1. Data Controller

This Privacy Notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Italian Legislative Decree No. 196 of 30 June 2003, as subsequently amended (hereinafter the “Italian Privacy Code”). It describes how the personal data of users who visit the website https://www.fbmr.it/ (hereinafter the “Website”) or use the contact features available through it are processed.

The Data Controller is FBMR Advisory STP S.r.l., with registered office at Corso Buenos Aires No. 56, Milan, Italy, Italian Tax Code and VAT Number 12638170964 (hereinafter the “Data Controller” or “FBMR”).

Contact details of the Data Controller:

Address: Corso Buenos Aires No. 56, 20129 Milan, Italy

Email: info@fbmr.it

Telephone: +39 02 82872 508

The Data Controller has not appointed a Data Protection Officer (DPO). Any enquiries concerning the processing of personal data may be addressed directly to the contact details provided above.

This Privacy Notice applies exclusively to processing activities associated with accessing and using the Website, as well as managing enquiries received through the contact channels provided on the Website.

Any additional processing activities carried out in the context of professional relationships with FBMR’s clients are governed by the specific privacy notices provided to the relevant data subjects.

 

2. Categories of Personal Data Processed

2.1. Browsing Data

The IT systems and software procedures used to operate the Website collect, during their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols.

Such data may include:

• IP addresses and domain names of the devices used by users;

• addresses of requested web resources;

• dates and times of requests;

• information concerning the browser, operating system and device used;

• technical information concerning requests and server responses;

• other data necessary for the proper functioning of the Website and the security of IT systems.

This information may be used to enable browsing, monitor the proper functioning of the Website, identify technical issues, prevent unauthorised access and protect the security of IT systems.

2.2. Data Voluntarily Provided by Users

The Data Controller processes personal data voluntarily provided by users through the contact form available on the Website, by email, telephone or through the other communication channels indicated.

Such data may include:

• first name and surname;

• email address;

• telephone number;

• information concerning the user’s professional activity or business, where applicable;

• content of requests for information or professional advice;

• additional information and documents voluntarily submitted by the data subject.

Personal data are processed exclusively for purposes relevant to the enquiry received, unless a further, independent legal basis for processing applies.

Users are requested not to submit, through the contact form, personal data that are unnecessary for handling their enquiry, particularly special categories of personal data referred to in Article 9 of the GDPR or personal data relating to criminal convictions and offences referred to in Article 10 of the GDPR.

Should such information nevertheless be provided, the Data Controller will assess its relevance and whether it may lawfully be processed in accordance with applicable legislation.

2.3. Cookies and Other Tracking Technologies

The Website may use cookies and other tracking technologies for technical and statistical purposes and, where enabled, for advertising measurement purposes.

For information on the types of cookies used, their respective purposes, retention periods and consent management procedures, please refer to the Cookie Policy, available through the link in the Website footer.

 

3. Purposes and Legal Bases of Processing

Personal data are processed for the purposes described below, on the legal bases provided for under Article 6 of the GDPR.

3.1. Website Operation and Security

Browsing data are processed in order to:

• enable access to and proper display of the Website;

• ensure the operation of the available services and features;

• carry out maintenance activities and resolve technical issues;

• prevent and counter unauthorised access, cyberattacks, attempted security breaches and other unlawful uses of the systems;

• protect the integrity and availability of the Website and its underlying IT infrastructure.

Legal basis: Article 6(1)(f) of the GDPR, based on the Data Controller’s legitimate interest in ensuring the operation, reliability and security of the Website and its IT systems, while respecting the fundamental rights and freedoms of data subjects.

3.2. Management of Requests for Information and Professional Advice

Personal data provided through the contact form or other contact details indicated on the Website are processed in order to:

• receive and manage users’ enquiries;

• provide information about FBMR’s activities and professional services;

• assess requests for professional advice or assistance;

• contact users in order to respond to their enquiries;

• carry out, where requested, preliminary activities aimed at potentially establishing a professional relationship.

Legal basis:

• Article 6(1)(b) of the GDPR, where processing is necessary to take steps at the request of the data subject prior to entering into a contract;

• Article 6(1)(f) of the GDPR, in other cases, based on the Data Controller’s legitimate interest in managing unsolicited communications and responding to data subjects.

Data collected in this manner will not be used to send newsletters or unsolicited promotional communications.

Should a professional relationship subsequently be established, the specific privacy notices applicable to the services provided will apply.

3.3. Statistical Analysis and Website Improvement

The Data Controller may process browsing data through statistical analysis tools, such as Google Analytics 4, for the following purposes:

• analysing how the Website is used;

• determining the number and origin of visits;

• identifying the most frequently visited pages;

• assessing the effectiveness of the Website’s content;

• improving the organisation and usability of the Website.

Legal basis: Article 6(1)(a) of the GDPR, where processing is based on the data subject’s consent, without prejudice to Article 122 of the Italian Privacy Code and the provisions applicable to statistical tools that may be treated as equivalent to technical tools.

3.4. Measuring the Effectiveness of Advertising Campaigns

Where tracking technologies associated with Google Ads are active, the Data Controller may process data relating to interactions with advertisements in order to measure the effectiveness of advertising campaigns and activities aimed at acquiring new contacts.

Any use of remarketing or personalised advertising tools is subject to the requirements and consents prescribed by applicable legislation.

Legal basis: Article 6(1)(a) of the GDPR, based on the data subject’s consent, where such consent is required.

Failure to provide consent to such processing activities will not affect the ability to browse the Website or contact FBMR.

3.5. Compliance with Legal Obligations and Protection of Rights

Personal data may also be processed where necessary to comply with obligations imposed by applicable legislation, respond to lawful requests from competent authorities, or establish, exercise or defend legal claims.

Legal basis: Article 6(1)(c) of the GDPR, where processing is necessary to comply with a legal obligation, or Article 6(1)(f) of the GDPR, based on the legitimate interest in protecting the Data Controller’s rights, where applicable.

 

4. Nature of the Provision of Personal Data

The provision of personal data requested through the contact form is voluntary.

However, failure to provide the information necessary to identify and contact the user may prevent the Data Controller from responding to the enquiry received.

Browsing data necessary for the operation of the Website are collected automatically when users access web pages, according to the technical characteristics of the systems used.

Consent to the use of non-essential cookies or other tracking technologies is voluntary, and refusing such consent does not prevent normal browsing of the Website.

 

5. Processing Methods and Security Measures

Personal data are processed using IT and electronic communication systems and, where necessary, paper-based means, in accordance with methods strictly related to the purposes set out in this Privacy Notice.

Processing is carried out by authorised staff and collaborators, within the scope of their respective responsibilities, as well as by external parties that may be appointed as data processors pursuant to Article 28 of the GDPR.

The Data Controller implements technical and organisational measures appropriate to the level of risk in order to protect personal data against unauthorised access, loss, alteration, unlawful disclosure and other forms of unauthorised processing.

The Website uses IT security tools, including Wordfence, designed to protect its WordPress infrastructure, detect potentially malicious activities, monitor login attempts and prevent cyberattacks.

Such tools may involve the recording and analysis of technical information, including IP addresses, network identifiers, request timestamps and data relating to attempts to access the Website.

 

6. Recipients of Personal Data

Personal data may be accessed and processed, to the extent necessary to achieve the purposes described above, by the following categories of recipients:

• FBMR personnel, professionals and collaborators authorised to process personal data;

• providers of hosting services and IT infrastructure;

• providers responsible for the development, maintenance, updating and security of the Website;

• providers of email and communication services;

• providers of statistical analysis and advertising measurement services, where actually used;

• advisers and professionals who may be involved in complying with legal obligations or protecting the Data Controller’s rights;

• public authorities and other parties to whom disclosure is required by law or pursuant to lawfully issued orders.

In particular, depending on the features actually enabled, personal data may be processed through services provided by:

• Google, for statistical analysis and advertising measurement features;

• Defiant, Inc., provider of the Wordfence IT security service.

External parties may act as data processors pursuant to Article 28 of the GDPR or as independent data controllers, depending on the characteristics of the service and their respective responsibilities.

Personal data are not sold to third parties.

 

7. Links to Third-Party Services

The Website may contain links to external platforms and services, including Google Maps and WhatsApp, which allow users to obtain directions or contact FBMR through alternative channels.

Accessing such services may involve the processing of personal data by their respective operators, in accordance with their privacy notices and terms of use.

Processing activities carried out independently by such parties are outside the Data Controller’s responsibility.

FBMR remains responsible for the processing of any personal data it receives and subsequently uses to manage enquiries from data subjects.

 

8. Retention of Personal Data

Personal data are retained for no longer than is necessary to fulfil the purposes for which they were collected, in accordance with Article 5(1)(e) of the GDPR.

In particular:

• Data relating to requests for information or professional advice: retained for the period necessary to handle the enquiry and, in the absence of an established professional relationship or other legitimate grounds for further retention, for no longer than six months from receipt.

• Data relating to ordinary support requests: where such requests are handled separately from professional activities, retained for the period necessary to resolve them and, in any event, for no longer than three months from the last communication.

• Technical browsing and security data: retained in accordance with the log rotation and deletion periods configured in the hosting and security systems, limited to the period necessary for the operation of the Website, the identification of anomalies and the prevention of IT security incidents.

• Data collected through statistical and advertising tools: retained in accordance with the settings applicable to the services used and for the periods specified in the relevant privacy notices and the Cookie Policy, taking into account the configurations adopted by the Data Controller.

Upon expiry of the applicable retention period, personal data will be deleted or anonymised, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend legal claims.

Where an initial enquiry results in the establishment of a professional relationship, the relevant personal data will be processed and retained in accordance with the purposes and retention periods specified in the privacy notices applicable to that relationship.

 

9. Transfers of Personal Data to Third Countries

In connection with the use of IT services and technology platforms provided by external parties, certain personal data may be transferred or made accessible to recipients located outside the European Economic Area, including the United States of America.

In such cases, transfers are carried out in compliance with Chapter V of the GDPR, using one of the safeguards provided for under applicable legislation.

In particular, transfers may be based on adequacy decisions adopted by the European Commission pursuant to Article 45 of the GDPR, including the EU-US Data Privacy Framework for participating US recipients, or, where necessary, on Standard Contractual Clauses approved by the European Commission pursuant to Article 46 of the GDPR, together with any additional measures that may be required.

Data subjects may request information about the safeguards applicable to any such transfers by contacting the Data Controller using the contact details provided in this Privacy Notice.

 

10. Promotional Communications and Automated Decision-Making

Personal data provided by users through the contact form are not used to automatically subscribe them to newsletters or mailing lists for commercial communications.

This Privacy Notice does not cover processing activities aimed at systematically sending promotional communications by email, SMS or other direct communication channels.

Any use of advertising and tracking tools for measurement or personalisation purposes is governed by the provisions of this Privacy Notice and the Cookie Policy.

In managing enquiries received through the Website, the Data Controller does not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them within the meaning of Article 22 of the GDPR.

 

11. Rights of Data Subjects

Data subjects may exercise, in the cases and within the limits provided for under applicable legislation, the rights granted by Articles 15–22 of the GDPR.

In particular, they have the right to:

• obtain confirmation as to whether personal data concerning them are being processed and access such data;

• request the rectification of inaccurate personal data or the completion of incomplete data;

• request the erasure of personal data, where provided for by law;

• obtain the restriction of processing;

• object to processing in the cases provided for under Article 21 of the GDPR, including where processing is based on the Data Controller’s legitimate interests;

• receive their personal data in a structured, commonly used and machine-readable format and request their transmission to another controller, where the conditions for data portability are met;

• withdraw any consent previously given at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Requests to exercise these rights may be submitted to the Data Controller using the contact details provided above.

The Data Controller will respond within the time limits and in accordance with the procedures laid down in Article 12 of the GDPR.

Data subjects have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they believe that the processing of their personal data infringes applicable data protection legislation.

 

12. Amendments and Updates to This Privacy Notice

The Data Controller reserves the right to amend and update this Privacy Notice to reflect changes in legislation, decisions of competent authorities or changes to the services, systems and methods used to process personal data.

Any updates will be published on this page, indicating the date of the latest revision.

The updated version of this Privacy Notice will be available at any time through the relevant link on the Website.