Privacy policy
This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended.
Data controller
The controller is Lex Migra, in the person of Andrea Perrone, its founder and director, at the contact details set out above. For any question concerning your personal data, please write to the email address given there.
What we process, and when
When you browse this site. The server hosting it automatically records technical data: IP address, browser type, date and time of the request, and the page requested. These logs are necessary to deliver the service and to detect security incidents. They are not used to identify visitors or to build profiles.
Visit measurement. We count visits to the site in aggregate with Vercel Web Analytics, without cookies and without identifying you: we only know how many people visit each page, from which country and from which site they came. The legal basis is our legitimate interest in improving the site (Article 6.1(f) GDPR). Vercel Inc., based in the United States, acts as our processor; transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.
When you contact us. If you write by email, WhatsApp or telephone, we process the data you choose to give us: your name, contact details and the content of your enquiry.
When you book a consultation. The booking button takes you to our case management system (PraxIA), hosted in the European Union. Collection happens there and is governed by the notice you are given at that point. Only your browsing language and the section you came from travel with the link, so that the enquiry can be attributed correctly.
Purposes and legal bases
Answering your enquiry and taking steps prior to a possible engagement — legal basis: Article 6(1)(b) GDPR, pre-contractual measures taken at your request.
Providing the legal services engaged — Article 6(1)(b), performance of the contract.
Complying with legal, tax and professional-conduct obligations — Article 6(1)(c).
Keeping the site secure and operational — Article 6(1)(f), legitimate interest.
Special category data
Given the nature of this practice, your communications may contain data that Article 9 GDPR treats as special category, or data concerning your immigration status and country of origin.
We process such data only where necessary for the establishment, exercise or defence of legal claims — Article 9(2)(f) GDPR — or with your explicit consent. Please do not include sensitive information in a first email unless it is essential; you can provide it later through an appropriate channel.
Recipients
Your data is never sold or disclosed for commercial purposes. The following may access it, strictly as needed:
· the network lawyers working on your matter, each admitted in their own jurisdiction, together with the sworn translators, genealogists and accountants collaborating on it;
· our hosting provider and the provider of our case management system, acting as processors;
· the administrative, consular or judicial authorities with which your matter must be filed;
· public authorities, where required by law.
Everyone who has access to your data is bound by a duty of confidentiality (professional secrecy or a confidentiality undertaking, as the case may be).
Transfers outside the European Economic Area
Our case management system and its database are hosted in the European Union. Some providers — site hosting and visit measurement (Vercel Inc.) and messaging (WhatsApp, by Meta) — may process data outside the European Economic Area. Those transfers rely on a European Commission adequacy decision, including the EU-US Data Privacy Framework, or on standard contractual clauses.
Retention
Enquiries that do not lead to an engagement are kept for as long as needed to deal with them, and in any event no longer than twenty-four months. Client files are kept for the periods required by tax legislation and professional-conduct rules, and are then deleted or anonymised. Technical server logs are kept for short periods.
Your rights
You may at any time request access to your data, its rectification or erasure, restriction of processing, portability, and object to processing based on legitimate interest. Where processing rests on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
To exercise these rights, write to the email address given above. If you believe your rights have not been respected, you may lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it) or with the supervisory authority where you live.
Automated decisions
The eligibility test offered on this site runs entirely in your browser: your answers are neither transmitted nor stored. Its result is indicative only and constitutes neither legal advice nor an automated decision within the meaning of Article 22 GDPR.
Changes
Any change to this notice will be published on this page, together with its update date.