Legal
Privacy Policy
This document is drawn up pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 in order to explain how your personal data is handled when you use this website.
01The controller
The controller within the meaning of Art. 4(7) of the Regulation is Harald Wild, Consulente del Lavoro (payroll and employment law consultant), Pfarrmoos 11, 39050 Völs am Schlern (BZ), Italy. For questions about the processing of your data you can reach me at the contact details at the foot of this page; the full provider details are in the legal notice.
No data protection officer (DPO) has been appointed – the conditions in Art. 37 of the Regulation are not met for a single-practitioner office of this size. Please address data protection enquiries to me directly.
02The personal data covered by this processing
The processing covers only the data that arises when this website is used:
2.1Navigation data
When a page is requested, the systems operating this website record technically necessary information: IP address, the date and time of the request, the address requested, the volume of data transferred, the server's response status, the referring page, and browser and operating system identifiers.
This data arises at the hosting provider and is required in order to deliver the page. It is held there only briefly for operational and security purposes and then deleted automatically. I do not analyse it, keep no statistics from it, and do not attribute it to any person.
2.2Data provided by the data subject
The form on the contact page processes: name, email address, subject, and message as required entries, and company and phone number as optional ones, together with confirmation of the consent checkbox. An additional field, invisible to you, serves solely to deter spam; if it is filled in, the submission is discarded and not examined further.
If you contact me directly by email, PEC, or phone, I process the information transmitted – sender details and the content of your message, or your number and your request – in order to reply.
2.3Special categories and third-party data
Please do not use the form to transmit special categories of personal data within the meaning of Art. 9 of the Regulation – in particular health data, such as data arising from sick leave, disability, or maternity – or data concerning your employees. An initial enquiry can be described without such details.
Where they are needed for advice, they are collected within the engagement by a suitable route, on the basis of the separate notice (section 10). If you do transmit third-party data, I process it only as far as is necessary to reply and delete it within the periods in section 7; responsibility for the lawfulness of the transmission itself remains with the sender.
2.4Cookies and similar techniques
Cookies are small text files that a website places on the visitor's device via the browser. They are read again on a later visit and serve different purposes: technically necessary cookies support a site's navigation and security, statistics cookies record how a site is used, functional cookies remember choices you have made, and profiling cookies track behaviour across several sites in order to serve targeted advertising. Besides cookies there are browser stores that do the same thing, such as localStorage.
For cookies and storage that are not strictly necessary in order to operate the website, the visitor must actively consent, and that consent can be withdrawn at any time (Art. 122 of Legislative Decree 196/2003, implementing Directive 2002/58/EC). This website therefore shows a banner on your first visit. Until you decide, everything that is not necessary stays switched off: it is not loaded and later deleted, it is not loaded at all.
This website uses no profiling cookies and no advertising networks; no addresses or identifiers are matched against third-party databases.
2.5Consent decision and statistics
The choice you make in the consent dialogue is stored locally in your browser (localStorage, not a cookie) so that the dialogue does not reappear on every visit. That entry never leaves your device.
Only if you consent to the “Statistics” category is Google Analytics 4 loaded, recording usage data such as pages viewed, time spent, approximate location, and device characteristics. Without your consent the script is not loaded and no connection to Google is established.
This website embeds no other external content, and in particular no map. The office address appears as text on the contact page.
2.6Blocking cookies in your browser settings
Independently of the consent dialogue, cookies and site data can be blocked or deleted in the browser. The setting is found in every common browser under privacy and security, where individual cookies already stored can also be removed. If you block everything, sites that depend on technically necessary cookies may work incompletely – this website works without them.
The providers' instructions:
The individual cookies and services used, together with retention periods and how to withdraw consent, are set out in the cookie policy.
03Purposes of the processing
The data is processed for the following purposes:
- a) Operating the website
- delivering the pages, stability and security, and detecting faults and attempted abuse.
- b) Answering enquiries
- handling your enquiry sent through the form, by email, PEC, or phone, replying to you and – if an engagement follows – taking the preliminary steps to it.
- c) Spam protection
- screening form submissions for automated abuse so that the contact channel remains usable.
- d) Demonstrating consent
- storing your decision from the consent dialogue so that it persists and can be demonstrated.
- e) Audience measurement
- statistical analysis of usage with Google Analytics 4, in order to improve the structure and content of the website.
The data is not processed for any other purpose. In particular, there is no processing for advertising, newsletters, market research, or profiling, and no matching against third-party databases.
04Legal basis and whether providing the data is required
| Purpose | Legal basis | Providing the data |
|---|---|---|
| a) Operating the website | Art. 6(1)(f) – legitimate interest in secure and uninterrupted operation | required: without navigation data the page cannot technically be delivered |
| b) Answering enquiries | Art. 6(1)(a) – consent via the checkbox in the form – and (b) – steps preliminary to a contract | optional: without the entries marked as required, an enquiry cannot be dealt with |
| c) Spam protection | Art. 6(1)(f) – legitimate interest in working contact channels | required as part of any form submission |
| d) Demonstrating consent | Art. 6(1)(c) together with Art. 7(1) – obligation to be able to demonstrate consent | required as soon as you make a choice in the dialogue |
| e) Audience measurement | Art. 6(1)(a) – consent; for storage on your device, Art. 122 of Legislative Decree 196/2003 | optional: refusing has no consequences for your use of the website |
You may withdraw consent at any time; this does not affect the lawfulness of processing carried out up to that point (Art. 7(3) of the Regulation).
05Recipients of personal data
The data may be made accessible to the following recipients:
- (i) processors that are necessary in order to provide the service – the hosting provider of this website and the providers of the contact channels;
- (ii) persons, bodies, or authorities to whom the data must be disclosed under a statutory provision or an official order;
- (iii) persons authorised by me to carry out processing and bound to confidentiality – as I work without employees, there are currently no such persons.
| Recipient | Task | Location | Basis |
|---|---|---|---|
| Netlify, Inc. | hosting the website and handling form submissions; engages its own sub-processors for this, including a service that screens every form submission for spam | USA | processor under Art. 28 of the Regulation; EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited and Google LLC | audience measurement with Google Analytics 4 – only with your consent | Ireland and USA | processor under Art. 28 of the Regulation; EU-US Data Privacy Framework |
| Aruba S.p.A. | running the email mailbox: transmitting and storing messages | Italy | processor under Art. 28 of the Regulation |
| Tinexta Infocert S.p.A. (Legalmail) | running the PEC mailbox on the professional chamber's domain | Italy | processor under Art. 28 of the Regulation |
There are no other recipients: data is not sold, not passed on for advertising purposes, and not made accessible to any other third party. Statutory recipients such as INPS, INAIL, the Revenue Agency, or welfare funds concern only processing within an engagement (section 10), not the use of this website.
The sub-processors engaged by the hosting provider are listed in its data processing agreement: netlify.com/gdpr-ccpa. On request I will name the recipients and provide a copy of the transfer safeguards.
06Transfers of personal data outside the EEA
Netlify, Inc. and Google LLC are established in the United States; using their services may involve transfers of data there. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Decision (EU) 2023/1795), supplemented by the standard contractual clauses under Implementing Decision (EU) 2021/914.
That decision is in force: the General Court of the European Union upheld it in September 2025 and an appeal before the Court of Justice is pending. A residual risk of access by US authorities cannot be ruled out entirely. Google's service is therefore loaded only after you consent; the transfer to Netlify is necessary in order to operate the website and is limited to the navigation and form data described in section 2.
07Retention of personal data
Data is kept no longer than the relevant purpose requires:
- Navigation data (purpose a)
- held briefly by the hosting provider for operational and security purposes, then deleted automatically. I keep no archive of my own.
- Enquiries without an engagement (purpose b)
- deleted no later than twelve months after the last correspondence, unless a statutory retention obligation applies.
- Enquiries that lead to an engagement (purpose b)
- added to the engagement file; the periods in the separate engagement notice then apply (section 10), including professional and tax retention obligations.
- Consent decision (purpose d)
- remains stored in your browser until you change it or clear the site data in your browser settings.
- Statistics data (purpose e)
- Google Analytics 4 cookies expire after two years; details are in the cookie policy.
Beyond these periods I retain data only where a statutory retention obligation applies, or where it is necessary in order to protect my own legal position until the statutory limitation periods have expired (Art. 2946 et seq. of the Italian Civil Code). On request I will tell you the period actually envisaged for an individual processing operation.
08Security of processing
The website is served exclusively over HTTPS; form entries are encrypted in transit. Typefaces and the consent library are held on the same server as the website and are not fetched from any third-party network – simply opening a page therefore transmits no data to third parties.
Within the practice, access is limited to me and password-protected, and devices and backups are encrypted. As a Consulente del Lavoro I am additionally bound by professional confidentiality.
09Rights of the data subject
Under Art. 15 et seq. of the Regulation you may at any time:
- Access (Art. 15)
- obtain confirmation of whether I process data about you, and a copy of that data.
- Rectification (Art. 16)
- obtain the correction of inaccurate data and the completion of incomplete data.
- Erasure (Art. 17)
- obtain erasure, unless a retention obligation or an overriding ground applies.
- Restriction (Art. 18)
- obtain restriction of processing in the cases provided for, for instance while the accuracy of data is verified.
- Portability (Art. 20)
- receive the data you provided in a structured, commonly used, and machine-readable format.
- Objection (Art. 21)
- object to processing based on a legitimate interest (purposes a and c).
- Withdrawal (Art. 7(3))
- withdraw consent – for statistics via the cookie settings, otherwise by sending me a message.
- Complaint (Art. 77)
- lodge a complaint with the supervisory authority; in Italy the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, protocollo@gpdp.it, PEC protocollo@pec.gpdp.it, phone +39 06 696771. Recourse to the courts remains available.
No automated decision-making, including profiling, within the meaning of Art. 22 of the Regulation takes place. A request in writing to the contact details at the foot of this page is enough; I reply within one month (Art. 12(3) of the Regulation).
Consent to statistics can also be withdrawn directly from the cookie policy.
10Engagements: separate notice
This policy concerns use of the website. For an engagement – payroll, employment law advice, personnel administration – you receive a separate notice under Art. 13 and 14 of the Regulation when the engagement is entered into. It describes the processing of payroll and personnel data of your employees, including special categories under Art. 9 such as health data in cases of sick leave, the statutory recipients such as INPS, INAIL, the Revenue Agency, and welfare funds, as well as the professional and tax retention periods.
That notice also settles the capacity in which I process such data: as controller as regards my own professional obligations, or as processor under Art. 28 of the Regulation on the company's behalf. That allocation belongs in the engagement contract, not on a website.
11Changes
This privacy policy applies from 25 August 2026. I reserve the right to change or update its content in whole or in part, including as a result of changes in the applicable legislation or in the services used on this website.
The version published here is always the one that applies; the date at the foot of the page states when it was last revised. It is therefore worth looking at this page from time to time.
Contact for data protection enquiries
Harald Wild · Pfarrmoos 11 · 39050 Völs am Schlernharald.wild@consulente-del-lavoro.it ·h.wild@consulentidellavoropec.it
Last updated: 25 August 2026