Last updated: 17.10.2026. This English version is provided for convenience only; in case of discrepancy, the Italian text prevails.

1. Data controller

The data controller isAvv. Giovanni Emanuele Davide Barnabà, with offices in Bari (70122), Via De Rossi 225, Italy — VAT No. 09098340723.

• Email: g.barnaba@studiobarnaba.it
• Certified email (PEC): giovanniemanueledavidebarnaba@pec.it
• Telephone: +39 080 964 6134

No Data Protection Officer has been appointed: the conditions of art. 37 GDPR are not met, as processing is not on a large scale.

2. Scope of this notice

This notice concerns processing connected with browsing the Website and using the services offered on it.

Processing carried out in the course of legal practice — relationships with clients, opposing parties and third parties involved in matters — is governed by theExtended privacy notice for professional activity, published on the Website.

Cookies and other tracking tools are governed by theCookie Policy.

3. Purposes, data processed and legal bases

3.1 Contact and consultation requests

Data: first name, surname, telephone and electronic contact details, and any information the data subject chooses to provide about their situation.

Purposes: responding to the request and preliminary steps towards assessing a possible engagement.

Legal basis: art. 6(1)(b) GDPR — pre-contractual measures taken at the data subject’s request. Consent is not required.

Special categories and judicial data. Describing a debt situation, proceedings or a dispute may involve the voluntary disclosure of health data or data relating to criminal convictions and offences. Such data are processed underart. 9(2)(f) GDPR and, as regards the data referred to in art. 10, on the basis ofart. 2-octies(3)(i) of the Italian Privacy Code and the rules of conduct adopted by the Italian Data Protection Authority’s decision no. 512 of 19.12.2018, only to the extent necessary to establish, exercise or defend a legal claim.

Please do not include confidential or excessive information in the forms: documents are requested, where necessary, through appropriate channels after the first contact.

3.2 Booking appointments

Data: first name, surname, contact details, date and time of the appointment, brief subject of the request.

Purposes: managing the consultation schedule, in the office or remotely.

Legal basis: art. 6(1)(b) GDPR.

3.3 Newsletter

Data: email address, any identification data, data on interaction with the messages sent (opening and clicking on links).

Purposes: periodic sending of legislative and case-law updates and notices of published articles, with a maximum of two mailings a month.

Legal basis: art. 6(1)(a) GDPR — consent, given by voluntary subscription with an address confirmation procedure (double opt-in) and revocable at any time.

Withdrawal: via the unsubscribe link at the bottom of each message or by writing to segreteria@studiobarnaba.it. Withdrawal does not affect the lawfulness of prior processing.

3.4 Quick contact buttons and WhatsApp channel

The Website displays buttons that start a conversation through messaging apps. By selecting them, users start a communication whose content and metadata are also processed by the service provider — for WhatsApp, Meta Platforms Ireland Ltd. — in accordance with that provider’s terms and privacy notice, over which the Controller has no control.

Legal basis: art. 6(1)(b) GDPR as regards the Firm’s reply.

For confidential communications, the use of certified email (PEC) is recommended.

3.5 Comments on articles

Where the feature is active, posting a comment involves processing the name, email address, IP address and technical information about the browser used.

Legal basis: art. 6(1)(f) GDPR — legitimate interest in managing the discussion space and preventing abuse.

Comments are read by the Firm before publication. Comments containing data on the health, court proceedings or financial situation of identifiable persons are not published, nor are requests for advice on personal cases: the Firm replies to these privately, if the author so wishes. Authors may ask for their comment to be removed at any time.

3.6 Usage statistics and advertising campaign measurement

Data: random identifiers assigned to the device, pages viewed, source of the visit, interaction with the Firm’s adverts.

Purposes: measuring use of the Website and the effectiveness of the Firm’s advertising campaigns.

Legal basis: art. 6(1)(a) GDPR and art. 122 of the Italian Privacy Code — consent given through the banner, separately for statistics and for advertising. Without consent, no measurement takes place. The services used are listed in the Cookie Policy.

3.7 Security and operation

The systems that deliver the Website record technical connection data, including IP addresses, for operational, diagnostic and security purposes.

Legal basis: art. 6(1)(f) GDPR — legitimate interest in the security of the systems.

3.8 Legal obligations

Data needed to comply with tax, accounting and professional obligations are processed underart. 6(1)(c) GDPR.

4. Whether providing data is mandatory

Providing the data marked as mandatory in the forms is necessary to respond to the request; refusal prevents the requested service from being provided.

Providing data to subscribe to the newsletter is optional, and refusal has no consequences.

5. Recipients of the data

The data are processed by the Controller and may be disclosed to the following parties, who act as processors under art. 28 GDPR:

• Aruba S.p.A. — hosting, email and certified email services;
• Automattic Inc. — contact form on the “Contact us” page (Jetpack);
• WPMU DEV — consultation request forms and Website optimisation;
• NSquared — appointment scheduling;
• Google Ireland Ltd. — statistical and advertising measurement, fonts (Google Fonts), map services, video conferencing;
• CookieYes Ltd. — cookie consent management;
• Chaty — quick contact buttons;
• OptinMonster — collection of newsletter subscriptions.

Acting as independent controllers are the providers of the messaging apps selected by the user and the professionals who provide accounting and tax services to the Firm.

The data are never disseminated or disclosed to third parties for commercial purposes.

The up-to-date list of processors can be requested by writing to segreteria@studiobarnaba.it.

6. Transfers to third countries

Some of the parties listed in section 5 are based in the United States of America or carry out processing operations there.

Such transfers take place in compliance with Chapter V GDPR, on the basis of the adequacy decision adopted by the European Commission on 10.07.2023 (EU–US Data Privacy Framework), where the recipient has joined it, or of the standard contractual clauses under art. 46(2)(c) of the Regulation.

A copy of the safeguards adopted can be requested by writing to the Controller’s contact details.

7. Retention period

Data are kept only as long as strictly necessary for the purposes for which they are collected and, in particular:

• contact and consultation requests: twelve months from the last contact, unless they become part of the professional relationship;
• bookings: twenty-four months, unless they become part of the professional relationship;
• newsletter: until consent is withdrawn or the service ends;
• comments on articles: until the comment is removed or the feature is discontinued;
• accounting and tax data: ten years, under art. 2220 of the Italian Civil Code;
• connection data: the time technically necessary for security purposes.

If a professional engagement is given, the periods set out in the Extended privacy notice apply.

Once these periods have expired, the data are securely deleted.

8. No automated decision-making

The Controller does not carry out processing based on automated decision-making, including profiling, under art. 22 GDPR.

9. Minors

The Website is not intended for children under sixteen and does not knowingly collect their data. If such data are detected, they are deleted without delay.

10. Data subject rights

Data subjects have the right to:

• obtain access to their data (art. 15);
• request their rectification (art. 16) or erasure (art. 17);
• obtain restriction of processing (art. 18);
• receive their data in a structured format and transmit them to another controller — portability (art. 20);
• object to processing based on legitimate interest (art. 21);
• withdraw consent at any time, without affecting the lawfulness of prior processing (art. 7(3)).

Requests should be sent to segreteria@studiobarnaba.it. A reply is given within one month, which may be extended by two months for complex requests.

The exercise of these rights may be restricted, underart. 2-undecies of the Italian Privacy Code, where it would cause actual and concrete prejudice to defence investigations or to the exercise of a legal claim, and on grounds of professional secrecy.

11. Complaint to the supervisory authority

You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, as indicated at www.garanteprivacy.it, or apply to the courts.

12. External links

The Website may contain links to third-party websites, over whose processing the Controller has no control and for which it is not responsible.

13. Changes

This notice may be updated. The current version is always published on the Website, with the date of the last update.