Personal data processing notice.

1. Data controller

MMA Srl, registered office at Via Andrea Solari 18, 20144 Milan, Italy, VAT no. IT14808540968. For any matter concerning personal data, write to privacy@mauriziomilanadvisory.com.

2. Data processed

The contact form collects the data voluntarily entered by the data subject: full name, email address, and optionally organisation, phone number, area of interest, and the message content.

The “The leadership question” intake collects, in addition to the same contact details, the free text the data subject writes to describe their organisation's context, its ambition, and the decision at stake, together with the options selected and any correction of the reading received. This text may contain information about the organisation and references to third parties. For that reason you are asked to describe roles and functions rather than naming the individuals involved: the controller has no need to process identifying data of third parties in order to answer the enquiry, and does not use it for any further purpose.

For security purposes and in order to demonstrate the consent given, the date and time of submission and the originating IP address are also recorded.

3. Purposes and legal basis

• Replying to the enquiry and managing the resulting correspondence. Legal basis: the data subject's consent (Art. 6(1)(a) GDPR), given via the form checkbox, and the performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Generating the reading shown at the end of the “The leadership question” intake. Legal basis: as above; the processing takes place at the data subject's request and forms part of the service requested.
• Site security and abuse prevention. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR).

The data collected is never used for marketing purposes, newsletters, or commercial communications.

4. Nature of the provision

Providing the data marked as required, and giving consent, is necessary in order to act on the enquiry: without them no reply can be sent. Providing the remaining data is optional.

5. Recipients

Data is processed by the controller and by persons authorised to process it. It may also be processed, as processors under Art. 28 GDPR, by the following providers:

• Label Srl — development and technical operation of the website and of the “The leadership question” intake, including maintenance and support. Label Srl in turn relies on the sub-processors listed below.
• SiteGround Spain S.L. — website hosting and email services.
• Anthropic Ireland, Limited, as sub-processor — processing of the text entered in the “The leadership question” intake, for the sole purpose of generating the reading shown to the data subject. The provider does not use that content to train its models.

Data is neither disclosed publicly nor transferred to third parties for their own purposes.

6. Transfers outside the EU

Data collected through the contact form is not transferred outside the European Economic Area.

The text entered in “The leadership question” is processed by Anthropic Ireland, Limited, a company incorporated in Ireland: this disclosure takes place within the European Economic Area and does not constitute a transfer to a third country.

Anthropic Ireland in turn relies on its parent company Anthropic PBC, based in the United States. That onward transfer takes place on the basis of the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, Module Three (processor to sub-processor), under Art. 46(2)(c) GDPR. Those clauses are incorporated into Anthropic's Data Processing Addendum, version of 24 February 2025, which is referenced by and binding under the commercial terms of the service.

Anyone who would rather not have their data processed this way can use the ordinary contact form, which involves no transfer outside the EU.

7. Retention period

Data is retained for as long as necessary to handle the enquiry and, thereafter, for 24 months from the close of correspondence, unless otherwise required by law or needed to establish or defend legal claims. Evidence of consent is retained for as long as needed to demonstrate it.

8. Rights of the data subject

The data subject may at any time exercise the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction of processing, portability, and objection. Consent may also be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. Requests should be sent to the contact details in section 1.

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome - garanteprivacy.it).

9. Artificial intelligence systems and automated decision-making

The reading shown at the end of the “The leadership question” intake is generated by an artificial intelligence system from what the data subject has written. It is a summary and reframing: it is not an assessment of the data subject, nor professional advice, nor a decision concerning them.

No automated decision-making producing legal or similarly significant effects under Article 22 GDPR is therefore carried out, and no profiling takes place.

10. Updates

This notice may be updated. The version in force is always the one published on this page. Last updated: 14/08/2026.