Privacy and cookie notice

Last updated: 1 November 2026

1. Data controller

The controller of the personal data collected through this website is Studio Professionale Umbriano & Partners, with offices at Via Pinturicchio 1, 20133 Milan, Italy, in the person of Dott. Raffaele Umbriano, Chartered Accountant registered with ODCEC Milan.

For any matter concerning your personal data you may write to raffaele@umbriano.it.

2. What data we collect

We collect only the data needed to answer your enquiries and to operate the website properly. Specifically:

• Data you provide: name and surname, company name if applicable, email address, telephone number, subject of the enquiry and the content of the message you send through the contact form or by email.
• Technical browsing data: IP address, browser and device type, pages visited, date and time of access. These are recorded in the server logs for security and operational reasons.
• Engagement data: if you become a client, the data and documents required to carry out the engagement, processed within the professional relationship and governed by the relevant agreement.

This website does not collect special categories of data through the contact form. Please do not include in your message information concerning health, legal proceedings or other special categories of data: where necessary, we will obtain it during the engagement with appropriate safeguards.

3. Why we process it and on what legal basis

• To answer your enquiries — legal basis: your consent, which you may withdraw at any time, and steps taken at your request prior to entering into a contract (Art. 6(1)(a) and (b) GDPR).
• To carry out the professional engagement, if the contact becomes a relationship — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To comply with legal obligations in tax, accounting and anti-money-laundering matters — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To keep the website secure and prevent misuse — legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• To defend our rights in legal proceedings where necessary — legal basis: legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for profiling, we take no automated decisions concerning you and we send no marketing communications unless you expressly request them.

4. Provision of data

Providing the data marked as mandatory in the contact form is necessary for us to reply: without it we cannot act on your enquiry. Providing any other data is optional.

5. Who the data may be disclosed to

Your data is processed by the controller and by authorised persons acting under its responsibility. It may be disclosed, strictly as necessary, to:

• Netlify, Inc., which hosts this website and which receives, stores and forwards to the controller the messages sent through the contact form, acting as a processor under Art. 28 GDPR;
• other technical service providers (email, storage tools), likewise appointed as processors;
• professionals and advisers assisting with the engagement, bound by confidentiality obligations;
• public authorities, where disclosure is required by law or requested by a competent authority.

Your data is not sold, transferred or disclosed to third parties for commercial purposes.

6. Transfers outside the European Economic Area

Some technical service providers may process data in third countries. In that case the transfer takes place solely on the basis of an adequacy decision of the European Commission or of the standard contractual clauses approved by the Commission, together with any supplementary measures required.

In particular, the data you enter in the contact form is transmitted to and stored in the infrastructure of Netlify, Inc., based in the United States of America, which acts as a processor on behalf of the controller. The transfer is governed by the standard contractual clauses approved by the European Commission and by the further safeguards set out in the agreement entered into with that provider.

If your engagement concerns third countries — for example the United Arab Emirates — the necessary data may be disclosed to professionals and authorities in those countries, strictly as required to perform the contract (Art. 49(1)(b) GDPR).

7. How long we keep it

• Enquiries that do not lead to an engagement: twelve months from our reply, unless you tell us otherwise.
• Engagement data: for the duration of the relationship and thereafter for the period required by accounting, tax and anti-money-laundering law, and in any event for as long as needed to defend the controller’s rights.
• Technical server logs: a limited period, as a rule no longer than twelve months.

Messages sent through the contact form also remain stored in the website’s management panel, held by the hosting provider, until they are deleted: we remove those no longer needed on a regular basis.

Once those periods expire, data is deleted or irreversibly anonymised.

8. Security and confidentiality

We apply technical and organisational measures appropriate to protect data against unauthorised access, loss or disclosure: HTTPS transmission, access protected by individual credentials, restricted permissions and backups.

Professional activity is additionally covered by professional secrecy: all information obtained in the course of an engagement is treated with the utmost confidentiality and is not disclosed to third parties, save where required by law.

9. Your rights

At any time you may exercise the rights set out in Articles 15 to 22 GDPR, and in particular:

• obtain confirmation that processing is taking place and access your data;
• request rectification or completion of inaccurate or incomplete data;
• request erasure, in the cases provided for by law;
• request restriction of processing;
• object to processing based on legitimate interest;
• receive your data in a structured format and transmit it to another controller (portability);
• withdraw your consent, without affecting the lawfulness of processing already carried out.

To exercise them, simply write to raffaele@umbriano.it. We will reply without undue delay and in any event within one month of your request.

If you believe that the processing of your data infringes the applicable rules, you have the right to lodge a complaint with the supervisory authority: the Italian Data Protection Authority (Garante per la protezione dei dati personali).

10. Cookies and third-party tools

This website is built as static pages and uses no profiling, marketing or analytics cookies. There are no tracking pixels and no user-behaviour analysis tools.

Only two third-party elements are present:

• Google Fonts: the website’s typefaces are served from Google’s servers, which may record the visitor’s IP address in order to deliver the file;
• Google Maps: the map on the contact page is embedded by Google and loads only when you open that page. Interacting with the map may result in Google setting cookies.

Both services are provided by Google Ireland Limited; please refer to Google’s privacy notice. You can block or delete cookies at any time in your browser settings.

11. Changes to this notice

This notice may be updated to reflect changes in the law or in the website. The version in force is always the one published on this page, with the date of the latest update shown at the top.