Privacy notice

The data controller is Studio Legale Bianucci – Avv. Marco Bianucci, with offices at Via Alberto da Giussano 26, 20145 Milano, VAT no. 08125620966.

• Email: info@studiolegalebianucci.it
• Phone: +39 02 8295 4969

You can use these contact details for any question about the processing of your data and to exercise the rights described below.

Browsing data

Each time you open a page, your browser transmits certain technical data to the systems that make the website available: IP address, date and time of the request, page requested, referring page, outcome of the request and user agent, that is, the string indicating the type and version of the browser and of the operating system.

These data are recorded in the server’s technical logs and are also processed by Cloudflare, the service through which the website is delivered and protected. We use them only to operate the website and to defend it against attacks and abuse.

Data sent through the contact form

If you write to us using the contact form, we process the data you enter:

• full name;
• email address;
• phone number, if you provide it;
• the area of law your request concerns, if you select it;
• the text of your message;
• confirmation that you have read this notice.

Together with your request, we record the date and time it was sent, the language of the website, the page from which you sent the form, your browser’s user agent and a non-reversible code (hash), calculated from your IP address using a secret key and different every month. Your IP address is not stored in plain text in the website’s database: the code serves only to limit the number of requests sent from the same connection.

The notification of your request that reaches the firm, by email and on Telegram, does however show your IP address, the approximate location derived from it (city, region and country, through the ip-api.com service), your browser and the page you came from: they help us recognise anomalous or fraudulent submissions.

Mandatory and optional data

Your name, email address and message are needed for us to reply to you: without these data we cannot act on your request. Phone number and area of law are optional. To send the form, you must tick the box confirming that you have read this notice.

Statistical data

Only if you have given your consent does Google Analytics 4 collect data on the use of the website, associated with a random identifier stored in a cookie, as described in the cookie policy.

We process data only for the purposes set out below, each founded on a specific legal basis.

• Responding to your request and, if you decide to proceed, carrying out the activities that precede the engagement, such as the initial meeting, the preliminary review of the matter and the written estimate. Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• Protecting the form against spam and abuse, by means of automatic technical checks and a limit on the number of submissions from the same connection. Legal basis: the firm’s legitimate interest in keeping the form secure and usable (Article 6(1)(f) GDPR). The form is also protected by Google reCAPTCHA v3, which is loaded only when you start filling it in: it analyses technical data about your device and your interaction with the page, including your IP address and browser, to estimate whether the submission comes from a person. Google’s privacy policy and terms of service apply. Submissions identified as automated are discarded without being stored.
• Operating the website and ensuring its security, by means of technical logs and the protection provided by Cloudflare. Legal basis: the firm’s legitimate interest in keeping the website available and protected against cyber attacks (Article 6(1)(f) GDPR).
• Usage statistics, only if you give your consent via the banner. Legal basis: consent, pursuant to Article 6(1)(a) GDPR and Article 122 of Legislative Decree no. 196/2003 (Italian Privacy Code); you may withdraw it at any time.

The rules for data concerning health, data relating to criminal convictions and offences and other sensitive data are set out in the section Special categories of personal data and criminal offence data.

A few lines are enough in your first message. Unless it is strictly necessary, we ask you not to include special categories of personal data, such as information about health, sex life or sexual orientation, ethnic origin or religious beliefs, or data relating to criminal convictions and offences. We go into the details during the meeting.

If you nevertheless choose to share such data with us, we process them solely to assess your request, subject to professional secrecy. The legal basis is Article 9(2)(f) GDPR, which permits processing that is necessary for the establishment, exercise or defence of legal claims; for data relating to criminal convictions and offences, the legal basis is Article 10 GDPR together with Article 2-octies(3)(e) of Legislative Decree no. 196/2003.

If your message concerns other people, for example a family member or the other party, please limit the information to what is essential to outline the matter.

Requests sent through the form are stored in the website’s database and forwarded to the firm by email and through a Telegram notification, received only by authorised people. We send a confirmation of receipt to the email address you provide. The website uses an encrypted connection (HTTPS) and, within the firm, the data are accessed only by authorised lawyers and staff, who are bound by confidentiality.

What you tell us is covered by the professional secrecy that binds lawyers under Article 6 of Law no. 247 of 31 December 2012 (Italian Legal Profession Act) and Article 28 of the Codice deontologico forense (Italian Code of Conduct for Lawyers), even if no engagement follows.

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

• Requests that do not lead to an engagement: we delete them within 12 months of receipt.
• Requests followed by an engagement: we keep the data for the entire duration of the professional relationship and, once it has ended, for the period required by law and by professional rules, generally ten years, which is the ordinary limitation period (Article 2946 of the Italian Civil Code).
• Technical data recorded with the request (IP address hash and user agent in the database; IP address and approximate location in the notification to the firm): these follow the retention period of the request to which they relate.
• Website technical logs: these are kept for a limited period, up to 6 months, for security purposes.
• Usage statistics, only with your consent: in Google Analytics, data are kept for up to 14 months.
• Choice made in the banner: remembered for 6 months.

Once these periods have expired, the data are erased or anonymised.

We do not sell the data and do not pass the data sent through the contact form on to third parties for marketing purposes. For the purposes set out above, the data may be processed by:

• the firm’s lawyers and staff authorised to process them;
• the hosting provider, which hosts the website and the database;
• the email service provider, through which requests reach the firm;
• Cloudflare, which delivers the website and protects it against attacks and abusive traffic (CDN and security service) and may therefore process IP addresses and other browsing data;
• Google, which provides the form’s reCAPTCHA anti-spam check and, only if you have given your consent, the Google Analytics 4 service;
• Telegram, the messaging service through which the firm is notified of new requests;
• ip-api.com, the service that derives from the IP address the approximate location shown in the notification.

The hosting provider, the email service provider and Cloudflare act as processors within the meaning of Article 28 GDPR: they may use the data only on behalf of the firm, in accordance with its instructions and with appropriate security measures.

Some providers, in particular Cloudflare, Google (for reCAPTCHA and, with your consent, for Google Analytics), Telegram and ip-api.com, may also process data such as IP addresses outside the European Economic Area, for example in the United States.

Any such transfers take place only with the safeguards provided for by the GDPR: the adequacy decision on the EU-U.S. Data Privacy Framework (European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), for companies that have joined it, or the standard contractual clauses approved by the European Commission (Article 46 GDPR).

By default, the website uses only technical tools. Usage statistics with Google Analytics 4 are optional: they are loaded only with your consent via the banner. You can withdraw your consent at any time using the “Cookies” link at the bottom of every page.

The list of the tools used, their duration and instructions on how to manage them are set out in the cookie policy.

You may exercise the rights provided for by Articles 15–22 GDPR at any time:

• access: to know whether we process data concerning you and to receive a copy of them (Article 15);
• rectification: to have inaccurate data corrected or incomplete data completed (Article 16);
• erasure: to obtain the erasure of data in the cases provided for by law (Article 17);
• restriction: to request that the data only be stored, without being otherwise used, in the cases provided for by law (Article 18);
• portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to ask us to transmit them to another controller, where the processing is based on consent, on a contract or on pre-contractual steps and is carried out by automated means (Article 20);
• withdrawal of consent: to withdraw your consent to statistics at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3)).

Right to object. You may object at any time, on grounds relating to your particular situation, to the processing based on the firm’s legitimate interest described in the section Purposes and legal bases (Article 21 GDPR).

To exercise your rights, write to info@studiolegalebianucci.it. We will reply without undue delay and in any event within one month; in more complex cases this period may be extended by two further months, in which case we will inform you within the first month (Article 12 GDPR). For data collected through the TikTok pixel you may also contact TikTok, as described in its privacy policy.

If you believe that the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU Member State in which you habitually reside, in which you work or in which the alleged infringement took place (Article 77 GDPR).

The website is not intended for minors under the age of 14. If the matter concerns a minor, the request must be sent by a parent or legal guardian.

We may update this notice, for example when the website’s features or the legislation change. The version in force is always the one published on this page; the date of the last update is shown at the top.

• Regulation (EU) 2016/679, General Data Protection Regulation (GDPR);
• Legislative Decree no. 196 of 30 June 2003, Personal Data Protection Code, as amended by Legislative Decree no. 101 of 10 August 2018;
• Italian Data Protection Authority, Guidelines on cookies and other tracking tools, decision no. 231 of 10 June 2021.