This privacy statement (“Statement”) is provided pursuant to art. 13 of Regulation (EU) 2016/679 concerning the protection of personal data (“Regulation”) and is drafted in compliance with the Orders of the Italian Personal Data Protection Authority, Italian Legislative Decree no. 196/2003 (as amended) and with the Guidelines set by the European authorities.

This Statement is addressed to users (“User”) of the websites www.dejalex.com, www.dbjwatch.it, www.dejalexonbrexit.eu,  www.transportwatch.eu  and www.dejalexondigital.eu (each of which is a “Website”) belonging to the Law Firm De Berti Jacchia Franchini Forlani Studio Legale, based in 7,Via San Paolo, Milan (“Firm”) and describes how the Firm processes the personal data of Users. The information does not apply to other websites, pages or online services accessible via external hyperlinks (links) that may be published on the Website.

1. DATA CONTROLLER

The Data Controller is the Firm as identified above. Users, as data subjects pursuant to art. 4 (1) of the Regulation, may contact the Firm if they intend to exercise one or more of their rights as described below. For this purpose or for any further information, Users may contact the e-mail address gdpr.admin@dejalex.com.

2. WHAT KIND OF DATA DO WE PROCESS?

A) Browsing data:

The computer systems and software procedures used to operate the Website acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This is information that is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow the User to be identified.

This category of personal data includes IP addresses or domain names of computers and terminals used by the User, URI / URL addresses (Uniform Resource Identifier / Locator) of the requested resources, time of request, method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (good order, error, etc.) and other parameters related to the operating system and the computer environment of the User.

These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check its correct functioning and are deleted immediately after processing.

B) Data voluntarily communicated by the User

The Firm may collect some personal data (name, surname, e-mail address, telephone number, e-mail address etc.) communicated by the User via e-mail, through the appropriate section on the Website, the social media or otherwise.

C) Cookies

Concerning cookies used by the Websites, please read our Cookie Policy.

3. WHY DO WE PROCESS YOUR PERSONAL DATA, ON WHAT LEGAL BASIS AND FOR HOW LONG?

Personal data will be processed for purposes connected with or useful for the activity of the Firm as better indicated in the table below.

The processing of personal data will be based on principles of correctness, lawfulness and transparency, protecting the privacy of the User. The methods of processing personal data will provide for the use of IT and telematic tools, with logic strictly related to the purposes indicated below.

We use personal data to	Legal basis for the collection and processing of personal data	For how long we will retain personal data
1. Allow Users to consult the Websites (browsing data)	The processing of personal data is necessary for the exercise of a legitimate interest on the part of the Firm to properly manage the Websites and that of the User to use them	Personal data will be stored for the time necessary to browse the Website in question. A longer period of storage of personal data could be made necessary in the cases provided by the law or if there is a request by the Judicial Authority or for the verification of computer crimes to the detriment of the Website
2. Examine the curriculum vitae (CV) of Users who spontaneously submit them to the Firm through the Websites, email addresses as indicated in the Websites, via the social media or otherwise	The processing of personal data is a pre-contractual measure necessary to allow the Firm to examine the CV with a view to a possible future contractual relationship. The retention of the data subsequent to the selection period is based on the consent of the candidate.	Personal data sent spontaneously will be retained for 12 months. Personal data sent in reply to a job announcement will be kept for the time necessary to complete the selection. If you are not selected and subject to your consent, we will keep your CV for a period not exceeding one year after the close of the selection procedure.
3. Send newsletters containing in-depth legal information on particular subjects that may be of interest to the User or updates related to the activities of the Firm and invitations to our events.	Where the User is not a client of the Firm the processing is based on the consent of the User through the appropriate section on the Website (Insights)or otherwise. Where the User is a client of the Firm, the processing is carried out on the basis of the Firm’s legitimate interest in informing and updating its clients on legal topics and organizing events on issues of interest. If consent is not given where necessary, we will not be able to send you newsletters, legal information and updates or invitations to events.	Personal data Users will be kept until the User revokes their consent or notifies opposition to the processing, which may take place at any time.

4. WHO WILL WE SHARE YOUR PERSONAL DATA WITH?

Your personal data processed for the purpose referred to in paragraph 3 (1) may be shared with companies which provide services to the Firm such as: suppliers of development, management and maintenance services of the web platform and technical services, appointed as data processors pursuant to art. 28 of the Regulation. Personal data collected for the purposes referred to in paragraph 3 (2) will be accessible to partners, duly authorized employees and collaborators of the Firm, while personal data collected for the purposes referred to in paragraph 3 (3) may be processed by duly authorized staff of the Firm as well as by third parties who provide marketing services to the Firm and appointed data processors pursuant to art. 28 of the Regulation. Some of such services may be provided by The Rocket Science Group (trading as Mailchimp) a company situated in the United States, which participates in the EU-US Data Privacy Framework, approved by the European Commission as providing adequate protection of personal data transferred to participant companies in the United States.

5. WHAT ARE YOUR RIGHTS?

Users are hereby informed pursuant to art. 13 of the Regulation that they have the right to ask the Data Controller to access their personal data, to obtain updating and correction or (in the cases provided for by the Regulation) the cancellation or the limitation of the processing that concerns them, and to oppose the processing.

Users also have the right to receive such personal data in a structured format, commonly used and readable by automatic device and to transmit them to other data controllers without impediments and to revoke at any time consents given without prejudice to the lawfulness of the processing based on the consent prior to the revocation.

The above requests may be addressed to gdpr.admin@dejalex.com.

Finally, Users also have the right to lodge a complaint with the Data Protection Authority (Garante per la Protezione dei Dati Personali) with head office in Piazza Venezia 11, 00187 Rome; for more information on this, see www.garanteprivacy.it.