Pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, this notice explains how the personal data of users who visit this website or contact the Practice through the details provided on it are processed.

1. Data controller

Massimiliano Mariano, Lawyer, Via Galmozzi, 19 – 24127 Bergamo (BG), Italy, VAT No. 03590350165.

Email: info@sportlegal.eu – Certified email (PEC): marianostudio@pec.it

The Controller has not appointed a Data Protection Officer (DPO), as this is not required under Article 37 GDPR.

2. Data processed

Browsing data. The IT systems that run the website collect, in the course of their normal operation, certain data whose transmission is implicit in the use of the Internet, such as IP address, browser and device type, pages visited, date and time of the request. These data are used to ensure the functioning and security of the website.

Data provided voluntarily. If users contact the Practice by email, certified email or telephone, the Controller processes the data provided (name, surname, contact details and content of the message) in order to respond to the request. Please do not send, at this stage, special categories of data (Article 9 GDPR) or data relating to criminal proceedings (Article 10 GDPR) unless strictly necessary.

Cookies. See section 9.

3. Purposes and legal bases

• Responding to requests for information, contact or quotes: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

• Ensuring the functioning, security and maintenance of the website: legitimate interest of the Controller (Article 6(1)(f) GDPR).

• Complying with legal or regulatory obligations or requests from authorities: legal obligation (Article 6(1)(c) GDPR).

• Establishing, exercising or defending legal claims: legitimate interest of the Controller (Article 6(1)(f) GDPR).

If the contact leads to a professional engagement, the client’s data will be processed in accordance with the specific privacy notice provided when the mandate is conferred, in compliance with professional secrecy.

4. Whether providing data is mandatory

Providing contact details is optional, but without them it is not possible to respond to the request. Browsing data are necessary in order to use the website.

5. Methods of processing

Data are processed electronically and, where necessary, on paper, using appropriate technical and organisational measures to prevent their loss, unlawful use or unauthorised access. No automated decision-making or profiling takes place.

6. Recipients of the data

Data may be processed on behalf of the Controller, as data processors (Article 28 GDPR), by:

• Wix.com Ltd., provider of the platform hosting the website;

• the provider of the email and certified email services used by the Practice;

• any collaborators and support professionals, who are bound by confidentiality.

Data may also be disclosed to the competent authorities where required by law. Data are not disseminated or transferred to third parties for commercial purposes.

7. Transfer of data outside the European Union

Wix.com Ltd. is based in Israel, a country recognised by the European Commission as ensuring an adequate level of protection (Decision 2011/61/EU). Any transfers to other third countries by service providers, for example to the United States, take place on the basis of adequacy decisions (EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the Commission (Article 46 GDPR).

8. Retention period

• Contact requests not followed by an engagement: for the time needed to respond and in any case no longer than 24 months.

• Browsing data: for the period set by the platform provider for technical and security purposes.

• Data needed to defend a right: until the relevant limitation periods have expired.

Data are then deleted or anonymised.

9. Cookies

The website uses technical cookies, necessary for its operation and set by the Wix platform, for which consent is not required (Article 122 of Legislative Decree 196/2003). Any non-anonymised analytics cookies or third-party cookies (for example social media sharing buttons) are set only with prior consent given through the banner, which can be changed or withdrawn at any time. Users can also manage or delete cookies in their browser settings.

10. Rights of the data subject

Data subjects may at any time exercise the rights set out in Articles 15–22 GDPR: access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest; they may also withdraw any consent given, without affecting the lawfulness of processing carried out before withdrawal.

Requests should be sent to the contact details in section 1; the Controller will respond without undue delay and in any case within one month. Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or to take legal action.

11. Changes

This notice may be updated, including as a result of changes in the law or to the website. Please check it periodically.

Last updated: 10 November 2026