← Back to homePrivacy

Privacy notice

Last updated: October 9, 2026

Notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

This notice describes, pursuant to Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree No. 196 of June 30, 2003 (the “Personal Data Protection Code”), as amended by Italian Legislative Decree No. 101 of August 10, 2018 and subsequent amendments and additions, how the Firm processes the personal data of individuals who visit the website or contact the Firm using the contact details provided on it.

This notice does not replace the specific information on personal data processing provided in connection with entering into and carrying out a professional engagement.

1. Data controller

The data controller is Oppido Fiorotto - tax & legal - società tra professionisti a responsabilità limitata, with its registered office at Corso Matteotti 1, 20121 Milan, Italy, VAT No. IT05571450963; email: info@oftax.it.

2. Data and purposes

Inquiries and correspondence. If you contact us by email or telephone, the contact details and information you provide will be used to assess your inquiry and prepare a response. Please provide only the information necessary for an initial discussion and do not send confidential information or special categories of personal data before a professional engagement has been established.

Browsing data. When you visit the website, its hosting server, operated by Aruba S.p.A., records data such as your IP address, the date and time of the request and the pages visited for technical and security purposes.

These data are not used for profiling.

Data required for a professional engagement are covered by separate notices.

3. Legal bases

Responding to a request made with a view to an engagement is based on pre-contractual steps taken at your request (Article 6(1)(b) GDPR). Managing professional correspondence is based on our legitimate interest in responding to inquiries (Article 6(1)(f)). Browsing data are processed on the basis of our legitimate interest in the security and proper functioning of the website (Article 6(1)(f)). Applicable legal obligations may require processing under Article 6(1)(c). Providing contact details is voluntary, but without sufficient information we may not be able to respond.

4. Recipients and data location

Data may be processed by service providers acting on behalf of the controller as processors under Article 28 GDPR. These include Aruba S.p.A. for website hosting and email services, provided through infrastructure located in Italy.

5. Retention

Inquiries are kept for 12 months after the last contact, unless an engagement follows (in which case the relevant information is placed in the engagement file and kept in accordance with applicable legal obligations) or it is necessary to establish, exercise or defend legal claims. Browsing data are retained for the time strictly necessary to operate and secure the website and address any incidents, taking into account the nature and severity of the events detected and applicable legal obligations. Applications are covered in section 7.

6. Your rights

Subject to the conditions set out in the GDPR, you may request access to your data, rectification, erasure, restriction of processing and, where applicable, portability. You may also object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. Write to info@oftax.it. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or another competent supervisory authority. This website does not carry out automated decision-making or profiling.

7. Unsolicited applications

Send applications to career@oftax.it. Contact details, information about your education and professional background, and other relevant data submitted with your CV are processed to assess your application and manage related communications, as pre-contractual steps at your request (Article 6(1)(b) GDPR); within these purposes, Italian law does not require consent for processing the data contained in your CV (Article 111-bis of Legislative Decree 196/2003). Providing this information is voluntary; without the necessary details we may not be able to assess your application. Please submit only information relevant to the professional assessment and avoid data on health, political or religious opinions, trade union membership or other special categories of data. Access is limited to authorized personnel involved in the assessment and necessary service providers. CVs are kept for 12 months from receipt. CVs are deleted at the end of this period, except where specific legal obligations or concrete requirements to establish, exercise or defend legal claims apply.