This Privacy Policy explains how FeGi M&A Services s.r.l. ("Empiria", "we", "our", "us") processes the personal data of visitors to this website and clients of our advisory services, in compliance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended.
1. Data Controller
Controller
FeGi M&A Services s.r.l.
Via Bocchetto 6, 20123 Milan (MI), Italy
P.IVA 13566450964
Email: info@fegima.com
The Controller has not appointed a Data Protection Officer (DPO) as no such designation is required under Article 37 GDPR.
2. Categories of personal data
We process the following categories of personal data:
- Identification data: name, surname, role, business email, phone number, employer.
- Professional and financial data shared in the course of M&A advisory engagements (corporate documents, financial statements, ownership information, transactional details).
- Browsing data automatically collected by the website (IP address, browser type and version, pages visited, time spent, referrer URL).
- Communications exchanged via email, telephone or messaging platforms.
3. Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Provision of M&A advisory services and related contractual obligations | Art. 6.1(b) GDPR · contract performance |
| Compliance with legal, accounting and tax obligations | Art. 6.1(c) GDPR · legal obligation |
| Management of business relationships and internal record-keeping | Art. 6.1(f) GDPR · legitimate interest |
| Replies to requests submitted via the website or email | Art. 6.1(b) and (f) GDPR |
| Direct marketing communications about our services | Art. 6.1(a) GDPR · consent |
| Defence in judicial or administrative proceedings | Art. 6.1(f) GDPR · legitimate interest |
4. Recipients of personal data
Personal data may be disclosed to the following categories of recipients, who act as data processors or as autonomous data controllers:
- Members of the Empiria internal team, duly authorised and instructed.
- External professionals (legal, tax, accounting and audit advisors) bound by professional secrecy obligations.
- IT and infrastructure service providers (hosting, email, secure document exchange).
- Counterparties and their advisors when relevant to the execution of an M&A mandate, subject to confidentiality undertakings.
- Public authorities and supervisory bodies, where required by applicable law.
Personal data are never sold or otherwise made available to third parties for unrelated commercial purposes.
5. Transfers outside the European Economic Area
Empiria processes personal data primarily within the EEA. Should processing involve transfers to non-EEA countries, Empiria shall rely on the safeguards set out in Articles 44 to 49 GDPR, including European Commission adequacy decisions and Standard Contractual Clauses.
6. Retention period
- Mandate and client data: for the duration of the engagement and for ten (10) years thereafter, in line with statutory obligations.
- Marketing data: until withdrawal of consent or objection.
- Browsing data: a maximum of 24 months for analytics purposes.
- Records relevant to litigation: for the duration of any related proceedings and statute of limitations.
7. Rights of the data subject
Pursuant to Articles 15–22 GDPR, you may at any time exercise the rights of access, rectification, erasure, restriction of processing, data portability and objection to processing, as well as the right to withdraw any previously granted consent.
To exercise these rights, please contact us at info@fegima.com or via certified email at fegimaservices@pec.it.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).
8. Security
Empiria adopts technical and organisational measures appropriate to the level of risk in order to protect personal data from unauthorised access, disclosure, alteration or destruction. Access to personal data is granted on a strict need-to-know basis and all members of the team are bound by confidentiality.
9. Updates to this Policy
This Privacy Policy may be amended from time to time to reflect regulatory developments or changes in our processing activities. The most recent version is always available on this page, with the date of last update indicated above.