PRIVACY POLICY

Information pursuant to Articles 13 and 14 GDPR

1. Data Controllers

The activities carried out under the VILAR ASSIST trade name, in respect of jointly determined processing operations, are carried out by the following joint controllers pursuant to Article 26 GDPR:

Vira Holova, independently carrying out professional activities, VAT No. 03747210361, Italy (hereinafter, “Vira”);

Larysa Holovanova, independently carrying out professional activities, VAT No. 04771870401, PEC: holovanova@pec.it (hereinafter, “Larysa”).

VILAR ASSIST is a trade name and not a separate legal entity. For matters concerning the processing of personal data and for the exercise of rights under the GDPR, VILAR ASSIST designates vilarassist@gmail.com as a single contact point. This does not limit the data subject’s right to contact either joint controller. Larysa may also be contacted at the PEC address holovanova@pec.it. The essential arrangements of the joint-controller agreement are set out in section 8.

2. Categories of Data and Purposes of Processing

We process identification and contact data, correspondence, administrative documents and other information required to respond to enquiries, assess whether a case can be accepted, enter into and perform an engagement, and provide documentary and organisational assistance. Such assistance may concern, in particular, incidents, compensation claims, stay in Italy and interactions with external professionals.

Data are normally collected directly from the data subject. Depending on the circumstances of the case, they may also be received from a person authorised by the client, family members, a representative, a lawyer, an insurer, a competent authority or an external professional. Where data are not collected directly from the data subject, information is provided in the manner and within the time limits required by Article 14 GDPR, unless a statutory exemption applies.

Where a lawful basis exists, we may process strictly necessary medical documentation and other special categories of data relevant to the specific case.

3. Legal Bases

For reviewing an enquiry and entering into and performing a contract or engagement, we process data under Article 6(1)(b) GDPR where applicable; to comply with legal obligations, under Article 6(1)(c) GDPR; and to ensure system security, organise our activities and protect rights in the event of claims or disputes, under Article 6(1)(f) GDPR where that legal basis applies.

For health data and other special categories of data, a condition under Article 9(2) GDPR is additionally required. Depending on the specific circumstances, this may be the data subject’s explicit consent for a defined purpose or processing necessary for the establishment, exercise or defence of legal claims. Consent is not presumed automatically and does not replace an assessment of the appropriate legal basis.

4. Provision of Data and Recipients

Providing data is voluntary. However, data identified as necessary for the assessment, acceptance or handling of a case are required for the relevant purpose; without them, we may be unable to accept the case, enter into a contract or provide the requested assistance.

Only where necessary and on a lawful basis, data may be disclosed to lawyers, forensic medical experts, translators, consultants, insurance companies, competent administrative authorities and IT service providers. Recipients act as independent controllers, data processors or authorised persons, depending on their actual role and applicable law. We do not use or disclose health data for advertising purposes.

5. Retention and Security

Personal data are retained for no longer than is necessary for the purposes for which they were collected, taking into account the nature of the relationship with the data subject, the category of information, the need to comply with legal, tax and accounting obligations, and the periods within which rights and claims connected with the case may be asserted or defended.

In particular:

·     data collected at the time of an initial contact, information request or assessment of whether a case can be accepted, where no contract has been entered into and no engagement has been granted, are retained for the period necessary to handle the request and document its outcome and, as a rule, no longer than 24 months from the last substantive contact;

·     data relating to clients, their representatives and other persons directly connected with an accepted case are retained for the duration of the engagement and, after its completion, for the period necessary to comply with applicable obligations and protect or exercise rights. As a rule, this period is up to 10 years from the closure of the case or the last substantive activity in relation to it;

·     documents and information that must be retained under tax, accounting or other applicable legislation are retained for the period established by law;

·     where a claim, judicial, insurance, administrative or other proceeding exists or can reasonably be anticipated in relation to a case, relevant data may be retained until the final conclusion of that proceeding and the expiry of the applicable period for the protection of rights;

·     medical documentation is processed with access limited to persons for whom it is objectively necessary in relation to the specific case and is not used for purposes incompatible with the engagement.

At the end of the applicable retention period, data are deleted, anonymised or archived with restricted access where further retention is required by law or for the protection of rights. We apply organisational and technical security measures proportionate to the nature of the data processed and the risks to the rights and freedoms of data subjects.

6. International Transfers and Website

Transfers of data outside the European Economic Area are made only in compliance with Chapter V GDPR and where an applicable lawful transfer mechanism is in place. Cookies and any tracking tools on the website are subject to the information and preference settings provided in a separate cookie policy, where required. Non-technical tools that require consent must not be activated before the user has made the relevant choice.

7. Rights of Data Subjects

Within the limits established by law, you may request access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest. You may withdraw previously given consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, you may contact either joint controller. You may also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali: www.garanteprivacy.it. The assistance described does not involve decisions based solely on automated processing that produce legal effects or similarly significantly affect data subjects.

8. Essential Arrangements for Joint Controllership

Vira and Larysa jointly determine the purposes and essential means of the joint processing. The joint controller receiving the data ensures that the privacy notice is provided; both joint controllers cooperate in handling data-protection requests, ensuring security and responding to incidents. Each retains autonomy in relation to her own administrative, tax and other processing that does not fall within the jointly determined activity. Data subjects may exercise their rights against either joint controller.

9. Updates

This policy is updated if the processing operations, services used or applicable rules change. Version date: 1 November 2026.

VILAR ASSIST  •  PRIVACY POLICY