Privacy Policy
How personal data is processed and how cookies are used
Controller: DOROSH & PARTNERS SRLS · C.F./P.IVA 09577791214 · REA NA-1042376
Privacy contact: info@dorosh.it · Version 1.0 · 31 July 2026
English version · informational translation
Privacy Policy and Use of Cookies and Other Tracking Technologies
This Privacy Policy is provided in accordance with Articles 12 and 13 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree of 30 June 2003 no. 196 as amended and currently in effect ("Privacy Code"). It describes the processing of personal data through the website dorosh.it, feedback forms and communication channels linked from the site.
The Policy covers site visits, initial contact, preliminary assessment of requests and scheduling of consultations. Should professional, contractual or representation relationships arise between the parties, this Policy may be supplemented by a separate notice concerning the specific case and the services ordered.
PREVAILING LANGUAGE In case of discrepancies, the Italian version has legal precedence. The English text is an informational translation for clear information of English-speaking users.
1. Data controller
The data controller is DOROSH & PARTNERS SRLS, C.F./P.IVA 09577791214, REA NA-1042376 (hereinafter "Dorosh & Partners" or "Controller").
Website: dorosh.it · e-mail for inquiries and exercise of rights: info@dorosh.it
It is recommended to indicate "Privacy" in the subject line of any email concerning personal data. If necessary, the Controller may request proportionate additional information to verify the identity of the requester.
2. Scope, sources and data categories
2.1 Visit and security data
Information systems and servers may collect the IP address, date and time of the request, URL and requested resource, HTTP response code, user agent, information about browser, operating system and device type, referrer, diagnostic data and information necessary for site security, accessibility and proper operation. After providing consent, Google Analytics 4 may also collect online identifiers, session and interaction data, approximate location, browser and device information.
2.2 Data provided through forms and communication channels
Forms collect name, telephone number, e-mail if desired, subject of the request and text of the message. The source of the form, the language chosen, and the URL of the page from which the request was sent, including any campaign or UTM parameters in the address, are also transmitted. If the user contacts us by e-mail, telephone, Telegram or WhatsApp, the data and content of messages sent through the chosen channel are also processed.
2.3 Case-related data
During the assessment or execution of an assignment, identification, family, employment, tax, migration, property, contractual and judicial data may be processed, as well as documents and data of third parties. When strictly necessary, information may include special categories of data under Art. 9 GDPR or data concerning convictions and criminal offences under Art. 10 GDPR.
DATA MINIMISATION Do not add to the initial form documents, medical data, information on criminal proceedings or other confidential information that is not necessary. After first contact, if needed, the team will suggest an appropriate channel for secure document transmission.
2.4 Locally stored settings
The site uses browser localStorage to remember the language (dorosh_lang) and theme (dorosh_theme). These settings remain on the device until the user changes or deletes them. The language chosen may be included in a request sent through the form.
2.5 Third-party data
Any person reporting data of other individuals must transmit only relevant, necessary and lawfully accessible information and, where required by law, inform such individuals. Dorosh & Partners may also receive data from opposing parties, specialists, authorities, registries and public sources if necessary to verify conflicts of interest, provide the service or protect rights.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Site operation, security, prevention of abuse and spam, diagnostics and event logs. | Art. 6(1)(f) GDPR: legitimate interest in service security and continuity. Art. 122 Privacy Code — for strictly technical means. | Usually up to 30 days; longer only in case of incident, obligation or protection of rights. |
| Preservation of chosen language and display theme. | Art. 6(1)(f) GDPR and the need to provide the requested function; technical means under Art. 122. | On the device until changed or deleted by the user. |
| Response to inquiries, preliminary assessment, offer and scheduling of consultation or estimate. | Art. 6(1)(b) GDPR: pre-contractual measures at the request of the person. Art. 6(1)(f) — for non-contractual or third-party received communications. | If relationships do not arise: up to 12 months from last contact, unless there is a specific need for protection. |
| Provision of legal, business advisory, translation, negotiation and other ordered services. | Art. 6(1)(b), 6(1)(c), 6(1)(f) GDPR: contract, legal obligations, establishment and protection of rights. | During the relationship and, as a rule, 10 years after closure; longer if required by law or dispute. |
| Processing of special categories of data, strictly necessary for the case. | Art. 9(2)(f) GDPR for the establishment, exercise or protection of rights; Art. 9(2)(a) — only when separate explicit consent is needed. | As with the relevant case materials, with limited access and enhanced minimisation. |
| Processing of data on convictions, offences or security measures, strictly necessary for the case. | Art. 10 GDPR and Art. 2-octies Privacy Code, in particular for the establishment, exercise or protection of law in court. | As with the relevant case materials, only in the necessary scope. |
| Administrative, accounting, tax obligations, payments, fraud prevention and disputes. | Art. 6(1)(b), 6(1)(c), 6(1)(f) GDPR. | Usually 10 years or another period under law; in a dispute — until completion and expiry of the statute of limitations. |
| Measurement of website usage through Google Analytics 4. | Art. 6(1)(a) GDPR and Art. 122 Privacy Code: prior, voluntary and revocable consent. | GA4 cookies: up to 2 years; user/event data: up to 14 months according to settings. |
| Publication of identified reviews or recommendations on the site or the Controller's channels. | Art. 6(1)(a) GDPR: separate revocable consent if another specific basis does not apply and is not documented. | Until revocation or agreed term; evidence of consent — for as long as needed for protection. |
| Consideration of rights requests, complaints, audits and legal protection of the Controller. | Art. 6(1)(c), 6(1)(f) GDPR. | For the duration of processing and applicable statute of limitations periods. |
NO AUTOMATIC MARKETING Submitting an inquiry does not mean automatic subscription to newsletters or marketing messages. Possible marketing would require a separate legal basis and separate notification.
4. Mandatory nature of data provision and consequences of refusal
Name, telephone and description of the request are necessary to process the inquiry; e-mail is optional. Without the mandatory data, the form cannot be submitted and processed. Consent to analytics tools is voluntary: refusal does not limit access to the site or the ability to request a consultation.
5. Method of processing and security measures
Processing is carried out by electronic and, if necessary, paper means in compliance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation, integrity and confidentiality. Proportionate technical and organisational measures are applied, including access controls, authorisations, confidentiality obligations, communication protection, backup and incident response procedures. However, no system can guarantee absolute security.
6. Recipients and authorised persons
Within the stated purposes, data may be processed or transmitted to:
- employees, collaborators and specialists authorised by the Controller and bound by confidentiality obligations;
- lawyers, consultants, accountants, translators, interpreters, notaries, experts and other specialists necessary for the case, as processors or separate controllers depending on the actual role;
- providers of hosting, email, IT services, security, backup, CRM, appointment booking or communications, designated as processors under Art. 28 GDPR, when necessary;
- payment providers, banks, administrative and accounting entities to the necessary extent;
- authorities, courts, state institutions, consulates, law enforcement agencies and other persons if transmission is provided by law or necessary for the case;
- Google Ireland Limited and its subprocessors for Google Tag Manager and Google Analytics 4 — only after consent to analytics;
- providers of Telegram and WhatsApp when the user voluntarily chooses these platforms, in accordance with their policies.
Dorosh & Partners does not sell personal data and does not make it publicly available, except with agreed publication of reviews or cases directly provided by law.
7. Transfers to third countries
Some technology or communication providers may process data outside the European Economic Area. Such transfer takes place only in accordance with Chapter V of GDPR — on the basis of an adequacy decision, the Data Privacy Framework for certified entities in the USA, standard contractual clauses of the European Commission or another lawful mechanism, with additional measures when necessary. Information or a copy of applicable safeguards may be requested through info@dorosh.it taking into account the rights of third parties and confidentiality.
When the user follows a Telegram or WhatsApp link or communicates directly through these services, the platform provider also processes data as a separate controller in accordance with its own terms and policies.
8. Cookies and other tracking technologies
8.1 Categories of technologies
The site uses technical means necessary for operation and preservation of settings. Non-technical analytical means are activated only after positive user choice. Closing the banner or refusal leaves initial settings without analytics.
| Technology / identifier | Purpose | Duration | Category / subject |
|---|---|---|---|
| dorosh_lang (localStorage) | Remembers the chosen language. | Until changed or deleted. | Technical, first party. |
| dorosh_theme (localStorage) | Remembers light/dark theme. | Until changed or deleted. | Technical, first party. |
| Cookie settings record | Stores consent, refusal or category choice. | Usually 6 months. | Technical, first party / CMP. |
| GTM-5K7MB54H | Manages tag firing; must not trigger analytics before consent. | Own cookies not required. | Google Tag Manager; Google Ireland Limited. |
| _ga | Distinguishes users and sessions in Google Analytics 4. | Up to 2 years. | Analytical, only after consent; Google Ireland Limited. |
| _ga_H0XB39T0XB | Stores GA4 session state. | Up to 2 years. | Analytical, only after consent; Google Ireland Limited. |
The actual duration may be shortened by browser or service settings. The list must be updated when technologies, providers or configuration change.
8.2 Consent management and revocation
The user may accept, reject or customise optional technologies in the banner and change the choice at any time through the "Cookie settings" command on the site. Revocation does not affect the lawfulness of prior processing. Cookies and localStorage can also be deleted or blocked in the browser; after that, some technical settings will need to be chosen again.
9. External links and third-party channels
The site contains links to Telegram, WhatsApp and other external services. Until such a link is clicked, it does not give Dorosh & Partners permission to transmit the content of an inquiry to the platform; after opening the service, processing is also governed by the policy of the respective provider. The Controller does not control external sites and services.
10. Automated processes and profiling
As of the date of this Policy, no decisions are made based solely on automated processing that have legal or similar significant consequences for the person within the meaning of Art. 22 GDPR. Analytical statistics are not used to decide whether to accept or the outcome of a case. Any future implementation of automated assistants, inquiry qualification systems or new profiling will require prior Policy update and appropriate measures.
11. Minors
The site is not intended to directly provide information society services to persons under 14 years of age. Inquiries concerning minors should generally be submitted by the person exercising parental responsibility or another legal representative. Data of minors is processed only if necessary and with appropriate safeguards.
12. Rights of the data subject
In the cases and to the extent provided by Articles 15 to 22 GDPR, a person may request access, rectification, erasure, restriction, data portability, object to processing and withdraw consent. They may also obtain information about recipients and safeguards for international transfer. Exercise of rights may be limited where necessary for professional secrecy, rights of third parties or establishment, exercise or protection of rights.
The request is sent to info@dorosh.it. The Controller responds without undue delay and, as a rule, within one month; the deadline may be reasonably extended in cases provided for by GDPR.
13. Complaint and court protection
A person may lodge a complaint with the Garante per la protezione dei dati personali in accordance with Art. 77 GDPR and Articles 140-bis et seq. of the Privacy Code, and may apply to the competent court. Information and forms are available at garanteprivacy.it.
14. Updates
The Controller may update this Policy due to changes in legislation, organisation or technology. The current version is published on the site with the update date. If changes significantly affect processing or require new consent, users will be informed in an appropriate manner.
Last updated: 31 July 2026 · Version 1.0