Privacy notice
Last updated:
1. Data controller
The data controller is Avv. Michele Mennoia, with offices at Via Santa Radegonda 16, 20121 Milan (MI), Italy. Email: michele@mennoialaw.com. To exercise your data protection rights: privacy@mennoialaw.com. Certified email (PEC): michele.mennoia@milano.pecavvocati.it.
No data protection officer (DPO) has been appointed, as none is required.
2. Purposes, legal bases and retention
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to users of this website and to anyone who contacts the practice.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Making the website available and protecting it from misuse | Technical browsing data (IP address, date and time, resource requested, result, browser) | Legitimate interest in the security of the website (Art. 6(1)(f) GDPR) | For the technical period set by the hosting provider for server logs; longer only where needed to establish wrongdoing |
| Replying to requests sent by email, certified email, phone or WhatsApp and assessing a possible instruction | Contact details, including phone number, content of the message and any attachments | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) | Requests that do not lead to an instruction: for as long as needed to handle the request and, in any event, no longer than needed to protect any rights |
| Carrying out the professional instruction | Client and party data, case documents | Performance of the contract (Art. 6(1)(b) GDPR); legal obligations, including tax and anti-money-laundering rules (Art. 6(1)(c) GDPR) | 10 years from the close of the file, for limitation periods and tax obligations |
| Establishing, exercising or defending legal claims | The data needed for the case | Legitimate interest in protecting rights (Art. 6(1)(f) GDPR) | For the duration of the proceedings and until the time limits for appeal expire |
3. Browsing data, cookies and third-party tools
This website does not use contact forms, newsletters, statistics or analytics tools, profiling, advertising, remote fonts, maps or content embedded from external platforms. It sets no cookies and uses no other form of browser storage. Details are in the cookie policy.
Server logs are managed by Aruba S.p.A., the hosting provider, with data centres in Italy. The controller does not use them to profile users.
4. Communications by email, certified email, phone or WhatsApp
Mailboxes on the mennoialaw.com domain are run on Google Workspace Business Starter, a service provided by Google Ireland Limited. Certified email (PEC) is handled by the relevant accredited provider.
The practice can also be contacted by phone and on WhatsApp Business at +39 379 217 5909. WhatsApp is provided by WhatsApp Ireland Limited (Meta group), which processes data relating to the use of the app, such as your phone number and technical information about conversations, as an independent controller under its own privacy policy. Message content is protected by end-to-end encryption. If you prefer not to use WhatsApp, you can contact the practice by email, certified email or phone.
For a first contact, a short description of the matter and the names of the parties are enough. Please do not send documents, health data or other special categories of data, or data relating to criminal convictions or offences.
If such data are nevertheless sent, they are processed only where necessary to establish, exercise or defend legal claims (Art. 9(2)(f) GDPR) and, for criminal data, within the limits of Art. 10 GDPR and Art. 2-octies of the Italian Privacy Code (Legislative Decree 196/2003); otherwise they are deleted.
5. Recipients
Data may be processed, as processors, by: Aruba S.p.A. (hosting; privacy notice); Google Ireland Limited (email; privacy policy and data processing addendum); the certified email provider; advisers to the practice, in the role determined by the service provided and the related agreements. For messages sent on WhatsApp, data are also processed by WhatsApp Ireland Limited as an independent controller. Data may also be disclosed to judicial and public authorities where required by law. Data are not published.
6. Transfers outside the European Union
The website is hosted in Italy. For email services, Google or its sub-processors may process data in the United States or other third countries. Any such transfer relies on the adequacy decision for the EU-US Data Privacy Framework, in which Google participates, and on the standard contractual clauses approved by the European Commission (Arts. 45 and 46 GDPR). For WhatsApp messages, WhatsApp Ireland Limited and Meta group companies may process data in the United States; Meta Platforms, Inc. participates in the same Data Privacy Framework.
7. Your rights
Subject to the conditions and limits set out in the GDPR, you may request access to, rectification or erasure of your personal data, restriction of processing and data portability by emailing privacy@mennoialaw.com.
Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on the controller’s legitimate interest.
No automated decision-making or profiling takes place (Art. 22 GDPR). If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (Garante) (Art. 77 GDPR).
8. Whether you must provide data
Browsing data are needed to access the website. Providing data by email, certified email, phone or WhatsApp is optional, but without the necessary information it is not possible to reply.
9. Changes
This notice may be updated following technical, organisational or legal changes. The version published on this page, with its last-updated date, applies.