02-92853067
Stefano Ricci Stefano Ricci

Privacy Policy

Last updated: 13/10/2026

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 to visitors and users of www.ricci.legal (the “Website”). It does not cover third-party websites reachable through links.

1. Data controller

Avv. Stefano Ricci, Via Pietro Colletta 7, 20135 Milan, Italy – VAT no. 04850500960 – tel. +39 02 92853067 – e-mail stefano@ricci.legal – certified e-mail (PEC) stefano.ricci@cert.ordineavvocatimilano.it.

2. Data processed, purposes and legal bases

2.1 Browsing data

The systems running the Website collect, in the course of their normal operation, certain data whose transmission is inherent in the use of Internet protocols (e.g. IP address, date and time of the request, resource requested, server response code, browser and device type). These data are processed to ensure the operation and security of the Website and to detect any misuse, on the basis of the controller’s legitimate interest (Article 6(1)(f) GDPR). They are kept for up to 6 months, unless needed to establish unlawful conduct.

2.2 Requests via the contact form or e-mail

The data entered in the contact form (name and surname, e-mail, telephone, text of the request) or sent spontaneously by e-mail are processed to reply and, where appropriate, to arrange a meeting, on the basis of Article 6(1)(b) GDPR. Please do not include in your first contact health data or other special categories of data (Article 9 GDPR), or data relating to criminal convictions and offences (Article 10 GDPR). Further details are set out in the contact form privacy notice.

2.3 Booking a consultation

The “Book a consultation” button links to a Google Calendar booking page. The data entered to book (name, e-mail and any notes) are processed to schedule and manage the appointment, on the basis of Article 6(1)(b) GDPR, and are kept according to the criteria set out in section 5. The service is provided by Google Ireland Ltd.

2.4 Spam protection (Google reCAPTCHA)

The contact form uses Google reCAPTCHA v3, which collects data on the user’s interaction with the page (e.g. IP address, browser data, pointer movements) to distinguish human users from automated programs. The processing is based on the controller’s legitimate interest in the security of the Website (Article 6(1)(f) GDPR). The service is provided by Google Ireland Ltd; more information is available in Google’s privacy policy (policies.google.com/privacy).

2.5 Usage statistics (Google Analytics 4)

Subject to consent given through the cookie banner, the Website uses Google Analytics 4 to measure page usage in aggregate form. The legal basis is consent (Article 6(1)(a) GDPR and Article 122 of Legislative Decree 196/2003), which may be withdrawn at any time through the preference settings. Without consent the tool is not activated. Data are kept for 14 months.

3. Cookies and similar technologies

The Website uses:

  • technical cookies, necessary for the operation of the Website and for storing cookie preferences through the Axeptio consent management platform, provided by Agilitation, a French simplified joint-stock company (SAS). These cookies do not require consent;
  • security tools (Google reCAPTCHA), described in section 2.4;
  • third-party analytics cookies (Google Analytics 4), set only with consent, described in section 2.5.

On the first visit the banner allows you to accept, reject or customise non-technical cookies; your choice can be changed at any time. Rejecting cookies does not prevent browsing.

3.1 Links to third-party websites

The links to the controller’s LinkedIn and X profiles lead to third-party websites, which process data under their own privacy notices.

4. Recipients and transfers outside the EEA

Data are processed by the controller and by any authorised and instructed staff (Article 29 GDPR). They may also be processed, as processors (Article 28 GDPR) or independent controllers, by the providers of hosting, website maintenance and e-mail services and by the providers of the services described in sections 2 and 3. Data are not disclosed to the public. Some providers may transfer data to the United States: such transfers rely on the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) or, failing that, on the standard contractual clauses adopted by the Commission (Article 46 GDPR).

5. Retention

Data are kept for the periods indicated above. Data relating to contact requests and bookings are kept for as long as necessary to handle them and in any case no longer than 24 months from the last contact; if a professional engagement follows, they are kept for the duration of the engagement and for the period required by law and professional rules.

6. Your rights

You may at any time, free of charge and without formalities, exercise your rights of access, rectification, erasure, restriction, portability and objection (Articles 15-22 GDPR), and withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal, by writing to stefano@ricci.legal. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you habitually reside, work or where the alleged infringement occurred.

The controller does not take decisions based solely on automated processing, including profiling.

7. Changes

This notice may be updated; the version in force is always published on this page, together with the date of the last update.

Cookies

The data is managed through a cookie management tool, and the cookie policy is shown as an overlay upon first access to the website.

Possible Recipients or Categories of Recipients of Personal Data and Transfer of Personal Data to a Third Country or Outside the European Economic Area

Only authorized individuals, duly instructed (including with regard to security measures and confidentiality obligations) in accordance with Article 29 GDPR, may access the data. This may include employees of the data controller handling user requests via the form present on the site.

Further access to the data may be granted, as independent data controllers or processors under Article 28 GDPR, to professionals and consultants appointed by the Controller. Specifically, but not limited to, the data may be accessed by:

  • Entities providing IT system and communication network management services (including email accounts or payment providers);
  • Companies supporting the controller in the administration of the Site (e.g., the Internet service provider) or in providing the services requested by the user;
  • Couriers and shippers handling product shipments;
  • Competent authorities fulfilling legal obligations and/or requests from public bodies;
  • Other companies within the business group for internal administrative purposes based on the legitimate interest of the controller;
  • Other companies during corporate operations such as acquisitions or splits, provided that it is contractually ensured that such information remains confidential and protected.

To obtain an updated list of entities that may access personal data, a request can be made using the contact details provided.

The controller guarantees that personal data will never be disseminated. If it becomes necessary to transfer the data to a third country outside the EEA, the controller guarantees that such transfer will occur only in the presence of an adequacy decision by the European Commission or other appropriate safeguards provided for by personal data protection regulations (such as the stipulation of standard contractual clauses with the recipient ensuring that the user’s personal data is subject to the same level of protection guaranteed by the controller).

Rights of the Data Subject

Exercising the rights indicated in this section is free of charge and not subject to any formality, except for requests that are manifestly unfounded or excessive under Article 12(5) of the GDPR.

Concerning the processing described in this policy and under the GDPR, the user may exercise the following rights:

  • Right of access to their personal data and all information specified in Article 15 of the GDPR;
  • Right to rectify inaccurate personal data and to complete incomplete data;
  • Right to erase personal data except for those contained in documents that must be mandatorily retained by the Company and unless there is an overriding legitimate reason to proceed with processing;
  • Right to restrict processing under one of the scenarios outlined in Article 18 of the GDPR;
  • Right to object to the processing of personal data, without prejudice to the need and mandatory nature of the processing for establishing the relationship;
  • Right to withdraw consent for non-mandatory data processing without affecting the lawfulness of processing based on consent before its withdrawal.

The Data Subject also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) or the Supervisory Authority of the EU Member State where the Data Subject habitually resides, works, or where the alleged violation occurred in relation to a processing activity considered non-compliant.

For any requests, the user can use the contact details provided.

Policy Modifications

Any future changes to this policy will be published on this page. Users can review and stay updated.