1. Data Controller

The Data Controller for personal data processing is Avv. Armando Simbari (for Simbari Avvocati Penalisti law firm), located at Via Durini 7 – 20122 Milan (MI), Italy.

Email: info@simbari.it / a.simbari@simbari.it
Telephone: +39 02 3943 1467

2. Categories of Data Processed

In connection with the consultation of this website and professional legal engagements, the following categories of data may be processed:

  • Browsing data: Technical logs, anonymized IP addresses, request times, and browser/device metadata necessary for website operation.
  • Data voluntarily provided: Name, contact details, email addresses, and any information provided voluntarily when sending messages or calling our offices.
  • Professional engagement data (including judicial and special categories under Arts. 9 and 10 GDPR): In the event of legal representation or legal advice, identification data, tax information, as well as data relating to criminal convictions, offenses, or special categories of personal data necessary to establish, exercise, or defend legal claims.
  • Only with prior consent, usage statistics collected through Google Analytics 4 (see section 7).

3. Purpose and Legal Basis of Processing

Data is processed in compliance with Regulation (EU) 2016/679 (GDPR) for the following purposes:

  • Website operation & security: Enabling smooth browsing and safeguarding IT security (Legal basis: Legitimate interest, Art. 6(1)(f) GDPR).
  • Handling inquiries: Replying to requests for information or preliminary assessments (Legal basis: Contractual/pre-contractual measures, Art. 6(1)(b) GDPR).
  • Performance of legal services & defense in court: Fulfilling professional engagements in criminal defense and legal counsel (Legal bases: Performance of a contract, Art. 6(1)(b); establishment, exercise, or defense of legal claims for special and criminal data, Arts. 9(2)(f) and 10 GDPR).
  • Statutory and anti-money laundering compliance: Adhering to accounting, tax, and AML regulations pursuant to Italian Legislative Decree 231/2007 (Legal basis: Legal obligation, Art. 6(1)(c) GDPR).
  • Website usage statistics: measuring site use in aggregate form to improve its content and operation (Legal basis: consent of the data subject, Art. 6(1)(a) GDPR, revocable at any time). See section 7.

4. Processing Methods and Retention Period

Data processing is conducted using digital and paper media equipped with technical and organizational security measures to protect data confidentiality under legal professional privilege.

Technical browsing data is erased or anonymized at the end of each session. Statistical data collected with Google Analytics 4, subject to consent, is retained for 2 months and then automatically deleted.

5. Data Disclosure and Recipients

Personal data will not be disseminated for commercial purposes. Where strictly necessary, data may be communicated to:

  • Legal associates, expert witnesses, and technical advisors involved in legal proceedings;
  • Judicial Authorities, Police Authorities, counter-parties and their legal representatives;
  • Public oversight bodies for legal and AML compliance (e.g., Financial Intelligence Unit - UIF);
  • IT hosting and software providers appointed as Data Processors (Art. 28 GDPR).
  • Google Ireland Limited, for the Google Analytics 4 service, only with prior consent, acting as Data Processor (Art. 28 GDPR);
  • Adobe Systems Software Ireland Ltd, for the Adobe Fonts service that delivers the typeface used for the website headings. To deliver the font, the service receives the visitor's IP address; no cookies are set (Legal basis: the Controller's legitimate interest in the proper presentation of the website, Art. 6(1)(f) GDPR).

Data is stored within the European Union. Google and Adobe may process some technical data (e.g. the IP address or the browser's pseudonymous identifier) in the United States as well: the transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (10 July 2023), to which both companies adhere, and on standard contractual clauses.

6. Data Subject Rights

Pursuant to Articles 15 to 22 of the GDPR, data subjects have the right to access, rectify, request erasure (where permissible under legal retention duties), restrict or object to processing, request data portability, and lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

Inquiries can be addressed to: info@simbari.it.

7. Usage statistics (Google Analytics 4)

Only if the user consents through the cookie banner, this website uses Google Analytics 4, provided by Google Ireland Limited, to measure in aggregate form how the site is used.

  • Data processed: pseudonymous browser identifier, pages visited, visit duration, referral source, device type and approximate geographic area. Google Analytics 4 does not log or store IP addresses.
  • Legal basis: consent (Art. 6(1)(a) GDPR), revocable at any time with the "Manage cookies" link at the bottom of every page, without affecting the lawfulness of processing carried out before withdrawal.
  • Provision of data: optional. Declining does not prevent you from using the website in any way.
  • Retention: 2 months.
  • Recipients and transfers: see section 5.

The cookies used are described in the Cookie Policy.