1. Data Controller

The Data Controller of personal data is Studio Legale Alleva & Associati, with registered office at Via Vincenzo Monti No. 6, Milan (hereinafter also referred to as the “Firm” or the “Data Controller”). The Firm provides legal assistance, advice and representation services and processes personal data in connection with the performance of professional engagements entrusted by clients, as well as in connection with activities related and instrumental to the practice of the legal profession. For any information concerning the processing of personal data and for the exercise of the rights recognised under the GDPR, the Data Controller may be contacted at: Studio Legale Alleva & Associati Via Vincenzo Monti No. 6, Milan, Italy E-mail: privacy@allevalaw.com

2. Categories of Personal Data Processed

In connection with its professional activities and the purposes set out in this Privacy Notice, the Firm may process, by way of example:

• identification and personal data;
• contact details;
• professional and employment-related data;
• financial, tax and asset-related data;
• data contained in documents and correspondence relating to matters entrusted to the Firm;
• data relating to contractual, commercial and professional relationships;
• special categories of personal data pursuant to Article 9 GDPR, where present and relevant to the matters handled;
• personal data relating to criminal convictions and offences, in the cases and within the limits permitted by applicable law.

The data may concern clients, assisted parties, prospective clients, counterparties, their representatives and legal counsel, suppliers, professionals, consultants, collaborators and other natural persons whose data are necessary or relevant in connection with the matters and professional engagements handled by the Firm.

3. Purposes of Processing

Personal data are processed for the following purposes.

a) Performance of the professional engagement and pre-contractual activities

Personal data may be processed in order to:

• establish and manage the professional relationship with the client;
• provide legal advice, assistance and representation in judicial and extrajudicial proceedings;
• manage relationships with clients, assisted parties, counterparties and other individuals involved in matters handled by the Firm;
• prepare, review and manage deeds, contracts, legal opinions, communications and other documentation;
• manage and archive legal matters;
• carry out communications relating to professional engagements;
• perform activities necessary or instrumental to the proper performance of the professional engagement.

b) Compliance with legal obligations

Personal data may be processed in order to comply with:

• tax, accounting and administrative obligations;
• obligations arising from legislation and regulations governing the legal profession;
• obligations concerning the retention of documents and records;
• obligations imposed by judicial, administrative, tax or supervisory authorities;
• other obligations arising under applicable European Union and national legislation.

c) Establishment, exercise or defence of rights

Personal data may be processed in order to:

• establish, exercise or defend the rights of the Data Controller, the client or other relevant persons;
• prepare for and manage judicial, extrajudicial and arbitration proceedings;
• manage disputes and potential disputes;
• prevent, detect and address fraud, abuse or unlawful conduct.

d) Security and systems management

Personal data may be processed, to the extent necessary and proportionate, in order to:

• ensure the security of IT systems and information;
• prevent unauthorised access;
• perform backup and recovery activities;
• prevent and manage security incidents and personal data breaches;
• ensure the continuity and resilience of the Firm’s activities.

4. Legal Bases for Processing

The processing of personal data is carried out on the basis of the lawful grounds provided for by Article 6 GDPR, depending on the specific purposes pursued. In particular:

• Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• Article 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
• Article 6(1)(f) GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

The legitimate interests pursued by the Data Controller may include, where applicable, the protection and exercise of its rights, the security of systems and information, the prevention of fraud and abuse, the management and defence of disputes, and the organisation and proper functioning of the Firm’s professional activities. Where processing is based on the consent of the data subject, such processing shall be carried out pursuant to Article 6(1)(a) GDPR. With regard to special categories of personal data, where applicable, processing shall be based on one or more of the conditions set out in Article 9(2) GDPR, as well as on any additional requirements provided for by applicable national law.

5. Special Categories of Personal Data

In carrying out its professional activities, the Firm may process, where necessary and relevant, special categories of personal data within the meaning of Article 9 GDPR, including data concerning health and other categories of data falling within the scope of Article 9 GDPR. Such processing shall only take place where necessary in connection with the purposes of the professional engagement and where one of the conditions provided for under Article 9(2) GDPR and applicable national legislation is satisfied. In particular, where the applicable conditions are met, processing may be necessary for the establishment, exercise or defence of legal claims or whenever such processing is provided for or permitted by applicable law.

6. Personal Data Relating to Criminal Convictions and Offences

The Firm may process personal data relating to criminal convictions and offences or related security measures only where authorised by Article 10 GDPR and applicable European Union or national legislation. Such data shall be processed only to the extent necessary and relevant to the professional activities carried out and to the purposes of the professional engagement.

7. Nature of the Provision of Personal Data

The provision of personal data that are necessary for the establishment and performance of the professional engagement, compliance with legal obligations and the pursuit of purposes strictly connected with the professional relationship is necessary. Failure to provide such data may make it impossible for the Firm to establish or continue the professional relationship, properly perform the professional engagement or comply with legal obligations. The provision of additional personal data that are not necessary for the purposes indicated above may be optional. Where such data are not provided, this shall not prejudice the professional relationship, unless such data subsequently become necessary for the proper performance of the professional engagement or for compliance with legal obligations.

8. Processing Methods and Security

Personal data are processed by means of paper-based, electronic and telecommunications systems, in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, integrity, confidentiality and storage limitation. The Firm adopts appropriate technical and organisational measures proportionate to the risks arising from the processing, aimed at ensuring an appropriate level of security and preventing, insofar as reasonably applicable, unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing of personal data. Such measures may include, by way of example:

• authentication and access-control systems;
• authorisation and permission management;
• infrastructure and network protection;
• backup and recovery systems;
• endpoint protection measures;
• system updates and maintenance;
• physical and logical security measures;
• procedures for managing security incidents and personal data breaches;
• training and instructions provided to personnel and collaborators authorised to process personal data.

9. Use of Artificial Intelligence Systems

In providing professional services, the Firm may use tools and services based on Artificial Intelligence (“AI”) technologies intended, by way of example, to support:

• legal research and analysis;
• analysis, classification and organisation of documentation;
• extraction and summarisation of information;
• searches within documents;
• translation and linguistic processing;
• preparation of draft documents and communications;
• other activities supporting the provision of professional services.

AI systems are used solely as support tools for professional activities and do not replace the professional judgement, assessment or responsibility of the Firm’s Lawyers and Collaborators. Any processing of personal data through AI systems shall be carried out in compliance with the principles of data protection by design and by default, data minimisation, proportionality, security, confidentiality and purpose limitation, where applicable. Where technically and organisationally appropriate, the Firm may adopt measures including:

• minimisation of the personal data entered into AI systems;
• anonymisation or pseudonymisation, where appropriate;
• selection of tools and providers offering appropriate guarantees regarding data protection and security;
• configuration of available privacy and security settings;
• access controls;
• verification and human review of outputs generated by AI systems.

Outputs generated by AI systems shall not, in themselves, constitute legal advice, legal assessments or professional opinions of the Firm and shall be subject to appropriate human review before being relied upon in connection with professional activities. With regard to individual AI tools and services used by the Firm, the Firm assesses, as applicable, the relevant conditions concerning the processing of personal data, retention periods, use of content, security measures, sub-processors, international data transfers and, where applicable, the appointment of the relevant provider as a Data Processor pursuant to Article 28 GDPR. The Firm does not use AI systems to make solely automated decisions producing legal effects or similarly significantly affecting data subjects. The use of AI systems shall comply with the GDPR, applicable professional confidentiality and legal professional privilege obligations, professional ethical rules and applicable European Union and national legislation concerning Artificial Intelligence.

10. Recipients of Personal Data

Personal data may be disclosed, within the limits of the purposes set out in this Privacy Notice and in compliance with applicable law, to the following categories of recipients:

• Lawyers, professionals, collaborators and personnel of the Firm authorised to process personal data;
• external consultants and appointed professionals;
• technical consultants, experts, translators and other persons involved in matters handled by the Firm;
• judicial, administrative, tax and other competent public authorities;
• banks and insurance companies, where necessary;
• providers of IT, cloud, hosting, assistance and technological support services;
• providers of software and services used in the course of professional activities;
• entities appointed as Data Processors pursuant to Article 28 GDPR;
• other entities to which disclosure is necessary for the performance of the professional engagement or required by law.

Personal data shall not be disseminated or made publicly available. The Firm selects its service providers taking into account the guarantees they provide with regard to the protection of personal data and, where required by applicable law, appoints them as Data Processors pursuant to Article 28 GDPR.

11. Transfers of Data to Third Countries

Where, in connection with the services used by the Firm, personal data are transferred to countries outside the European Economic Area (“EEA”), or are otherwise made accessible to entities located in such countries, such transfers shall be carried out in compliance with Articles 44 et seq. GDPR. Depending on the circumstances, the transfer may take place on the basis of:

• an adequacy decision adopted by the European Commission;
• appropriate safeguards pursuant to Article 46 GDPR, including, where applicable, Standard Contractual Clauses;
• another lawful transfer mechanism provided for by Articles 44 et seq. GDPR.

The safeguards and transfer mechanism applied shall be assessed and identified in relation to the specific service and the relevant international transfer.

12. Retention Period

Personal data shall be retained for no longer than is necessary for the purposes for which they are processed, taking into account the nature of the professional engagement, applicable legal and regulatory obligations, professional obligations and the need to establish, exercise or defend rights. In particular:

• data relating to the management of the professional relationship shall be retained for the duration of the engagement and thereafter for the period necessary to comply with applicable legal and professional obligations and to protect the rights of the Firm and its clients;
• documentation relating to professional matters shall be retained for the period required by applicable legislation and professional obligations and for the period reasonably necessary for judicial or extrajudicial protection;
• data necessary for tax, accounting and administrative purposes shall be retained for the periods required by applicable legislation;
• in the event of litigation or reasonably foreseeable litigation, data may be retained for the period necessary for the establishment, exercise or defence of the rights of the Data Controller or its clients.

At the end of the applicable retention period, personal data shall be deleted, anonymised or otherwise rendered no longer attributable to the data subject, unless their further retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of a right.

13. Automated Decision-Making and Profiling

The Firm does not carry out processing intended to result in decisions producing legal effects or similarly significantly affecting data subjects based solely on automated processing within the meaning of Article 22 GDPR. The Firm does not carry out profiling of data subjects for the purpose of making professional or legal decisions concerning them. Responsibility for legal assessments, defence strategies, professional opinions and decisions made in connection with professional engagements remains with the Firm’s professionals. No legal assessment, professional opinion, defence strategy or decision producing effects concerning a data subject shall be made solely on the basis of outputs generated by Artificial Intelligence systems.

14. Data Subject Rights

The data subject may exercise, where applicable under the GDPR and applicable national law, the rights recognised under Articles 15 to 22 GDPR, including the right to:

• obtain confirmation as to whether or not personal data concerning them are being processed;
• obtain access to their personal data and the information provided for under Article 15 GDPR;
• obtain the rectification of inaccurate personal data or the completion of incomplete personal data;
• obtain the erasure of personal data in the cases provided for under Article 17 GDPR;
• obtain restriction of processing in the cases provided for under Article 18 GDPR;
• object to processing in the cases provided for under Article 21 GDPR;
• obtain the portability of personal data in the cases provided for under Article 20 GDPR;
• lodge a complaint with the competent supervisory authority.

The exercise of these rights may be subject to the limitations provided for by applicable law, including where necessary to protect professional legal secrecy, legal professional privilege, the right of defence or compliance with legal obligations applicable to the Data Controller. Requests concerning the exercise of data subject rights may be submitted to the Data Controller using the contact details indicated in Section 1 of this Privacy Notice.

15. Right to Lodge a Complaint with the Supervisory Authority

Where the data subject considers that the processing of personal data concerning them infringes the GDPR or applicable data protection legislation, they have the right to lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) pursuant to Article 77 GDPR, without prejudice to any other administrative or judicial remedy available under applicable law.

16. Updates to this Privacy Notice

This Privacy Notice may be updated from time to time in connection with changes in applicable legislation, the Firm’s organisational arrangements, technological developments or changes in the manner in which the Firm processes personal data. The updated version of this Privacy Notice shall be made available to data subjects through appropriate communication channels. Last updated: 7 October 2026