligation or to defend one’s right before a judicial, administrative or other authority.

3. To whom we communicate the personal data of the interested parties

The personal data of the interested parties, therefore, may be disclosed to third parties such as judicial or administrative authorities only where this is necessary to fulfill a legal obligation to which Leexè is subject or to defend a right of Leexè before a judicial, administrative or other authority.

In order to ensure that the processing of the personal data of the interested parties is as accurate as possible, Leexè has also appointed some data processors to whom the personal data of the interested parties could be communicated.

4. How we protect the personal data of data subjects

The personal data of the interested parties are collected, processed, transmitted and stored by adopting adequate security measures (physical, logical and organizational) to protect them from any violations (such as destruction, loss, modification, unauthorized disclosure or access, in an accidental or illegal, to the personal data in question) and to ensure that the processing is carried out solely for the purposes described in this Disclosure.

5. What are the rights of the interested parties and how to exercise them

In compliance with the applicable legislation, and in particular with the provisions of the GDPR, the interested parties have the following rights with regard to the personal data processed by Leexè:

Access: interested parties can obtain information regarding the processing of their personal data and a copy of such personal data;

Rectification: where interested parties believe that their personal data is inaccurate or incomplete, they can request that such data be rectified or modified following their instructions;
Cancellation: without prejudice to the cases provided for by the applicable legislation, interested parties have the right to request the cancellation of their personal data when: (i) the data are no longer necessary for the purposes for which they were collected and processed; (ii) the interested parties withdraw their consent to the processing; (iii) the interested parties oppose the processing for direct marketing purposes or the processing carried out to pursue other purposes and there are no overriding legitimate reasons to continue with the processing; (iv) the personal data of the interested parties are unlawfully processed; (v) the cancellation is required by law;
Limitation: interested parties request the limitation of the processing of their personal data in accordance with the provisions of art. 18 of the Regulation;
Opposition: in accordance with the provisions of art. 21 of the Regulation, data subjects have the right to object to the processing of their personal data at any time in relation to their particular situation. Upon receipt of the opposition, Leexè will continue with the processing only if there are demonstrable legitimate and binding reasons that prevail over the rights, interests and freedoms of the data subjects. The right of interested parties to oppose processing carried out for direct marketing purposes is absolute and can be exercised at any time in the manner indicated in the “How to contact us” section. The opposition to processing carried out using automated tools is also valid for processing carried out with traditional tools;
Withdrawal of consent: in the event that the processing of the personal data of the interested parties is based on consent, the interested parties have the right to withdraw their consent at any time;

Data portability: where the processing is based on consent, the data subjects have the right to receive the personal data they have provided to Leexè in a structured format, commonly used and readable by an automatic device and, where this is technically feasible, to be transmitted. in the security of their personal data to another data controller.

6. How to contact us

To exercise your rights, and for any questions or clarifications on how their personal data are processed and used pursuant to this Notice, interested parties may contact Leexè by post at Via Tommaso Salvini, 5, 20122, Milano, tvia e-email to privacy@leexe.it oor to the dedicated number +39 02 45472049.

7. Protection of the rights of interested parties

To protect your rights and to protect your personal data, you can, at any time, decide to lodge a complaint with the competent supervisory authority, namely the Guarantor for the Protection of Personal Data (tel. +39 06.696771, e-mail address: protocollo@gpdp.it or urp@gpdp.it) or to bring an action before the competent national courts.

8. Changes to this Disclosure

We reserve the right to update this Disclosure at any time. To this end, we report the latest update date at the beginning of the information.

If the interested parties have already forwarded their personal data to us, any changes that substantially affect the processing of their personal data will be communicated to the interested parties through the appropriate channels, always in such a way as to guarantee effective knowledge of the processing methods, with a view to full transparency of the processing it self and full and adequate protection of the rights of the data subjects.