Vai al contenuto principale
Studio Carlo Cassarino

Personal data privacy notice

Under Ar­ti­cles 13 and 14 of Reg­u­la­tion (EU) 2016/679 (GDPR)

Last updated: 3 Oc­to­ber 2026

1. Data controller

Practice
Stu­dio Carlo Cas­sari­no
Controller
Ing. Carlo Cas­sari­no
VAT number
11886391009
Registered address
Via Al­beri­co II n° 15, 00193 Roma (RM), Italy
Email
info@studiocassarino.org
Certified email (PEC)
protocollo@pec.studiocassarino.org

No Data Pro­tec­tion Of­fi­cer (DPO) has been ap­point­ed, as the pro­cess­ing does not fall with­in the cir­cum­stances re­quir­ing ap­point­ment under Ar­ti­cle 37 GDPR.

2. Categories of data and purposes

2.1 Browsing data

The sys­tems op­er­at­ing the web­site re­ceive tech­ni­cal data trans­mit­ted through In­ter­net pro­to­cols. These may in­clude your IP ad­dress, brows­er type, re­quest time and re­quest­ed re­source. These data are processed to de­liv­er the web­site, check its op­er­a­tion and pro­tect it from mis­use. Tech­ni­cal logs may be re­tained by the host­ing provider. Google An­a­lyt­ics sta­tis­tics are processed sep­a­rate­ly, only after con­sent.

2.2 Data you provide through the website forms

The web­site pro­vides a mes­sage form and a tech­ni­cal site-visit re­quest form. The mes­sage form re­quires your first name, sur­name, email ad­dress, tele­phone num­ber, sub­ject and mes­sage; the or­gan­i­sa­tion field is op­tion­al. A site-visit re­quest also in­cludes the prop­er­ty ad­dress and ge­o­graph­i­cal co­or­di­nates, ser­vices of in­ter­est, and pre­ferred ap­point­ment date and time. These data are processed to an­swer your re­quest, arrange a pos­si­ble visit, man­age any re­sult­ing pre-con­trac­tu­al or con­trac­tu­al re­la­tion­ship, and meet legal oblig­a­tions. They are not sold or used by the prac­tice for mar­ket­ing.

2.3 Third-party services

The web­site uses third-party ser­vices that may process user data as in­de­pen­dent con­trollers or proces­sors. For ser­vices cov­ered by Google’s gen­er­al pri­va­cy pol­i­cy, Google Ire­land Lim­it­ed is the con­troller for users in the EEA and Switzer­land, sub­ject to ex­cep­tions for spe­cif­ic ser­vices; Google LLC par­tic­i­pates in ser­vice pro­vi­sion and in­ter­na­tion­al trans­fers. Their pri­va­cy no­tices pro­vide fur­ther de­tails.

  • Google An­a­lyt­ics 4 (Google LLC): web­site traf­fic analy­sis. With con­sent, it also mea­sures con­tact clicks and form stages (start, error and re­quest re­ceived), with­out send­ing mes­sage con­tents, names, email ad­dress­es or tele­phone num­bers. It process­es pseu­do­nymised iden­ti­fiers and brows­ing data. Ac­cord­ing to Google, IP ad­dress­es are used dur­ing col­lec­tion to es­ti­mate lo­ca­tion and then dis­card­ed, with­out being logged or stored in An­a­lyt­ics. These data are not anony­mous under the GDPR. Legal basis: con­sent (Ar­ti­cle 6(1)(a)). Google Pri­va­cy Pol­i­cy.
  • Google re­CAPTCHA v3 (Google LLC): anti-spam pro­tec­tion for both web­site forms. It analy­ses user be­hav­iour to dis­tin­guish human traf­fic from au­to­mat­ed traf­fic, with­out re­quir­ing an ex­plic­it ac­tion. Legal basis: the con­troller's le­git­i­mate in­ter­est in web­site se­cu­ri­ty (Ar­ti­cle 6(1)(f)). This web­site is pro­tect­ed by re­CAPTCHA; Google's Pri­va­cy Pol­i­cy and Terms of Ser­vice apply.
  • Open­StreetMap Foun­da­tion: sup­plies map tiles for the site-visit form. When the map loads, your brows­er con­nects to the provider's servers, which may re­ceive your IP ad­dress, tech­ni­cal con­nec­tion data and in­for­ma­tion about the re­quest­ed tiles. The Foun­da­tion acts as an in­de­pen­dent con­troller for its own ser­vices. Legal basis for load­ing the map: le­git­i­mate in­ter­est in lo­cat­ing the prop­er­ty in­volved in the re­quest (Ar­ti­cle 6(1)(f)). Open­StreetMap Pri­va­cy Pol­i­cy.
  • HERE Geocod­ing and Search (HERE Glob­al B.V.): ad­dress search, au­to­com­plete and geocod­ing in the site-visit form. Typ­ing or se­lect­ing an ad­dress, fill­ing the fields or mov­ing the mark­er may send the re­quired ad­dress text or co­or­di­nates to HERE. HERE does not sup­ply the map tiles, and the web­site does not use a HERE traf­fic-data ser­vice. Legal basis: le­git­i­mate in­ter­est in ar­rang­ing the re­quest­ed visit (Ar­ti­cle 6(1)(f)). HERE Pri­va­cy Pol­i­cy.
  • Google Apps Script and its in­te­grat­ed Maps ser­vice (Google LLC): route re­quests to the con­troller's mail­box and check ap­point­ment avail­abil­i­ty. Apps Script process­es form data: name, sur­name, email, tele­phone, sub­ject and mes­sage; for vis­its, also ad­dress, ser­vices and pre­ferred date and time. To check whether a dri­ving jour­ney fits an ap­point­ment time, Maps re­ceives de­par­ture and des­ti­na­tion co­or­di­nates and the jour­ney time. The route query does not con­tain the ap­pli­can­t's name or con­tact de­tails. Pro­cess­ing terms de­pend on the Google ser­vice con­fig­u­ra­tion and agree­ments in use. Google Pri­va­cy Pol­i­cy.
  • Gmail and Google Cal­en­dar (Google LLC): the forms use the con­troller's per­son­al Google ac­count. Re­quests are no­ti­fied to his mail­box through Gmail. When a local visit pass­es the au­to­mat­ic checks, the ap­point­ment is record­ed in the prac­tice's cal­en­dar. For a long jour­ney, out­bound trav­el, the visit and re­turn trav­el may in­stead be pro­vi­sion­al­ly re­served pend­ing the con­troller's per­son­al con­fir­ma­tion. Data in­clude name, sur­name, email, tele­phone, prop­er­ty ad­dress, re­quest­ed ser­vices and pro­posed date and time. The terms and pri­va­cy no­tices of the Google ser­vices used apply. Google Pri­va­cy Pol­i­cy.
  • Aruba S.p.A.: web­site host­ing and in­fra­struc­ture. Data lo­ca­tions and any sub­con­trac­tors de­pend on the con­tract­ed ser­vice and its doc­u­men­ta­tion. Aruba Pri­va­cy No­tice (Ital­ian).

3. Legal bases

Per­son­al data are processed under the fol­low­ing bases in Ar­ti­cle 6 GDPR:

  • Pre-con­trac­tu­al steps or per­for­mance of a con­tract (Ar­ti­cle 6(1)(b)): form data used to re­spond to re­quests and arrange a pos­si­ble visit, in­clud­ing cal­en­dar en­tries and email no­ti­fi­ca­tions.
  • Le­git­i­mate in­ter­ests (Ar­ti­cle 6(1)(f)): brows­ing data for web­site se­cu­ri­ty; data processed through re­CAPTCHA, Open­StreetMap and HERE for form op­er­a­tion and prop­er­ty lo­ca­tion.
  • Con­sent (Ar­ti­cle 6(1)(a)): data col­lect­ed by Google An­a­lyt­ics 4 through op­tion­al third-party an­a­lyt­i­cal cook­ies. Con­sent is re­quest­ed through the web­site ban­ner and can be with­drawn at any time.
  • Legal oblig­a­tion (Ar­ti­cle 6(1)(c)): pro­cess­ing re­quired by law, such as in­voic­ing and pro­fes­sion­al oblig­a­tions.

4. Recipients

The prac­tice does not sell per­son­al data or make them pub­lic. Data may be dis­closed, to the ex­tent nec­es­sary, to the fol­low­ing re­cip­i­ents. Providers act­ing as in­de­pen­dent con­trollers process data under their own pri­va­cy notices:

  • Tech­ni­cal ser­vice providers, in­clud­ing host­ing, email and cloud in­fra­struc­ture, ac­cord­ing to the roles and agree­ments for the ser­vice used;
  • Google Ire­land Lim­it­ed and Google LLC, Open­StreetMap Foun­da­tion, HERE Glob­al B.V. and other providers for the pur­pos­es de­scribed in sec­tion 2.3;
  • Pub­lic and ju­di­cial au­thor­i­ties where re­quired by law.

5. Transfers outside the European Union

The ser­vices list­ed in sec­tion 2.3 may in­volve pro­cess­ing out­side the Eu­ro­pean Eco­nom­ic Area. Trans­fers must rely on the safe­guards under Ar­ti­cles 44–49 GDPR, ac­cord­ing to the terms of the provider and the ser­vice used. Open­StreetMap tiles are re­quest­ed di­rect­ly from the Foun­da­tion's in­fra­struc­ture, which may use servers in sev­er­al coun­tries. Provider pri­va­cy no­tices and rel­e­vant con­trac­tu­al doc­u­ments de­scribe their safe­guards.

For An­a­lyt­ics, Google states that it re­lies on the EU–US Data Pri­va­cy Frame­work for trans­fers cov­ered by its cer­ti­fi­ca­tion and on Stan­dard Con­trac­tu­al Claus­es in the cir­cum­stances pro­vid­ed in its ser­vice terms. See Google An­a­lyt­ics trans­fer safe­guards and data pro­cess­ing terms. For the per­son­al Google ac­count ser­vices used by the forms, Google de­scribes ad­e­qua­cy de­ci­sions, the Data Pri­va­cy Frame­work and Stan­dard Con­trac­tu­al Claus­es in its data trans­fer doc­u­men­ta­tion. HERE states that it uses Stan­dard Con­trac­tu­al Claus­es where nec­es­sary, to­geth­er with tech­ni­cal and or­gan­i­sa­tion­al mea­sures. Fur­ther in­for­ma­tion or a copy of the rel­e­vant safe­guards can be re­quest­ed from the con­troller using the con­tact de­tails in sec­tion 1.

6. Retention periods

Data are re­tained for as long as nec­es­sary for their pur­pos­es, re­spect­ing the stor­age lim­i­ta­tion prin­ci­ple in Ar­ti­cle 5(1)(e) GDPR:

  • Brows­ing data: tech­ni­cal logs are re­tained for the pe­ri­od con­fig­ured with the host­ing provider, lim­it­ed to se­cu­ri­ty, main­te­nance and in­ves­ti­ga­tion of mis­use.
  • Form data: re­tained as need­ed to han­dle the re­quest. If a pro­fes­sion­al en­gage­ment fol­lows, rel­e­vant doc­u­ments are re­tained ac­cord­ing to legal oblig­a­tions and the need to pro­tect rights con­nect­ed with the en­gage­ment. The pe­ri­od de­pends on the doc­u­ments and re­la­tion­ship con­cerned.
  • Google An­a­lyt­ics 4 data: the web­site's prop­er­ty is con­fig­ured to re­tain event data for 2 months and user data for 14 months. Re­set­ting the re­ten­tion pe­ri­od for user iden­ti­fiers on new ac­tiv­i­ty is en­abled, so the 14-month pe­ri­od runs from the lat­est ac­tiv­i­ty. These lim­its do not apply to most stan­dard ag­gre­gat­ed re­ports, which may have dif­fer­ent re­ten­tion pe­ri­ods.

7. Your rights

Under Ar­ti­cles 15–22 GDPR, you have the right to:

  • Ar­ti­cle 15: ob­tain con­fir­ma­tion of whether your per­son­al data are being processed and, if so, a copy of those data (ac­cess);
  • Ar­ti­cle 16: have in­ac­cu­rate data cor­rect­ed or in­com­plete data com­plet­ed (rec­ti­fi­ca­tion);
  • Ar­ti­cle 17: have data delet­ed in the cir­cum­stances pro­vid­ed by law (era­sure);
  • Ar­ti­cle 18: ob­tain re­stric­tion of pro­cess­ing;
  • Ar­ti­cle 20: re­ceive data in a struc­tured, com­mon­ly used, ma­chine-read­able for­mat and trans­mit them to an­oth­er con­troller, where ap­plic­a­ble (porta­bil­i­ty);
  • Ar­ti­cle 21: ob­ject to pro­cess­ing based on the con­troller’s le­git­i­mate in­ter­ests;
  • Ar­ti­cle 7(3): with­draw con­sent at any time, with­out af­fect­ing the law­ful­ness of pro­cess­ing based on con­sent be­fore its with­draw­al.

8. Exercising your rights

Send writ­ten re­quests to the con­troller using the con­tact de­tails in sec­tion 1. The con­troller will re­spond with­out undue delay and with­in one month of re­ceiv­ing the re­quest (Ar­ti­cle 12(3) GDPR). This may be ex­tend­ed by two fur­ther months where nec­es­sary be­cause of the com­plex­i­ty or num­ber of re­quests; you will be in­formed of the ex­ten­sion.

9. Complaints to a supervisory authority

With­out prej­u­dice to other ad­min­is­tra­tive or ju­di­cial reme­dies, you may lodge a com­plaint with the com­pe­tent su­per­vi­so­ry au­thor­i­ty. In Italy, this is the Garante per la Pro­tezione dei Dati Personali: www.garan­tepri­va­cy.it, Pi­az­za Venezia 11, 00187 Roma, Italy.

10. Changes to this notice

The con­troller may up­date this no­tice. Changes will be pub­lished on this page with a re­vised date at the be­gin­ning. Please check this page pe­ri­od­i­cal­ly.