Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

Grimaldi Alliance, with its registered office in Milan, Corso Europa, 12 (hereinafter, “Grimaldi Alliance” or the “Data Controller”) within the scope of its activity comes into possession of the personal data of those who have sent their application through the dedicated form on the website https://www.grimaldialliance.com/ (hereinafter, the “Website”) in order to be part of the network of correspondents and law firms that Grimaldi Alliance benefits from.

Pursuant to EU Regulation 679/2016 (hereinafter, the “Regulation”), “processing” is defined as any operation, including the mere collection and/or storage, of personal data of any natural person (hereinafter, the “Data Subject”), “data controller” is defined as the natural or legal person who determines the purposes and means of the processing and “personal data” is defined as any information relating to a natural person, identified or identifiable even indirectly by reference to any other information.

That being said, Grimaldi Alliance hereby provides this privacy policy (hereinafter, the “Privacy Policy”), in accordance with Articles 13 and 14 of the Regulation, on the occasion of the selection procedure of correspondents/law firms intending to collaborate with Grimaldi Alliance (hereinafter, the “Selection Procedure”), for the processing of personal data provided in the form on the Website for sending the application and those possibly contained in the documents attached to the application (hereinafter, the “Personal Data”) provided by each correspondent or law firm contact person.

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The data controller is Grimaldi Alliance, with registered office in Milan, Corso Europa, 12, VAT No. IT04063930962, e-mail privacy@grimaldialliance.com, in the person of its legal representative, Mr. Francesco Sciaudone.

The Data Protection Officer appointed by the Data Controller is Mr. Claudio Rizzo, Milan, Corso Europa, 12. For the purposes of requesting information and exercising your rights, you may contact the DPO freely and free of charge at the e-mail address crizzo@grimaldialliance.com.

2. PURPOSE OF PROCESSING

Grimaldi Alliance processes your Personal Data as part of the management of the Selection Procedure for the following purposes:

1. carrying out activities related to the selection of correspondents and/or law firms for the purpose of starting a professional collaboration with Grimaldi Alliance; 
2. creation of a database from which to select the names of correspondents and/or law firms for the start of a new professional collaboration, both in current and future selection procedures;
3. fulfilment of obligations provided for by laws, regulations and Italian and/or European Union legislation arising from the Selection Procedure (e.g. anti-money laundering, fraud prevention, etc.);
4. protection of the Data Controller’s rights and interests in the conduct of the Selection Procedure.
5. LEGAL BASIS FOR PROCESSING

The legal basis for the processing of your Personal Data for the purpose referred to in Article 2)(a) and (b) above is the performance of a contract to which you are a party or of pre-contractual measures taken at your request, pursuant to Article 6(1)(b) of the Regulation, as well as the legitimate interest of the Data Controller in examining the applications received, pursuant to Article 6(1)(f) of the Regulation.

For the purpose referred to in (c), the legal basis is the fulfilment of a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the Regulation. 

For the purpose referred to in point (d) the legal basis is the legitimate interest of the Data Controller, pursuant to Art. 6(1)(f) of the Regulation. The legitimate interest is the need to exercise, defend and assert the rights and interests of Grimaldi Alliance before the competent authorities. 

We will not collect or process data falling under the special categories of personal data referred to in Article 9 of the GDPR or personal data relating to criminal convictions and offences.

4. NATURE OF THE PROVISION OF PERSONAL DATA AND CONSEQUENCES OF FAILURE TO PROVIDE DATA

The provision of your Personal Data is necessary for the purpose referred to in point 2) above, as it is strictly functional to the participation in the selection process of the correspondents/legal candidates. Not providing them would prevent Grimaldi Alliance from setting up and managing the Selection Procedure, as well as from carrying out the consequent and necessary activities.

5. CATEGORIES OF PERSONS TO WHOM PERSONAL DATA MAY BE DISCLOSED

Your Personal Data may be processed by the professionals and/or employees of Grimaldi Alliance within the scope of their respective functions and by any third party suppliers, from time to time duly appointed “data processors” pursuant to art. 28 of the Regulation, in accordance with the instructions given by the Data Controller, such as IT service providers providing assistance and maintenance in relation to the IT infrastructure of Grimaldi Alliance and related electronic devices.

In addition, your Personal Data may be disclosed to third parties who may act as autonomous data controllers, including:

• insurance companies and brokers, for the management of accident and claims policies;
• external consultants, such as firms of accountants and auditors, etc., for the performance of activities inherent to the task entrusted in connection with the processing in question;
• Grimaldi Alliance offices other than the place of work in relation to which the person concerned has sent his/her application.

The updated list of third parties to which the Data Controller may communicate your Personal Data remains at your disposal at the Grimaldi Alliance offices.

6. METHODS OF TREATMENT

Grimaldi Alliance will process your Personal Data with or without the aid of electronic means, in accordance with principles of fairness, lawfulness, transparency, so as to protect your confidentiality and your rights at all times, in the manner strictly necessary to fulfil the above-mentioned purposes, in compliance with the provisions of current legislation and in accordance with the applicable security measures pursuant to art. 32 of the Regulation.

7. RETENTION TIME OF PERSONAL DATA

If the Selection Procedure for which the application was selected is successful, the personal data of the Data Subject will be retained for the entire duration of the employment or collaboration relationship and for 10 years after its termination.

If, on the other hand, the selection process for which the application was selected is unsuccessful, the Data Subject’s personal data will be retained, subject to the consent of the Data Subject, for 12 months after the selection process has ended.

8. RIGHTS OF THE DATA SUBJECT

The rights granted to the Data Subject include the following: (a) to ask the Data Controller to confirm the existence or non-existence of his or her personal data; (b) to obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the storage period; c) obtain rectification and erasure of the data; d) obtain restriction of processing; e) obtain portability of the data, i.e. receive them from a data controller in a structured, commonly used and machine-readable format and transmit them to another data controller without hindrance f) to object to the processing at any time, including in the case of processing for direct marketing purposes; g) to object to automated decision-making relating to fixed persons, including profiling h) request from the data controller access to and rectification, erasure or restriction of personal data concerning him/her, object to the processing of personal data, as well as the right to data portability; i) withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation; j) lodge a complaint with a supervisory authority.

For any complaints or reports on data processing methods, the Data Subject may contact the Data Controller. However, you can forward your complaints or reports to the supervisory authority (the Italian Data Protection Authority – www.garanteprivacy.it).

9. TRANSFER ABROAD OF PERSONAL DATA

Some of the recipients of your Personal Data may be located outside the European Economic Area, in countries that do not have an adequate level of protection of personal data as required by the Italian Privacy Legislation. In such cases, Grimaldi Alliance may transfer your Personal Data only for the purposes set out in this Privacy Policy by means of the standard contractual clauses adopted by the European Commission, with the aim of ensuring a level of protection of personal data equivalent to the one provided for by the Regulation together with any further appropriate measures that may be necessary for that purpose.

You may at any time request a copy of your Personal Data transferred and/or the place where it has been made available, by forwarding your request to the e-mail address privacy@grimaldialliance.com and/or to the DPO appointed by Grimaldi Alliance, Mr. Claudio Rizzo, at the e-mail address crizzo@grimaldialliance.com.

10. AUTOMATED PROCESSING OF PERSONAL DATA

Your Personal Data are not subject to any fully automated decision-making process, including profiling.  

Milan, June 2024

Grimaldi Alliance