Privacy Policy

Information on the Processing of Personal Data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Introduction

This Privacy Policy describes how Mr Martin Pietro Eugenio Franco, Attorney-at-Law, in the course of his professional activities and through the website of IniLaw Law Firm, collects, uses, stores and protects the personal data of website users, clients and individuals who contact the Firm.

Personal data is processed in accordance with Regulation (EU) 2016/679 (hereinafter the "GDPR"), Italian Legislative Decree No. 196 of 30 June 2003, as subsequently amended, and any other applicable data protection legislation.

Where necessary in connection with the legal services requested, the personal data processed may also include special categories of personal data within the meaning of Article 9 GDPR and personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR.

2. Data Controller

The Data Controller responsible for the processing of personal data is:

Martin Pietro Eugenio Franco, Attorney-at-Law

IniLaw Law Firm

Registered professional address: Piazza G. Carducci, No. 3, 15121 Alessandria (AL), Italy

Email: martin.pietro.franco@gmail.com

The Data Controller determines the purposes and means of processing personal data collected in connection with his professional activities and through the Firm's website.

3. Purposes and Legal Bases of Processing

The Data Controller processes personal data for the following purposes:

• Provision of legal services: Providing legal advice, assistance and representation in judicial and extrajudicial matters, performing contractual obligations and taking steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.

• Compliance with legal obligations: Complying with statutory, tax, accounting, social security, professional and, where applicable, anti-money laundering obligations, pursuant to Article 6(1)(c) GDPR.

• Protection of legal rights: Establishing, exercising or defending legal rights in judicial and extrajudicial proceedings, on the basis of the applicable legal grounds, including, where appropriate, the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f) GDPR.

• Management of communications: Responding to enquiries received through the website, by email, telephone or other communication channels, on the basis of pre-contractual measures requested by the data subject or the legitimate interests of the Data Controller, as appropriate.

• Information and promotional communications: Sending newsletters, legal updates, legal publications and information concerning the Firm's professional activities, subject to the data subject's consent where required by applicable law, pursuant to Article 6(1)(a) GDPR.

• Website management and security: Ensuring the proper operation, maintenance and protection of the website, preventing unauthorised access and managing its technical functionalities, on the basis of the legitimate interests of the Data Controller, where applicable.

Special categories of personal data are processed only where one of the conditions set out in Article 9(2) GDPR is satisfied, including, where applicable, where processing is necessary for the establishment, exercise or defence of legal claims.

4. Principles Relating to the Processing of Personal Data

The Data Controller undertakes to process personal data in accordance with the principles established under Article 5 GDPR, ensuring that such data is:

• Processed lawfully, fairly and transparently;

• Collected for specified, explicit and legitimate purposes;

• Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;

• Accurate and, where necessary, kept up to date;

• Retained for no longer than is necessary for the purposes for which it is processed, without prejudice to applicable legal obligations;

• Processed in a manner that ensures appropriate security and confidentiality through suitable technical and organisational measures.

5. Methods of Data Processing

Personal data may be processed using paper-based records, electronic systems and telecommunications technologies, strictly in connection with the purposes described in this Privacy Policy.

The Data Controller implements appropriate measures to prevent unauthorised access, disclosure, alteration, loss, destruction or unlawful use of personal data.

Personal data is processed by the Data Controller and, where applicable, by collaborators, professionals and authorised persons, in compliance with applicable confidentiality obligations and professional secrecy requirements.

The processing activities covered by this Privacy Policy do not involve decision-making based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.

6. Categories of Personal Data Processed

In connection with the professional services provided, the Data Controller may process the following categories of personal data:

• Identification and personal details;

• Contact information, including postal addresses, telephone numbers and email addresses;

• Professional, employment-related, financial and property-related information;

• Information concerning contractual relationships, disputes and judicial proceedings;

• Special categories of personal data, where necessary for the performance of legal services;

• Personal data relating to criminal convictions and offences, within the limits permitted by applicable law;

• Technical and browsing data collected through the use of the website.

Processing is limited to information necessary for the purposes for which the data has been collected.

7. Recipients of Personal Data

For the purposes described above, personal data may be disclosed, to the extent necessary, to the following categories of recipients:

• Legal professionals, consultants and collaborators assisting in the performance of professional engagements;

• Tax, accounting and administrative advisers;

• IT, technology and hosting service providers;

• Banking institutions, insurance companies and other entities involved in the management of professional activities;

• Judicial authorities, administrative authorities and public bodies where required by law;

• Opposing parties, legal representatives and other persons involved in disputes or proceedings, where necessary for the provision of legal services.

Depending on the circumstances, recipients may act as independent data controllers, data processors within the meaning of Article 28 GDPR or authorised persons acting under the authority of the Data Controller.

Personal data will not be made publicly available or otherwise indiscriminately disclosed.

8. Transfers of Personal Data to Third Countries

Where the performance of professional engagements or the use of technological services requires the transfer of personal data to countries outside the European Economic Area (EEA), such transfers will be carried out in accordance with Articles 44 et seq. GDPR.

In particular, transfers may be based on adequacy decisions adopted by the European Commission, appropriate safeguards such as Standard Contractual Clauses, or the derogations provided for under Article 49 GDPR, where applicable.

Data subjects may request further information concerning the safeguards adopted by contacting the Data Controller.

9. Retention Period of Personal Data

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable statutory and professional obligations.

In particular:

• Data relating to professional engagements is retained for the duration necessary to manage the professional relationship and subsequently for the periods required by applicable legal obligations and the protection of the Data Controller's legal rights.

• Tax and accounting data is retained for the periods prescribed by applicable legislation.

• Data processed for information and promotional purposes is retained until consent is withdrawn, without prejudice to the possible need to retain evidence of consent for compliance with legal obligations.

• Data relating to contact enquiries is retained for the period necessary to handle the relevant requests and any subsequent obligations.

• Website browsing data is retained in accordance with the periods applicable to the specific functionalities and technical services used by the website.

When determining the appropriate retention period, the Data Controller takes into account the nature of the data, the purposes of processing, applicable legal obligations and relevant statutory limitation periods.

10. Data Security and Confidentiality

The Data Controller implements technical and organisational measures appropriate to the level of risk, in accordance with Article 32 GDPR, to ensure the security, integrity and confidentiality of personal data.

Such measures may include authentication and access control systems, protection of IT devices, secure communication tools, data storage and recovery procedures, and organisational safeguards designed to restrict access to information to authorised persons only.

In the exercise of the legal profession, the Data Controller also ensures compliance with confidentiality obligations and the duty of professional secrecy.

11. Information and Promotional Communications

The Data Controller may send communications concerning legislative developments, legal insights, publications, events and the Firm's professional activities solely in accordance with the conditions established by applicable legislation.

Where processing is based on consent, data subjects may withdraw their consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Promotional communications sent by email, where applicable, will include instructions on how to unsubscribe from future communications.

12. Provision of Personal Data

The provision of personal data necessary for the performance of professional engagements or compliance with legal obligations is a requirement for carrying out the relevant activities.

Failure to provide such data may prevent the establishment or continuation of the professional relationship.

The provision of personal data for information and promotional purposes is voluntary, and refusal to provide consent will not affect the data subject's ability to access the Firm's professional services.

13. Rights of Data Subjects

Pursuant to Articles 15 et seq. GDPR, data subjects may exercise the following rights, subject to the conditions and limitations established by applicable law:

• Right of access: To obtain confirmation as to whether personal data concerning them is being processed and to access the relevant information.

• Right to rectification: To request the correction of inaccurate personal data and the completion of incomplete personal data.

• Right to erasure: To request the deletion of personal data in the circumstances provided for under Article 17 GDPR.

• Right to restriction of processing: To obtain restriction of processing in the circumstances provided for under Article 18 GDPR.

• Right to data portability: To receive personal data provided to the Data Controller in a structured, commonly used and machine-readable format and to request its transmission to another controller, where the conditions established under Article 20 GDPR are satisfied.

• Right to object: To object to the processing of personal data in the circumstances provided for under Article 21 GDPR.

• Right to withdraw consent: To withdraw consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

• Rights relating to automated decision-making: To benefit from the safeguards provided under Article 22 GDPR, where applicable.

The exercise of these rights may be subject to restrictions established by applicable law, including those relating to the establishment, exercise or defence of legal claims and statutory data retention obligations.

14. How to Exercise Data Protection Rights

Data subjects may exercise their rights by submitting a request to the Data Controller at the following address:

Martin Pietro Eugenio Franco, Attorney-at-Law

Email: martin.pietro.franco@gmail.com

The Data Controller will respond to requests without undue delay and, in any event, within one month of receipt, in accordance with Article 12 GDPR.

Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months. In such cases, the data subject will be informed of the extension and the reasons for it within one month of receipt of the original request.

Where the Data Controller has reasonable doubts concerning the identity of the person making the request, additional information necessary to confirm that person's identity may be requested.

15. Right to Lodge a Complaint

Where data subjects consider that the processing of their personal data infringes applicable data protection legislation, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to Article 77 GDPR.

Italian Data Protection Authority

Garante per la protezione dei dati personali

Website: www.garanteprivacy.it

This is without prejudice to the right to seek an effective judicial remedy before the competent courts pursuant to Article 79 GDPR.

16. Processing of Personal Data Through the Website

When visiting the Firm's website, certain technical data necessary for the operation of web services may be collected, including IP addresses, browser information, information concerning the devices used and technical information relating to requests submitted to the website's servers.

The website may use technical cookies and, where actually implemented, statistical analytics tools or other tracking technologies.

Non-essential cookies and other tracking technologies requiring consent will be used only after obtaining the user's valid consent, in accordance with applicable legislation.

Specific information concerning the categories of cookies used, their purposes, service providers and retention periods will be made available through the website's dedicated Cookie Policy, where required.

17. Amendments to This Privacy Policy

The Data Controller reserves the right to amend or update this Privacy Policy to reflect changes in applicable legislation, guidance issued by competent supervisory authorities or changes in the methods used to process personal data.

Any amendments will be published on the Firm's website.

Last updated: 15 October 2026

Martin Pietro Eugenio Franco, Attorney-at-Law

IniLaw Law Firm