Privacy Policy.

Last updated: August 2026

Notice

This privacy notice (the “Notice”), issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation” or “GDPR”) and Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (the “Privacy Code”), describes the processing of personal data carried out by Leexè as data controller.

Data controller.

The data controller (within the meaning of Article 4(7) of the Regulation) is:

Leexè | Legal Expertise Associazione Professionale

C.F. e P. IVA: IT03953810961

Email: leexe@leexe.it

Dedicated data protection email: privacy@leexe.it

PEC: leexe@pec.it

(hereinafter, “Leexè” or the “Firm”).

What personal data we process and the legal basis for processing.

In carrying out its professional activities, Leexè may process various categories of personal data relating to the data subjects described in this section.

I. Data relating to candidates for positions with Leexè

Data processed. Leexè may process the following personal data relating to individuals applying for positions with the Firm, whether as a professional, an employee or a collaborator (“Candidates”), whether they contact Leexè through the dedicated form on www.leexe.it (the “Site”) or through other channels:

Personal details (e.g. first name, surname, date of birth, address);
Contact details (e.g. phone number, email address, postal address);
Photograph/portrait;
Data relating to qualifications, education and professional career;
Any other information provided by Candidates at the time of application or during the selection process, including data on income or assets and, where applicable, special categories of data.

Purpose. To assess candidates' suitability for the Firm's professional needs, to carry out the selection process and to finalise any resulting professional or employment relationship.

Legal basis. Performance of pre-contractual measures taken at the data subject's request (Article 6(1)(b) GDPR). Where a Candidate voluntarily provides special categories of data under Article 9 GDPR, the legal basis is the data subject's explicit consent (Article 9(2)(a) GDPR).

Retention period. Generally no longer than 12 months from the close of the selection process, unless a professional or employment relationship is established or the Candidate gives specific consent to a longer period. This period may be extended where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim, whether in court or otherwise.

II. Data relating to clients or prospective clients

Data processed. In carrying out its professional activities, Leexè processes the following categories of data relating to individual clients and prospective clients, as well as to employees, collaborators, representatives or contact persons of corporate clients or prospective clients (respectively, “Clients” and “Client Contacts”):

Personal and contact details;
Data relating to income and/or assets;
Data relating to court proceedings, criminal convictions and offences, where necessary for the proper performance of the engagement or to comply with legal obligations;
Special categories of data under Article 9 GDPR (e.g. health data, or data revealing sexual orientation, religious or philosophical beliefs, trade union membership), where relevant to the matter forming the subject of the engagement;
Any other data provided by the Client that is necessary for the proper performance of the engagement or to comply with a legal obligation.

Purpose. Proper performance of the professional engagement conferred on Leexè (legal advice and assistance, representation and defence in proceedings, management of correspondence and billing) and compliance with the legal obligations to which Leexè is subject, including customer due diligence obligations under anti-money laundering and counter-terrorist financing legislation (Legislative Decree No. 231/2007, as amended).

Legal basis.

Performance of the professional mandate and related pre-contractual measures (Article 6(1)(b) GDPR);
Compliance with legal obligations, including anti-money laundering obligations (Article 6(1)(c) GDPR);
For Client Contacts: Leexè's legitimate interest in performing the relationship with the Client to which they belong (Article 6(1)(f) GDPR);
For data relating to criminal convictions and offences: the need to comply with legal obligations to which Leexè is subject, subject to the safeguards under Article 2-octies of the Privacy Code, or the need to establish, exercise or defend a legal claim (Article 9(2)(f) GDPR and Article 2-octies(3)(e) of the Privacy Code);
For other special categories of data: the need to establish, exercise or defend a legal claim (Article 9(2)(f) GDPR), the data subject's consent (Article 9(2)(a) GDPR), or data manifestly made public by the data subject (Article 9(2)(e) GDPR).

In all cases, professional legal privilege continues to apply, to which Leexè's lawyers and staff are bound under Article 28 of the Italian Code of Legal Ethics and Article 622 of the Italian Criminal Code, to protect the confidentiality of information acquired in the course of the engagement, in addition to and complementing the safeguards under the GDPR.

Source of the data. Directly from Clients or through Client Contacts, including on the occasion of events, seminars or conferences.

Retention period. For the period strictly necessary to achieve the purposes for which the data were collected and, in any event, for a maximum of 10 years from the termination of the professional relationship, consistent with the retention periods applicable to accounting and tax records (Article 2220 of the Italian Civil Code and Article 22 of Presidential Decree No. 600/1973) and with the document retention obligations under anti-money laundering legislation. This period may be extended where necessary to comply with a legal obligation or to defend a legal claim, whether in court or otherwise.

III. Data relating to suppliers

Data processed. Personal and contact details of individual suppliers and of employees, collaborators, representatives or contact persons of corporate suppliers (respectively, “Suppliers” and “Supplier Contacts”), as well as any other data necessary for the proper performance of the relevant contract.

Purpose. Management of the contractual relationship with Suppliers.

Legal basis. Performance of the contract and related pre-contractual measures (Article 6(1)(b) GDPR); for Supplier Contacts, Leexè's legitimate interest in performing the relationship with the Supplier to which they belong (Article 6(1)(f) GDPR).

Retention period. Up to a maximum of 10 years from the termination of the contractual relationship, unless a longer period is required to comply with a legal obligation or to defend a legal claim, whether in court or otherwise.

IV. Data collected while browsing the Site

When you visit the Site we collect, among other things, technical information (IP address, device type, browser, operating system) and browsing information (pages visited, time and duration of the visit, browsing path), which is necessary for the proper functioning, management and improvement of the Site, to ensure its security and to obtain usage statistics, including in aggregate form.

This data is collected mainly through cookies and similar tracking tools. Technical cookies, which are essential for browsing, are installed without the need for prior consent; analytics cookies (if not anonymised and/or provided by third parties) and profiling cookies are installed only with the user's express consent given through the relevant banner, in accordance with the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority on 10 June 2021 (No. 231). For the detailed list of cookies used, their duration and how to manage consent, please refer to the Site's Cookie Policy.

Browsing data is retained only for as long as is strictly necessary for the purposes for which it was collected.

V. Processing for direct marketing purposes

Data processed. Personal and contact details, social media profile addresses (e.g. LinkedIn), data relating to qualifications and professional career.

Purpose. Sending promotional communications relating to Leexè's services and professional activities (e.g. newsletters, legal updates, event invitations), by email or through social media channels.

Legal basis. The data subject's consent (Article 6(1)(a) GDPR), where they are not a Client of the Firm. In respect of Clients or Client Contacts, as well as contacts acquired at events, seminars or conferences attended by Leexè's professionals, the legal basis is Leexè's legitimate interest in promoting its activities (Article 6(1)(f) GDPR), without prejudice to the data subject's right to object at any time, free of charge and through simplified means (e.g. an unsubscribe link included in every communication).

Retention period. A maximum of 60 months from the acquisition of the data or, if later, from the last interaction, unless a longer period is required to comply with a legal obligation or to defend a legal claim, whether in court or otherwise.

Who we share personal data with.

Personal data of data subjects may be disclosed to:

Judicial, administrative or supervisory authorities (including the relevant Bar Council and the National Bar Pension and Welfare Fund), where necessary to comply with a legal obligation or to establish, exercise or defend a right of Leexè or of a Client;
Third parties involved in the management of the engagement, such as correspondent lawyers and process agents, technical consultants, notaries, counterparties and their lawyers, to the extent necessary for the performance of the mandate;
Processors appointed under Article 28 GDPR, such as IT and hosting service providers, providers of management software, accounting and tax advisory firms, and professional liability insurers.

The list of external processors is updated periodically and is available on request by contacting the details set out in Section 8 below.

Personal data is not disclosed to the public, except where necessary for the performance of the professional mandate (e.g. filing of court documents) or required by law.

Transfer of data outside the European Economic Area.

Some of the service providers used by Leexè (for example, cloud, email or analytics providers) may process personal data outside the European Economic Area (EEA). In such cases, Leexè ensures that the transfer takes place in accordance with Articles 44 et seq. of the GDPR, on the basis of, alternatively, an adequacy decision of the European Commission, the adoption of standard contractual clauses approved by the European Commission, or other appropriate safeguards provided for by applicable law. Data subjects may request further information about the safeguards adopted by contacting Leexè at the details set out in Section 8.

How we protect personal data.

Personal data is collected, processed, transmitted and stored using technical and organisational security measures appropriate to the risk (including access controls, encryption, backups, and training of staff and collaborators on confidentiality obligations), in order to prevent breaches such as unauthorised, accidental or unlawful destruction, loss, alteration, disclosure of, or access to, the data processed. In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, Leexè will, where necessary, notify the Italian Data Protection Authority and, where the risk is high, inform the affected data subjects, pursuant to Articles 33 and 34 GDPR.

No automated decision-making.

Leexè does not carry out processing based solely on automated decision-making, including profiling, which produces legal effects on data subjects or similarly significantly affects them, within the meaning of Article 22 GDPR.

Data Protection Officer.

Given the nature, scope and purposes of the processing it carries out, Leexè is not currently required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. Any request relating to the processing of personal data may nevertheless be addressed to Leexè using the contact details set out in Section 8.

Leexè reserves the right to appoint a DPO should the development of its activities make this necessary or advisable, and will promptly communicate any such appointment by updating this Notice.

Data subjects' rights and how to exercise them.

In accordance with the GDPR, data subjects have the right to:

Access (Art. 15): obtain confirmation of whether processing concerning them is taking place and a copy of the relevant personal data;
Rectification (Art. 16): obtain the correction of inaccurate data or the completion of incomplete data;
Erasure (Art. 17): obtain the erasure of their data in the cases provided for by law (e.g. where the purpose of processing no longer applies, consent is withdrawn, an objection is upheld, or processing is unlawful), without prejudice to Leexè's retention obligations;
Restriction (Art. 18): obtain the restriction of processing in the cases provided for by law;
Objection (Art. 21): object at any time to processing based on legitimate interest, on grounds relating to their particular situation; objection to processing for direct marketing purposes is instead an absolute right, always exercisable without the need for any justification;
Withdrawal of consent (Art. 7): where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal;
Data portability (Art. 20): where processing is based on consent or a contract and is carried out by automated means, receive their data in a structured, machine-readable format and, where technically feasible, request its direct transmission to another controller.

To exercise these rights, data subjects may contact Leexè:

by email: [privacy@leexe.it](mailto:privacy@leexe.it);
by certified email (PEC): [leexe@pec.it](mailto:leexe@pec.it).

Leexè undertakes to respond to requests without undue delay and, in any event, within one month of receipt, save for the possibility of an extension in the cases provided for by Article 12(3) GDPR.

Lodging a complaint with the supervisory authority.

Data subjects who believe that the processing of their personal data infringes applicable law have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), based at Piazza Venezia n. 11, 00187 Rome, in accordance with the procedures set out on the website [www.garanteprivacy.it](https://www.garanteprivacy.it) (email: protocollo@gpdp.it; certified email: protocollo@pec.gpdp.it; switchboard: +39 06.696771), or with the supervisory authority of the EU member state where they habitually reside, work, or where the alleged infringement occurred. It is also always possible to bring proceedings before the competent courts.

Changes to this Notice.

Leexè reserves the right to update this Notice at any time, for example to reflect regulatory changes or changes in the way data is processed. The date of the last update is indicated at the beginning of this document. In the event of changes that materially affect the processing of data already collected, data subjects will be informed through appropriate channels to ensure they are effectively aware of such changes.

This is a courtesy translation. In the event of any discrepancy, the Italian version prevails.