Privacy notice

The data controller is Studio Legale LTC, Via Giovanni Amendola 168/5, 70126 Bari, Italy.

Email: segreteria@studiolegaleltc.it Phone: 0804037045

This notice covers personal data processed through the firm’s website (browsing, cookie banner, contact form and, if enabled, appointment requests). It does not replace any specific notices relating to a professional engagement or other relationships with the firm.

Contact and landing-page forms. We process your name, email, optional phone, subject and message to handle your request. Before submission, a temporary code sent via Resend verifies access to your email address. Google Cloud Firestore stores every verified request, including those whose notification email fails, with dates, privacy-notice acknowledgement, email verification and technical email outcomes.

Appointment requests also include up to two preferred dates and times and an optional note. Submission does not confirm an appointment. Firestore data are available only to authorised staff. Google Calendar receives invitation details only when the service is enabled and the firm confirms the appointment. Do not include confidential case details.

Cloudflare Turnstile prevents abusive automated submissions, including verification-code requests.

Cookie audit. Google Cloud Firestore stores the consent identifier, version, language, categories, action, truncated user-agent and hashed IP, not the raw IP address.

Analytics and marketing. Google Analytics 4 loads after analytics consent. Any marketing tools require the corresponding consent. Notification subscription is a separate choice.

Optional public notifications. When enabled, you may choose «Enable notifications» and grant browser permission. Firebase Cloud Messaging delivers general office updates, never client, case or appointment communications. Firestore stores device token, language, subscription date and latest update, plus a pseudonymous credential for withdrawal. Campaign records contain text, operator, date and technical outcomes. Cookie-banner «Accept all» does not subscribe you to notifications, and rejecting optional cookies does not prevent managing notifications. Withdraw through the bell in the header or block browser permission. If notifications are disabled site-wide, the bell is hidden; you can still block browser permission or contact the firm to delete your registration.

Staff workspace. Firebase Authentication with Google identifies authorised staff only. The server validates the account and maintains a protected five-day session. Operational staff notifications are separate from public notifications and contain generic notices, not client data.

You may voluntarily provide your first and last name so authorised staff can recognise the subscription in the public-device list. Names are user-declared, not verified, do not associate the device with a legal case and are not required to receive notifications. We do not automatically collect names, email addresses or device models and do not include subscriber names in notification content.

Names are stored with the registration in Google Cloud Firestore and in the browser to preserve them during token renewal. Unsubscribing on the site deletes the server record and local subscription data, including names. Blocking browser permission or deleting only local data does not automatically delete the server record. Devices not updated for thirty days are excluded from delivery, not automatically deleted. Contact the firm using the details in this notice to request correction or deletion.

New push subscriptions require an email verified by a code sent through Resend after privacy-notice acknowledgement and a Cloudflare Turnstile anti-spam check. The code is single-use, expires in ten minutes, permits five attempts and is stored as a digest with email, expiry and technical outcomes. Verification confirms access to the mailbox, not personal identity or declared names. Sending is limited to one code per email per minute.

Email and verification date are stored in the Firestore device record restricted to authorised staff; email is also stored in the browser for token renewal. It is not used for automatic newsletters or email campaigns. Existing subscriptions without email remain valid. Revocation removes the device record and local data but does not automatically delete verification or sending-limit records. Code expiry does not delete those records; contact the firm to request correction or deletion.

Requests and their archive: pre-contractual steps requested by the individual or the firm's legitimate interest in handling communications, depending on the request. The form checkbox acknowledges reading the notice; it is not consent to promotional communications.

Email verification, Turnstile and staff access: legitimate interest in security and preventing abuse, subject to the assessments required by law.

Cookie preferences and audit: legal obligation and/or legitimate interest in documenting choices.

Analytics, any marketing tools and public notifications: separate, optional, withdrawable consents. Sending a form never automatically subscribes you to notifications.

Calendar receives invitation details only after enabling the service and confirmation by the firm.

Technical providers according to their roles and agreements: hosting and infrastructure; Sanity for editorial content; Google Cloud Firestore for cookie audit records; Google/Firebase for Firestore, Authentication and Cloud Messaging; Resend for verification codes and email communications; Cloudflare for Turnstile; Google Analytics 4 with analytics consent and Calendar for confirmed appointments when enabled.

Requests are not public and are available to authorised professionals and collaborators only to handle communications. Public notifications do not include request data.

Some providers (for example Resend, Cloudflare or Google) may process data outside the European Economic Area. Where applicable, transfers rely on the safeguards set out in Regulation (EU) 2016/679 (such as adequacy decisions or standard contractual clauses), as described by each provider.

Requests and outcomes are retained as necessary for handling them and applicable obligations under the firm's retention policy. A verification code is valid for ten minutes, one request and no more than five attempts; expiry does not automatically delete its technical record.

Push registrations not updated for thirty days are excluded from delivery, not automatically deleted. Unsubscribing on the site deletes the public device registration. Campaign, notification and audit records are managed under the firm's retention policy.

The preference cookie lasts approximately 180 days; the staff session lasts five days. Closing the notification invitation postpones it for thirty days. Local subscription credentials remain until withdrawal or deletion of browser data.

Under Regulation (EU) 2016/679 you may exercise, within the limits of the law, the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent where processing is based on it, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, email segreteria@studiolegaleltc.it or call 0804037045.

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) — www.garanteprivacy.it — or to bring proceedings before the competent courts.

This notice may be updated to reflect changes to the website services or to applicable law. The update date is shown at the top of the page.

Subscription to general office notifications is optional and separate from cookies and contact forms. Browser permission is requested only when you choose to subscribe. Through Google Firebase/Firestore and Firebase Cloud Messaging we process the browser token, the management credential protected by a hash on the server, language, consent date and last update. First and last names, if voluntarily provided, are used only to recognize the subscription in the list restricted to authorized staff: they are not verified, do not associate the device with a legal case and are not required to receive notifications. This data is also stored in the browser to preserve the subscription when the token is renewed. You can unsubscribe using the bell: revocation deletes the server record and local subscription data. Blocking notifications in browser settings does not automatically delete the record. Devices not updated for thirty days are excluded from delivery but not automatically deleted. Contact the office using the details in this notice to request correction or deletion. The service does not automatically collect names, email addresses or device models.

New subscriptions require an email verified using a code sent through Resend and a Cloudflare Turnstile anti-spam check. The code can be requested before checking the privacy box; privacy-notice acknowledgement remains required to activate notifications. Verification confirms access to the mailbox, not personal identity or declared names. The code is single-use, expires in ten minutes and permits five attempts; it is stored as a digest, never in plain text, with email, expiry and technical outcomes. Codes are limited to one per email per minute. Email and verification date are stored in the Firestore registration restricted to staff; email is also stored in the browser for token renewal. It is not used to automatically subscribe to newsletters or send email campaigns. Existing subscriptions without email remain valid. Revocation removes the device record and local data but does not automatically remove verification or sending-limit records; code expiry does not delete them. Contact the firm to exercise your rights.

Cookie choices are recorded in Google Cloud Firestore with identifier, version, language, categories, action, date, truncated user-agent and an IP hash; the raw IP is not retained. Sanity is used for editorial content, not this register. Authorized staff may read and delete events with an operation audit, but cannot change consent. Deleting an event does not change browser preferences: use the website cookie settings to change your choices. Automatic deletion is not enabled; contact the firm to exercise your rights.