Privacy policy of the website

When you browse the Website, the Data Controller processes browsing data such as the IP addresses or domain names of the devices used to connect, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.

When you submit a request for information, the Data Controller processes your identification and contact details, as well as any personal data contained in the request.

When you browse the Website or submit a request for information, your data will be processed for the following purposes:

a) Enabling you to browse the Website and its pages.

The legal basis for the processing is the performance of pre-contractual and contractual obligations pursuant to Article 6(1)(b) of the GDPR. The data are collected automatically when you browse the Website through the use of the technical and necessary cookies described in the Cookie Policy, to which reference is expressly made.

b) Ensuring the security of the Website by preventing unlawful use, unlawful conduct and offences against the Website and the Data Controller.

The legal basis for the processing is the pursuit of the legitimate interest in protecting the Data Controller’s IT assets pursuant to Article 6(1)(f) of the GDPR. The data are collected automatically when you browse the Website through the use of the technical and necessary cookies described in the Cookie Policy, to which reference is expressly made.

c) Handling and responding to requests for information.

The legal basis for the processing is the performance of pre-contractual obligations pursuant to Article 6(1)(b) of the GDPR. The provision of personal data is optional; however, failure to provide the personal data requested will make it impossible to handle and respond to requests for information.

d) Complying with any applicable legal obligations, insofar as the processing is authorised by national and/or EU legislation.

The legal basis for the processing is compliance with a legal obligation under EU and national law pursuant to Article 6(1)(c) of the GDPR and Article 2-ter of Legislative Decree No. 196/2003. Personal data are provided when you browse the Website or submit a request for information.

e) Defending the Data Controller’s rights in judicial and extrajudicial proceedings.

The legal basis for the processing is the pursuit of the legitimate interest in protecting the Data Controller’s interests and rights pursuant to Article 6(1)(f) of the GDPR. Personal data are provided when you browse the Website or submit a request for information.

For the purposes described above, the data may be disclosed to other parties, such as public authorities and law enforcement agencies, law firms, accountants, etc., which will process the data as independent data controllers for their own purposes. The following may also have access to the data:

• the Data Controller’s staff, who are expressly authorised to process the data in accordance with the instructions provided, pursuant to Articles 29 and 32(4) of the GDPR and Article 2-quaterdecies of Legislative Decree No. 196/2003;

• service providers acting on behalf of the Data Controller and appointed as data processors, including, without limitation, companies and/or professionals responsible for developing and maintaining the Website. An up-to-date list of data processors is available from the Data Controller.

Personal data are not disclosed to the public.

Personal data are retained only for as long as strictly necessary to carry out the activities and fulfil the purposes described above. In particular, for purposes a) and b) above, the data are retained for the lifetime of the cookies as specified in the Cookie Policy, to which reference is expressly made.

For purposes c), d) and e) above, the retention period depends on the content of the request and any resulting legal obligations or need to protect legal rights. In the absence of such obligations or needs, personal data are deleted one year after the request.

Personal data are not normally transferred outside the European Economic Area. In any event, where data are transferred outside the European Economic Area, the Data Controller ensures that the transfer complies with applicable law, namely through appropriate safeguards such as adequacy decisions or the Standard Contractual Clauses approved by the European Commission. Further information may be obtained by contacting the Data Controller.

Data subjects may exercise their rights and/or request information on the processing of their data by contacting the Data Controller at dpo@milanosansiro.com. In particular, the GDPR grants data subjects:

a)     the right of access, namely the right to obtain a copy of their personal data and information on: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged retention period or, if this is not possible, the criteria used to determine that period; the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of the processing of personal data concerning them, or to object to such processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the data subject, all available information on their source; the existence of solely automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject;

b)     the right to rectification and completion of inaccurate or outdated data;

c)     the right to erasure whenever the data are no longer necessary for the purposes pursued, or where the data subject decides to withdraw consent or objects to the processing and there is no other legal basis for retaining the data, or where the data are processed unlawfully or must be erased to comply with a legal obligation;

d)     the right to restriction of processing where the data subject contests the accuracy of the personal data, for the period necessary for the Data Controller to verify their accuracy; where the processing is unlawful and the data subject opposes erasure and requests restriction of use instead; where, although the Data Controller no longer needs the personal data for the purposes of the processing, the data subject needs them for the establishment, exercise or defence of legal claims; or where the data subject has objected to the processing, pending verification of whether the Data Controller’s legitimate grounds override those of the data subject.

When exercising the rights referred to in points b), c) and d), data subjects have the right to know the recipients to whom their personal data have been disclosed and to have the Data Controller communicate any rectification, erasure or restriction of processing to those recipients, unless this proves impossible or involves disproportionate effort.

e)     the right to data portability, namely the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, including the direct transfer of those data by the Data Controller to other data controllers, where the processing is carried out by automated means and is based on consent or a contract;

f)      the right to object to processing where it is based on the Data Controller’s legitimate interest, as specified in section 2 above.

Finally, data subjects also have the right to lodge a complaint with the competent supervisory authority (in Italy, the Autorità Garante per la Protezione dei Dati Personali, https://www.garanteprivacy.it).

Last updated on 28 October 2026