Privacy notice
Who processes your data
The data controller is Avv. Gianni Spina, principal of Studio Legale Spina & Partners, professional address Corso Giuseppe Mazzini 80, 86100 Campobasso (CB), Italy, VAT no. 01471420701. Email studiolegale.spina@libero.it · certified email (PEC) avvgiannispina@puntopec.it.
The firm has not appointed a data protection officer (DPO): any question about this notice can be sent to the addresses above.
What data and where it comes from
The «Request a confidential consultation» form. First name, last name, phone, email; whether you write as an individual or as a business; the area or subject; for individuals, whether you already have a lawyer; for businesses, sector, revenue band, urgency and role; the description you write; the language of the site you write from.
In the description, include only what is needed to understand the request. If you share health data or data on criminal proceedings, the firm uses them only to assess the request and the defence of your rights. If you share data about other people (for example the other party), the firm uses them only to assess the request and to check for conflicts of interest.
Email, certified email and phone. If you contact the firm directly, the data you give us.
Browsing. For security reasons the server hosting the site automatically logs IP address, browser and requested pages. Only with your consent the site uses Google Analytics statistics (visits and page views, in aggregate); it uses no advertising or profiling. Cookies are described in the cookie policy.
Why, and on what legal basis
- Purpose
- Answering your request, assessing a possible engagement and checking for conflicts of interest
- Legal basis
- Pre-contractual steps you asked for (Art. 6(1)(b) GDPR); for health data, the defence of legal claims (Art. 9(2)(f)); for criminal-law data, Art. 10 GDPR and Art. 2-octies of the Italian Privacy Code; for third-party data, legitimate interest and professional duties (Art. 6(1)(f) and 6(1)(c))
- How long
- 24 months from receipt, then automatic deletion. If the request becomes an engagement, the data moves into the case file and follows the terms of the mandate and of the law (for example 10 years for accounting records)
- Purpose
- Site security and abuse prevention (anti-spam field, technical logs)
- Legal basis
- The firm's legitimate interest (Art. 6(1)(f))
- How long
- The hosting provider's technical retention
- Purpose
- Showing the Google Maps map on the office pages
- Legal basis
- Your consent, only if you click «Show the map» or «Accept» (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code)
- How long
- Until you withdraw it from «Cookie preferences»; Google's cookies last as set by Google
- Purpose
- Visit statistics with Google Analytics 4: how many people visit the site and which pages they read, in aggregate
- Legal basis
- Your consent to the «Statistics» category (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code)
- How long
- Until you withdraw it from «Cookie preferences»; the cookies last 2 years, the data stays in Google Analytics for the period set, at most 14 months
- Purpose
- Complying with legal obligations and defending the firm's rights
- Legal basis
- Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f))
- How long
- As long as the law requires or the defence needs
| Purpose | Legal basis | How long |
|---|---|---|
| Answering your request, assessing a possible engagement and checking for conflicts of interest | Pre-contractual steps you asked for (Art. 6(1)(b) GDPR); for health data, the defence of legal claims (Art. 9(2)(f)); for criminal-law data, Art. 10 GDPR and Art. 2-octies of the Italian Privacy Code; for third-party data, legitimate interest and professional duties (Art. 6(1)(f) and 6(1)(c)) | 24 months from receipt, then automatic deletion. If the request becomes an engagement, the data moves into the case file and follows the terms of the mandate and of the law (for example 10 years for accounting records) |
| Site security and abuse prevention (anti-spam field, technical logs) | The firm's legitimate interest (Art. 6(1)(f)) | The hosting provider's technical retention |
| Showing the Google Maps map on the office pages | Your consent, only if you click «Show the map» or «Accept» (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) | Until you withdraw it from «Cookie preferences»; Google's cookies last as set by Google |
| Visit statistics with Google Analytics 4: how many people visit the site and which pages they read, in aggregate | Your consent to the «Statistics» category (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) | Until you withdraw it from «Cookie preferences»; the cookies last 2 years, the data stays in Google Analytics for the period set, at most 14 months |
| Complying with legal obligations and defending the firm's rights | Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)) | As long as the law requires or the defence needs |
Fields marked with an asterisk are needed to answer: without them the request cannot be sent. Sending a request does not create an engagement. Data is not used for marketing and there is no automated decision-making.
Who receives the data
The firm's authorised staff, bound by professional secrecy, and the providers that run the site, each only for its own task:
- Provider
- Cloudflare, Inc.
- What it does
- Hosts the site
- Where
- Global network including servers in the European Union; US company
- Provider
- Supabase Inc.
- What it does
- Database where requests are stored, read by the firm from its private panel
- Where
- Servers in the United Kingdom (London); US company
- Provider
- Sendinblue SAS (Brevo)
- What it does
- Sends the confirmation email to whoever writes and the request notice to the firm
- Where
- France (European Union)
- Provider
- Zofia Digital Agency
- What it does
- Built the site and handles its technical maintenance
- Where
- Italy
- Provider
- Google Ireland Ltd
- What it does
- Google Maps maps, only after your consent; Google decides independently on its cookies
- Where
- Ireland, with transfers to the United States
- Provider
- Google Ireland Ltd (Google Analytics)
- What it does
- Visit statistics in aggregate, only after your consent
- Where
- Ireland, with transfers to the United States
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the site | Global network including servers in the European Union; US company |
| Supabase Inc. | Database where requests are stored, read by the firm from its private panel | Servers in the United Kingdom (London); US company |
| Sendinblue SAS (Brevo) | Sends the confirmation email to whoever writes and the request notice to the firm | France (European Union) |
| Zofia Digital Agency | Built the site and handles its technical maintenance | Italy |
| Google Ireland Ltd | Google Maps maps, only after your consent; Google decides independently on its cookies | Ireland, with transfers to the United States |
| Google Ireland Ltd (Google Analytics) | Visit statistics in aggregate, only after your consent | Ireland, with transfers to the United States |
Data may also go to public authorities when the law requires it. It is never sold or published.
Transfers outside the European Union
Cloudflare, Supabase and Google are US companies and may process some data in the United States. They do so with the safeguards of the GDPR: the EU-US Data Privacy Framework for participating companies and the standard contractual clauses approved by the European Commission. The database is in the United Kingdom, a country the European Commission recognises as adequate (Art. 45 GDPR).
Your rights
You can ask at any time to access, correct or delete your data, restrict its use, receive it in a readable format and object to processing based on legitimate interest; you can withdraw the map consent without affecting anything else (Articles 15-22 GDPR). Write to studiolegale.spina@libero.it or to the certified email avvgiannispina@puntopec.it: the firm replies within one month.
Some rights may be limited where exercising them would harm defensive investigations or the defence of a right in court (Art. 2-undecies of the Italian Privacy Code).
If you believe the processing is not correct you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Minors and security
The form is not intended for children under 14: a person with parental responsibility writes on their behalf.
The site uses encrypted connections (HTTPS). Requests can be read only from the firm's private panel, with personal access; the database is protected by rules that prevent anyone else from reading them.
