CTL - Corporate tax and legal firm

Privacy

Information and consent to the processing of personal data
Information Art.13 of the EU Regulation no. 2016/679
1. Data Controller and Data Protection Contact
The Data Controller is CTL Advisory S.r.l. stp. - Company of professionals with registered office in Via Vincenzo Monti, 15 - 20123 Milan. The Data Protection Manager can be contacted at CTL Advisory S.r.l. stp - E-mail: info@ctladvisory.com , PEC: ctladvisory@pec.it As the person in charge of the treatment, Mr. Marco Baggetti was appointed. Some members and collaborators of the Data Controller, as data processors, will be able to access the data, even sensitive ones, in order to carry out the tasks assigned to them in relation to the purposes of the processing.

2. Purpose and legal basis of the processing
CTL Advisory S.r.l. stp processes personal data of natural persons, legal entities, sole proprietorships and / or freelancers ("Data Subjects") for the following purposes:

Provision of professional services deriving from the assignment conferred. The treatment may also involve sensitive data. The provision of data necessary for these purposes represents, depending on the case, an obligation that is descended from this mandate or a requirement necessary for the performance of the activities envisaged in this mandate; in the absence of these, CTL would be unable to establish the relationship or to implement it;
Need to perform activities for which the interested party is a party or to perform pre-contractual activities upon his request. This need represents the legal basis that legitimizes the resulting treatments. The provision of the data necessary for these purposes represents, as appropriate, a contractual obligation or a requirement necessary for the performance of the activities envisaged by this mandate; in the absence of these, CTL would be unable to establish the relationship or to implement it;
Need to comply with legal obligations (eg obligations under the anti-money laundering legislation, instructions issued by the Supervisory Authority, the Magistrates, etc.). This need represents the legal basis that legitimizes the resulting treatments. Providing the data necessary for these purposes is a legal obligation; in the absence of these, CTL would be unable to establish relationships and could have the obligation to make specific instances.

3. Categories of processed data.
CTL processes personal data collected directly from the interested party, or from third parties, including, but not limited to, personal data (e.g. name, surname, address, date and place of birth), information on the financial situation (e.g. financial position, credit information, image data (e.g. photo on identity card), voice recordings (e.g. recording of telephone conversations with the interested party, whatsapp, also to protect rights in case of disputes) and other data attributable to the categories indicated above. CTL does not request and does not process its own particular data of its customers (e.g. data revealing the racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, genetic data, biometric data - designed to uniquely identify a natural person, data relating to the health or sexual life or sexual orientation of the person). However, it is possible that, to implement specific requests for services and operations relating to the relationship with the customer (e.g. preparation of tax returns, payment of membership fees to parties or trade unions, bank transfers to associations, etc.) should process such data. Since CTL cannot intercept or reject these requests, this mandate cannot be executed if the Data Subject denies its consent to the aforementioned processing. The data in question will be processed exclusively to execute the customer's request.

4. Recipients or categories of recipients of data
Individuals authorized to process the data necessary for the performance of the duties assigned to them may be made aware of the data of the Data Subject: They could be employees of CTL or seconded by him, temporary workers, collaborators, interns, as well. In addition, authorized Services Providers (Data Processors) may be disclosed to the processing of the data necessary for the provision of services requested by the data controller (i.e. IT services providers, labor consultants and / or other professionals who collaborate with CTL). CTL - without the consent of the interested party - may communicate the personal data in its possession to those subjects to whom this communication must be carried out in compliance with an obligation established by law, by a regulation or by community legislation in execution of this mandate.

5. Rights of Data Subjects
Current legislation on data protection attributes specific rights to the Data Subject, who, for the exercise of the same, can directly contact the Data Controller at any time. The rights exercisable by the interested party, described below, are:

Right of access;
Right of Rectification;
Cancellation right;
Right of limitation;
Right to portability;
Right of opposition.

Interested parties and legal entities, bodies and associations may at any time modify the optional consent whenever they wish.

6. Right of access
Right of access provides the possibility for the Data Subjects to know which personal data pertaining to them are processed by CTL and to receive a free copy (in case of further requested copies a contribution based on the costs incurred may be charged). The information provided includes the purposes of the processing, the categories of data processed, the expected retention period or, if not possible, the criteria used to define this period, as well as the guarantees applied in case of transfer of data to third countries. rights exercisable by the Interested party.

7. Right of rectification
Right of rectification allows the Data Subjects to obtain the updating or correction of inaccurate or incomplete data concerning him.

8. Right to cancel (e.g. "oblivion")
The right to cancel, or to be forgotten, allows the interested party to obtain the cancellation of their personal data in the following special cases:

Personal data are no longer necessary for the purposes for which they were collected and processed;
Data Subject revokes the consent on which the treatment is based, if there is no other legal basis that could otherwise legitimize it;
Data Subject opposes the processing and there is no further legitimate reason to proceed to the processing carried out by the holder for the pursuit of a legitimate self-interest or of third parties and there is no legitimate overriding reason for the holder to proceed with the processing;
Personal data of the interested party have been unlawfully processed.

This right can be exercised even after the withdrawal of consent. 9. Right of limitation
Right of limitation can be exercised by the interested party in case:

Violation of the conditions for the lawfulness of the processing, as an alternative to the deletion of data;
Request for rectification of data (pending correction) or opposition to their processing (pending the decision of the holder).
Without prejudice to the conservation, any other processing of the data whose limitation is requested is prohibited.

10. Right to portability
Right to portability allows the Data Subjects to use their data in possession of CTL for other purposes. Each Data Subjects may request to receive the personal data referred to him/her or request the transfer to another holder, in a structured format, commonly used and legible (Right to portability). In particular, the data that can be object of portability are the personal data (e.g. name, surname, address, date and place of birth, residence), as well as a set of data generated by the transactional activity that CTL has defined for each macro- category of products / services (eg existing or extinct relationships, handling). This right does not apply to non-automated treatments (e.g. archives or paper records).

11. Right to oppose
Right of opposition allows the Data Subjects to oppose at any time, for reasons related exclusively to his situation, the processing of personal data concerning him.
12. Exemptions from the exercise of rights
Data protection legislation recognizes specific exceptions to the rights granted to the Data Subject. CTL must however continue to process the personal data of the Data Subject when one or more of the following conditions apply:

Execution of a legal obligation applicable to CTL;
Resolution of pre-litigation and / or litigation (own or third parties);
Internal / external investigations / inspections;
Requests from the Italian and / or foreign public authorities;
Reasons of significant public interest;
Execution of an existing contract between CTL and a third party;
Any other technical conditions / blocking status identified by the CTL.

13. Exercise of rights
Each Data Subject to exercise their rights can contact CTL at the e-mail address info@ctladvisory.com or submit a written request to CTL Advisory S.r.l. stp - Via Vincenzo Monti, 15 - 20123 - Milan. The deadline for reply is one (1) month, extendable to two (2) months in cases of particular complexity; in these cases, CTL provides at least one interlocutory communication within one (1) month. The exercise of rights is, in principle, free. CTL, considering the complexity of processing the request and, in the event of manifestly unfounded or excessive (even repetitive) requests, reserves the right to request a contribution. CTL has the right to request additional information necessary for the identification purposes of the applicant.

14. Data retention period
CTL treats and keeps the personal data of Data Subjects for the entire duration of the present mandate, for the execution of the obligations related to it and consequent, for the respect of the applicable legal and regulatory obligations, as well as for own or third party defensive purposes until the end of the data retention period. In particular, the period of retention of personal data of the interested party starts from the date of closure of this mandate and expires with the expiry of the term of 3 years from the date of closure of this mandate. CTL is obliged to inform of the cancellation request other holders who process the personal data of Data Subject who has requested the cancellation. At the end of the applicable retention period, personal data relating to the Data Subjects will be deleted or stored in a form that does not allow identification of the Interested Party, unless their further processing is necessary for one or more of the following purposes:

Resolution of pre-litigation and / or litigation initiated before the expiry of the retention period;
To follow up investigations / inspections by internal control functions and / or external authorities initiated before the expiry of the retention period;
Resolution of pre-litigation and / or litigation initiated before the expiry of the retention period.

15. Complaint or report to the guarantor for the protection of personal data
If the Data Subject considers that he has suffered a violation of his rights, he can lodge a complaint or make a report to the Guarantor for the Protection of Personal Data or appeal to the Judicial Authority. The contacts of the Guarantor for the Protection of Personal Data are available on the website www.garanteprivacy.it .