Recording of telephone calls: privacy notice

pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”)

This is a translation. The Italian text is the only legally binding version.

This page explains which telephone calls we record, why we record them, how long we keep the recordings and what rights you have.

1. Data controller

Studio Ponchio Società tra Professionisti Dottori Commercialisti CPA S.r.l. (the “Firm”)

Registered office: Via IV Novembre 33, 44021 Codigoro (FE), Italy
VAT number and tax code: 01775330382, REA (Register of Economic and Administrative Information) no. FE-196727
Registered in the special section for professional companies (STP) of the Register of Chartered Accountants and Accounting Experts of Ferrara under no. 1/S

Our offices:

Ferrara, Via Bagaro 3, tel. +39 0532 450482
Codigoro, Via IV Novembre 33, tel. +39 0533 710240
Milan, Viale Elvezia 12

For any privacy matter, please write to [email protected] or to our certified e-mail address (PEC) [email protected].

2. Which calls we record

We record all incoming and outgoing calls on the Firm’s lines, namely the landline numbers of our offices and the apps connected to our switchboard. This applies to conversations with clients and with anyone else.

Only calls that are actually answered are recorded. Unanswered rings are not recorded.

Together with each recording, we keep the call details: calling number, called number, date, time and duration.

3. How we inform you

Incoming calls: before the conversation starts, a recorded message tells you that the call may be recorded for service quality purposes and for handling any complaints.
Outgoing calls: our staff member tells you at the start of the call.

4. Why we record calls

to ensure the quality of our service;
to handle complaints and requests;
to keep a record of communications and professional engagements;
to establish, exercise or defend legal claims, both in court (civil, criminal, administrative and tax proceedings) and out of court.

5. Legal basis

The processing is based on the Firm’s legitimate interest (Article 6(1)(f) GDPR): being able to prove what was said and agreed, improving our service and protecting our rights.

We have weighed this interest against your rights and freedoms. We consider them adequately protected because:

you are informed before the conversation starts;
access to the recordings is restricted to a small number of authorised persons;
the files are protected by appropriate security measures (section 8);
you can always choose another channel, such as e-mail or a meeting in person.

If you volunteer special categories of personal data during a call (for example, health data), the processing is based on Article 9(2)(f) GDPR, as it is necessary for the establishment, exercise or defence of legal claims.

Your consent is not required.

6. If you do not wish to be recorded

If you do not wish to be recorded, you may end the call before the conversation starts and contact us by e-mail, by certified e-mail (PEC) or in person at one of our offices.

7. How long we keep recordings

Each recording, together with its call details, is kept for 10 years from the date of the call. This is the ordinary limitation period under Article 2946 of the Italian Civil Code, which applies to professional relationships.

Where legal proceedings are pending, recordings may be kept for as long as necessary until they are concluded. They are then deleted.

8. Security and integrity

The files are stored on the Firm’s own systems: our internal switchboard and the servers and network storage at our offices. Only the controller and persons it has authorised have access to them.

To show that a recording has not been altered, we calculate a digital fingerprint (SHA-256 hash) of each recording and obtain a time stamp from trusted time-stamping services: DigiCert (United States) and FreeTSA (Germany). Only the fingerprint is sent to these services. The fingerprint does not contain the conversation and cannot be used to reconstruct it.

9. Who may receive your data

authorised staff of the Firm;
technical support providers, where necessary, appointed as data processors (Article 28 GDPR);
lawyers, technical experts, judicial authorities and supervisory authorities, where necessary for the purposes set out in section 4.

Your data is never made public. Recordings are not transferred outside the European Union. Only the digital fingerprint described in section 8 is sent to the service based in the United States.

10. Your rights

Under Articles 15 to 22 GDPR, you have the right to:

access your data, including the right to receive a copy of the recording of your call (Article 15);
rectification, where applicable (Article 16);
erasure and restriction of processing, within the limits set by law (Articles 17 and 18);
object to processing based on legitimate interest (Article 21). In that case the Firm will stop processing your data unless it demonstrates compelling legitimate grounds, or unless the data is needed to establish, exercise or defend legal claims.

To exercise your rights, write to [email protected] or to [email protected]. To help us find the recording, please tell us the phone number you used and the approximate date of the call. We will reply within the time limits set by Article 12 GDPR.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

11. Updates

This notice may be updated. The version in force is always published on this page. Data collected through the website is covered by our privacy notice.

Last updated: 18 October 2026.

Privacy Notice on the Recording of Telephone Calls