Privacy policy

How we handle the data of those who visit the site and write to us.

In short: the site’s pages use no cookies and no third-party tracking tools. We collect what you write in our forms only to reply, to book a meeting or, if you ask, to send you our updates. We do not sell your data or use it to profile you. Enquiries that do not lead to an engagement are deleted automatically after 24 months.

This notice is provided under Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (the “Privacy Code”). It covers the website and its forms; clients who engage the firm receive a specific notice on the professional relationship.

Who is responsible for your data?

The data controller is the firm:

SAPG Legal, Via Salaria 89, 00198 Rome, Italy. Tel. +39 06 8551912, email info@sapglegal.com.

For any question about data protection, and to exercise your rights, write to dpo.privacy@sapglegal.com.

What data do we collect, and why?

Each processing operation has one purpose and a specific legal basis. We do not use your data for any purpose other than those set out here.

Browsing and site security

When you open a page, the server hosting the site records the technical details of the request: IP address, browser, page requested, date and time. They keep the site running and help detect faults and abuse. To limit automated form submissions we count the requests coming from each IP address and for each email address, without storing either: we keep only a one-way fingerprint, deleted after 48 hours.

Legal basis: our legitimate interest in protecting the site and keeping it working (Art. 6(1)(f) GDPR).

Visit statistics, without cookies

We count page views and form submissions to understand which content is useful and which channels bring enquiries. For each visit we record the page, the section of the site, the referring domain only (not the full address) and any campaign parameters in the link (utm). We write nothing to your device and do not store your IP address: so as not to count the same visit twice, the server derives a session code from IP address and browser, using a key that changes every day. The code cannot recognise you on later days and is deleted after 30 days; only anonymous counts remain. The statistics are collected by the site itself, without third-party analytics services, and are not shared with anyone.

Legal basis: our legitimate interest in measuring the site’s effectiveness in aggregate form (Art. 6(1)(f) GDPR). You may object at any time by writing to us.

Contact enquiries

The contact forms (the general one, the one on each lawyer’s profile and the SAPG Focus form on the Superbonus) collect your name, email, phone number if you choose to give it, and your message. The Superbonus form also asks five short questions about your position (who you are, the stage of the matter, the order of magnitude of the amount, the documents available, any deadlines). Along with the enquiry we record the page you sent it from, the referring domain and any campaign parameters. We use this data to reply, to route the enquiry to the right lawyer and to send you a confirmation email.

Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Name, email and message are required: without them we cannot reply.

Please write only what is needed to frame the matter: we will go into detail at the meeting. In particular, please do not include data concerning health or criminal proceedings. If your message contains such data anyway, we will use it only to assess the enquiry, within the limits of Art. 9(2)(f) GDPR and Art. 2-octies(3)(e) of the Privacy Code.

Booking a first meeting

After an enquiry you can book an introductory meeting. We record the date, time and lawyer, linked to your enquiry. We send you a confirmation email with a calendar invitation, and a reminder the day before. The personal link to move or cancel the appointment is not stored: we keep only a fingerprint of it, so not even someone with database access can use it.

Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).

Updates from the firm

If you sign up for updates, or tick the optional box in the contact form, we email you legal updates and insights from the firm. We process your name and email, and record the date of your consent and the version of the notice in force, so that we can demonstrate the consent you gave.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 130 of the Privacy Code). It is optional: you can still write to us without giving it. You can withdraw it at any time by writing to dpo.privacy@sapglegal.com; withdrawal does not affect the lawfulness of what was done before.

Legal obligations and protection of rights

We may keep and use data to comply with legal obligations or requests from authorities (Art. 6(1)(c) GDPR) and, where necessary, to establish, exercise or defend the firm’s legal claims (Art. 6(1)(f) GDPR).

How do we protect it?

The site is served only over an encrypted connection (HTTPS). Enquiries are stored in a database accessible only to the firm’s authorised lawyers and staff, with personal credentials. Notification emails contain the enquiry and reach only the people at the firm who need to handle it.

We take no decisions based solely on automated processing and do no profiling. Automated spam checks flag suspicious enquiries, which still reach the firm. Submissions repeated within a short time or technically anomalous are instead refused on the spot, with an error message inviting you to try again or to write to us by email.

Who may receive it?

We do not sell data or pass it to third parties for marketing. It may be received by:

  • the firm’s authorised lawyers and staff, each to the extent their task requires;
  • the providers of the technical services we need: hosting of the site and database, and email. They act as processors (Art. 28 GDPR), under a contract and only on our instructions;
  • public and judicial authorities, where the law requires it.

The current list of processors is available on request from dpo.privacy@sapglegal.com.

Does the data leave the European Union?

The site and the database are hosted on servers located in the European Union. Some technical providers may, however, belong to groups based outside the European Economic Area, for instance in the United States. In that case any transfer takes place only with the safeguards of Chapter V GDPR: the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for providers certified under it, or the standard contractual clauses adopted by the Commission (Art. 46 GDPR). You can ask us for a copy.

How long do we keep it?

  • Enquiries that do not lead to an engagement: deleted automatically 24 months after submission, together with any appointment.
  • Enquiries that lead to an engagement: they become part of the file of the professional relationship and follow the periods stated in the notice you receive with the engagement.
  • Subscription to updates: until you withdraw consent. If the sign-up is not tied to an engagement, no longer than 24 months in any case.
  • Statistics session code: 30 days; afterwards only anonymous counts remain.
  • Anti-abuse counters: 48 hours.
  • Server technical logs: the short period set by the hosting provider, unless they are needed to establish an offence.

Emails you send us, or we send you, stay in the firm’s mailboxes for as long as needed to handle the relationship. Data may be kept longer only where the law requires it or to defend a legal claim, and only for that purpose.

What are your rights?

At any time you may ask us for:

  • access to your data and a copy of it (Art. 15 GDPR);
  • rectification of inaccurate or incomplete data (Art. 16);
  • erasure (Art. 17) or restriction of processing (Art. 18);
  • portability of the data you gave us, in a commonly used format (Art. 20).

You may also object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21), and withdraw your consent to updates, without affecting what was done before (Art. 7(3)).

Write to dpo.privacy@sapglegal.com. We reply without undue delay and in any case within one month (Art. 12 GDPR). For visit statistics we keep nothing that lets us recognise you, so we may be unable to find your data there (Art. 11 GDPR).

If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work (Art. 77 GDPR), or apply to the courts.

Cookies, children and other sites

The site’s pages use no cookies; only the area reserved to the firm’s staff uses technical cookies, for signing in. The details are in the cookie policy.

The site is not directed at children under 14. If you are under 14, please ask a parent to contact us for you.

Links to other sites, such as LinkedIn or the ELF – European Law Firm network, lead to pages with their own privacy notices, for which we are not responsible.

Changes to this notice

We update this notice when the way we process data changes. The date of the latest version is shown at the bottom of the page. For each consent we record the version in force at that moment.

Last updated: