Privacy notice on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
This notice describes how the personal data of users who browse the website lawandtechnology.eu and use its services is processed. In compliance with Regulation (EU) 2016/679 (GDPR) and the applicable national legislation, the following information is provided.
1. Data controller
The data controller is Avv. Valentina Grazia Sapuppo. For any matter relating to the processing of personal data, you may write to valentinagraziasapuppo [at] proton [dot] me; further contact details are available on the Contacts page of the website.
2. Types of data processed
Browsing data. The IT systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols, such as IP addresses (in anonymised form) and information about the device and browser.
Data provided voluntarily by the user. The optional sending of communications through the contact form or the addresses indicated on the site entails the processing of the sender’s contact details (for example name and email address) and of any personal data contained in the message.
3. Purposes of processing
Personal data is processed for the following purposes:
- A. to respond to requests and communications sent by the user;
- B. to ensure the technical operation, availability and security of the website;
- C. to produce anonymous, aggregated statistics on the use of the website;
- D. to comply with any legal obligations or requests from authorities.
4. Legal basis for processing
For purpose A, processing is necessary to act on the user’s request and is based on the performance of pre-contractual measures or on legitimate interest (art. 6(1)(b) and (f) GDPR). For purpose B, processing is based on the controller’s legitimate interest in ensuring the operation and security of the site (art. 6(1)(f) GDPR). For purpose C, processing is based on the user’s consent, given through the cookie management banner (art. 6(1)(a) GDPR). For purpose D, processing is necessary to comply with a legal obligation to which the controller is subject (art. 6(1)(c) GDPR).
5. Provision of data and refusal
Providing data is free and optional. Failure to provide the data needed to respond to a request makes it impossible to fulfil it. Browsing data is acquired automatically solely for the operation of the site; usage statistics are collected only subject to consent.
6. Processing methods and retention period
Processing is carried out using IT and electronic tools, with logic strictly related to the stated purposes and adopting technical and organisational measures adequate to ensure the security and confidentiality of the data. In compliance with the principles of lawfulness, purpose limitation and minimisation, data is retained for the time strictly necessary to achieve the purposes for which it was collected and in compliance with legal obligations.
7. Special categories of personal data
The site is not intended for the processing of data belonging to the special categories referred to in art. 9 of Regulation (EU) 2016/679, nor of data relating to criminal convictions and offences referred to in art. 10 of the same Regulation. Users are asked not to include such data in the communications they send.
8. Recipients
Data may be processed by parties providing technical services instrumental to the operation of the site, such as the hosting provider and the cookie consent management service, appointed as data processors where necessary. Data is not disseminated.
9. Transfer of data to third countries
Usage statistics are collected through a self-hosted installation of Matomo, with IP address anonymisation, without transfer to third countries. Where individual third-party components involve the transfer of data outside the European Economic Area, such transfer takes place only in the presence of adequate safeguards pursuant to Chapter V of the GDPR.
10. Cookies
The site uses necessary technical cookies and, subject to consent, statistical cookies. For details on cookies and to manage preferences, please refer to the Cookie Policy.
11. Rights of the data subject
The data subject may exercise at any time, by writing to the controller at valentinagraziasapuppo [at] proton [dot] me, the rights provided for in Articles 15 to 22 of Regulation (EU) 2016/679, including:
- Art. 15 – right of access to one’s personal data;
- Art. 16 – right to rectification of inaccurate or incomplete data;
- Art. 17 – right to erasure (right to be forgotten);
- Art. 18 – right to restriction of processing;
- Art. 20 – right to data portability;
- Art. 21 – right to object to processing;
- Art. 22 – right not to be subject to automated decision-making, including profiling.
The data subject also has the right to withdraw consent at any time (art. 7(3) GDPR), without affecting the lawfulness of processing based on consent before its withdrawal, and to lodge a complaint with the supervisory authority. In Italy this authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
12. Changes to this notice
The controller reserves the right to make changes to this notice by publishing them on this page. Users are therefore invited to consult it periodically.
Last updated: 1 July 2026