Legal document
Privacy notice
How we process your personal data when you browse the site, request a quote, purchase a service or use your client area, in accordance with the GDPR (EU Reg. 2016/679).
The Italian version of this document is legally binding: any translation is for convenience only and, in case of discrepancy, the Italian version prevails.
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003 ("Privacy Code") as amended by Legislative Decree 101/2018, the Studio provides the following information on personal data processing.
1. Data controller
- Controller: Geom. Lorenzo Armellin (Ditta individuale - regime forfettario (operazione senza IVA, art. 1 c. 54-89 L. 190/2014))
- Operating address: Via Vittorio Veneto 31, 56025 Pontedera (PI)
- VAT no. P.IVA: 02432220503 - Tax code C.F.: RMLLNZ90E27G843J
- Board registration: Collegio Geometri e Geometri Laureati di Pisa, n. 1969 - iscritto dal 21/01/2022
- PEC: lorenzo.armellin@geopec.it - Email: studio@successioniarmellin.it - Phone: 320 1570567
2. Data Protection Officer (DPO)
Appointing a DPO is not mandatory for the activity carried out; the assessment is documented by the Controller and updated based on volumes and nature of processing. For any personal data request you may contact the Controller using the details in section 1.
3. Categories of data processed
Depending on the interaction, the Controller may process the following categories of data:
- Identity and contact data: name, surname, email, phone number.
- Service-related data (succession case): tax code, identity and estate data of heirs and deceased, properties, accounts and financial relationships, degrees of kinship.
- Documents: ID document, death certificate/deed, cadastral searches, certifications and other documents needed for the case.
- Payment data: handled directly by the payment provider (Stripe); the Controller does not store full card details.
- Technical and browsing data: IP address, device identifiers, logs, cookies and similar technologies (see section 11 and the Cookie Policy).
Some data may concern persons other than the user who provides them (e.g. other heirs or the deceased): the provider warrants they are authorised and undertakes to inform the data subjects of this notice (Article 14 GDPR).
4. Purposes of processing and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to quote/contact requests and pre-contractual activities | Art. 6.1.b (pre-contractual measures) |
| Performing the professional service (preparing and electronically filing the succession declaration, cadastral transfers) | Art. 6.1.b (contract) |
| Tax, accounting and retention obligations (invoicing, professional mandate) | Art. 6.1.c (legal obligation) |
| Payment management | Art. 6.1.b and 6.1.c |
| Site security, prevention of abuse/fraud, system integrity | Art. 6.1.f (legitimate interest) |
| Direct marketing / newsletter (if activated) | Art. 6.1.a (consent) |
| Cookies and non-technical/profiling technologies | Art. 6.1.a (consent) |
As a rule, collection of special categories of data under Art. 9 GDPR is not envisaged. Where necessary for the service, processing is based on Art. 9.2.a or other applicable bases.
5. Nature of provision
Providing data for contractual, tax and legal purposes is necessary: without it the service cannot be performed. Marketing or non-essential cookie consent is optional.
6. Processing methods and security
Data are processed with IT tools and appropriate technical and organisational measures (encryption, access control, backups, EU hosting where possible).
7. Recipients and processors
To deliver the service, the Controller uses providers that process data as processors or independent controllers:
| Provider | Role / service | Data location |
|---|---|---|
| Supabase | Database, authentication, document storage | EU |
| Vercel | Application hosting and delivery | EU (functions) / possible non-EU |
| Stripe | Payment processing | EU/USA (SCCs) |
| Resend | Transactional email delivery | EU/USA (SCCs) |
| Google Workspace | Studio professional email | EU/USA (SCCs / DPF) |
| OpenAI | Assisted extraction of data from case documents (internal support for the professional) | EU/USA (SCCs / DPF) |
| Meta Platforms (WhatsApp Cloud API) | Messaging (if activated) | EU/USA (SCCs) |
| Google (Analytics/Ads) | Statistics and advertising (only with prior consent) | EU/USA (SCCs) |
| Cloudflare (Turnstile) | Anti-abuse protection for forms (if activated) | EU/USA (SCCs) |
Data may also be disclosed to public bodies (e.g. Agenzia delle Entrate, Cadastre) as required to perform the service and for legal obligations.
8. Transfers of data outside the EU
The Controller prefers providers with data in the European Union. When some providers process data outside the EU, appropriate safeguards apply (Standard Contractual Clauses, adequacy decisions, Data Privacy Framework where applicable).
9. Retention period
- Tax and accounting documents (invoices, receipts, mandate, declaration): retained for the periods required by tax/civil law (normally 10 years).
- Sensitive input documents uploaded by the client (e.g. ID card): retained for the time needed for the case and then deleted or anonymised according to the privacy policy.
- Final documents (AdE receipts, updated searches, invoice): made available in the client area and retained as needed for the service and legal obligations.
- Contact data for quotes not converted: deleted or anonymised within 12 months of the last contact.
- Marketing data: until consent is withdrawn.
- Technical/log data and cookies: according to the durations in the Cookie Policy.
10. Data subject rights
You may exercise at any time the rights under Arts. 15–22 GDPR: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent.
Requests should be sent to the contacts in section 1. The Controller responds without undue delay and in any case within one month.
11. Cookies and tracking technologies
The site uses technical cookies and, with prior consent, analytics cookies (Google Analytics 4 with Consent Mode). Details are in the Cookie Policy.
12. Automated decision-making and artificial intelligence
No automated decision-making that produces legal effects on the user or similarly significantly affects them is carried out.
- Data sent via API are not used by OpenAI to train its models.
- Every extracted datum is verified and validated by the professional before use: the decision remains human.
- Any related non-EU transfer takes place with the safeguards in section 8.
13. Minors
Services are aimed at adults. The Controller does not knowingly collect data of minors without the involvement of those with parental responsibility.
14. Changes to this notice
The Controller may update this notice. The current version is always published on the site with the update date.