Privacy Policy


LR LEX Avvocati Associati (hereinafter “LR LEX”) operates pursuant to what provided by the current
personal data protection legislation (the “Privacy Legislation”), including the EU Regulation 2016/679
(the “GDPR”).
This policy describes the methods adopted by LR LEX in order to manage user’s personal data while
browsing on the website lrlex.it (the “Website”); by visiting the Website, the user acknowledges to have
read and understood the main information on the following:
1. Data controller;
2. Data Protection Officer;
3. Types of personal data processed through the Website;
4. Purposes of the processing;
5. Legal basis;
6. Provision of personal data;
7. Methods of processing;
8. Transfer of personal data;
9. Data subjects’ rights;
10. Data retention period.

1. DATA CONTROLLER
The data controller of personal data collected by this Website is LR LEX Avvocati Associati, with
registered office in Via San Vittore al Teatro 1/3 – (Piazza Affari), 20123 Milan (the “Controller”). The
Controller can be contacted by email at the following address: info@lrlex.it.

2. DATA PROTECTION OFFICER
The Data Protection Officer is Lawyer Gianluca Leotta, domiciled for the position in the registered office
of LR LEX (the “DPO”). The DPO can be contacted by email at the following address: gleotta@lrlex.it.

3. TYPES OF PERSONAL DATA PROCESSED THROUGH THE WEBSITE
Through the interaction with the Website services LR LEX processes the following users’ data:
(i) Data collected during the Website navigation
Navigation data that informatic systems automatically collect during the use of the Website, such as IP
address, URI (Uniform Resource Identifier), identification codes, as well as details on the requests sent
by the user terminal to the Website’s server, which enable the navigation.
The navigation data can also be used to fill in anonymous statistics which support a better understanding
of how the Website works and can improve its structure.

It is understood that navigation data could possibly be used for the investigation about illegal activities
as in the case of cyber-crimes aimed to damage the Website.
(ii) Data provided by the user.
This is data voluntarily provided by data subject such as, but not limited to: name, surname, email
address, curriculum vitae, etc. obtained through the sending of an email automatically generated through
the section “Contacts” or “Do you want to work with us”. Furthermore, the sending of messages to any
contact listed in the Website results in the acquisition of the sender’s email address and of additional
personal data contained in the message.

4. PURPOSES OF THE PROCESSING
LR LEX informs the user that personal data are processed for the following purposes:
a) enabling the user to send spontaneous applications through the specific section “Do you want
to work with us” of the Website, allowing LR LEX to begin the selection process of the candidate
and provide a feedback;
b) receiving messages from the user through the specific section of the Website “Contact us”,
and respond or give a feedback to it;
c) with prior written consent, allowing users to subscribe to the mailing list in order to receive
advertising and articles regarding LR LEX;
d) enabling the user to learn about the professional expertise, services and publications provided
by LR LEX;
e) performing the adequate maintenance and technical assistance to guarantee the proper
functioning of the Website and of the related services in order to improve quality and structure
of the Website or to develop new contents;
f) enabling LR LEX to exercise its rights in Court and in the handling/management of disputes;
g) carrying out possible statistical purposes.

5. LEGAL BASIS
Processing of users’ data sending their spontaneous application
In relation to the processing of data provided by users for the purpose of sending their application to LR
LEX, as aforementioned in point 4.a), it is a pre-contractual measure aimed at the beginning of an
internship or a collaboration with LR LEX.
Data processing in relation to the subscription to mailing-list
Concerning the data processing related to the above-mentioned purposes listed at point 4.c), LR LEX
will ask the user for his prior consent to the processing of personal data.
Other data processing carried out through the Website
The processing of personal navigation data or of data contained in the notices sent to LR LEX through
the section “Contacts” of the Website has, as legal basis, the legitimate interest of the Controller in:
(i) promoting LR LEX on the internet;
(ii) informing the user, through the Website contents, on the activities carried out by LR LEX;
(iii) interacting with the user interested in the services offered by LR LEX, through the specific
section “Contacts”;
(iv) keeping and updating the Website functionalities.

6. PROVISION OF PERSONAL DATA
Processing of users’ data sending their spontaneous application
In order to submit spontaneous applications through the form in the Website’s section “Do you want to
work with us” it is compulsory to submit the following data:
• User’s name;
• User’s email address;
• information in the field “send a message”, to be freely filled in.
Failure in providing the above data inhibits the sending of the application.
Other data required in the section’s form “Do you want to work with us” are voluntary, but failure in
providing such data could impair the assessment and selection of the candidate submitting a request.
Data Processing in relation to the subscription to mailing-list service
The user’s consent to the processing of personal data for marketing purposes is optional; in case the user
does not give his consent, he could not provide the data required to subscribe to mailing-list service and
therefore for the receipt of informative and commercial notifications by LR LEX. If the user changes his
mind about being contacted for marketing purposes in the future, he shall/should simply select the option
“unsubscribe” above the email notifications in order to unsubscribe from the mailing-list.
Other data processing performed through the Website
Users are free to provide personal data mentioned in contacts and/or notifications sent to LR LEX.
Anyway, the failure in submitting such data can result in the impossibility of receiving answers to
notifications.
In case the user does not intend to submit any personal data linked to navigation, he is kindly asked not
to visit this Website, to differently use this Website or to send requests or notifications through this
Website, or rather not to provide his consent when such option is offered in accordance with the Privacy
Legislation.

7. METHODS OF PROCESSING
The Controller, through the Website, performs the following operations related to the processing of
personal data: collection, use and processing, storage, consultation, transmission, anonymization and
erasure.
Personal data are processed with automated tools, following logical procedures that are strictly related
to the purposes, and to the period strictly necessary to achieve purposes for which data had been
collected.
Information gathered/collected is registered in an environment which ensures its integrity and physical
and logical security as well.

8. TRANSFER OF PERSONAL DATA
Personal data is processed under the authority of LR LEX only by specifically authorized subjects.
Personal data could also be processed by third parties, providers of external services (i.e. for technical
assistance, cloud services) in accordance with the Privacy Policy and instructions from the Controller.
The Controller may also transfer the user’s data to supervisory or monitoring bodies, to Judicial
Authorities, as well as to all other subjects to which the communication is required by law or for the
fulfilment of purposes mentioned in point 5, as autonomous data controllers.
Users’ data is not disseminated to the public or to undefined subjects.
The potential transfer of the user’s personal data in non-EU countries could occur only following terms
and guarantees provided by the Privacy Legislation.

9. DATA SUBJECTS’ RIGHTS
The user, as data subject, pursuant to the Privacy Legislation, is always granted the right to require access
to personal data, to ask for their rectification or their updating – if they are incomplete, inaccurate or
were collected in violation of the Privacy Legislation or of any other applicable law – or rather to receive
(or to directly communicate to another controller) his personal data in a structured format of common
use and readable from an automated device.
Furthermore, the user is entitled to object to a processing performed by the Controller due to his
legitimate interest, to the recurrence of particular situations concerning him, as well as to withdraw, at
any time, his consent (if given).
In the cases provided by the Privacy Legislation, the user is also entitled to obtain the restriction of the
processing of his personal data, as well as to request the erasure or the anonymization of such data.

10. DATA RETENTION PERIOD
Personal data is stored and processed during all the browsing session and, consequently to its suspension,
for any intervened reason, for a period not exceeding (the “Retention Period”):
• 12 months, with reference to navigation data;
• 24 months, for other personal data processed by the Controller, including curricula vitae, unless
a different a different storage period is provided by law.
At the end of the Retention Period, personal data is deleted, unless additional legitimate interests of the
Controller and/or law obligations make it necessary to store them (following their prior minimization).