Privacy notice on the processing of personal data

Company name

iltuoavvocato.com S.r.l.

Legal form

Limited liability company, Innovative Startup

Registered office

Via Puglie n. 8, 71042 Cerignola (FG), Italy

Tax code / VAT no.

04597260712

Chamber of Commerce

Chamber of Commerce, Industry, Crafts and Agriculture of Foggia

Legal representative

Massimo Ciuffreda (Director)

Company email

info@iltuoavvocato.com

Privacy email

privacy@iltuoavvocato.com

Website

https://www.iltuoavvocato.com

The data controller pursuant to art. 4, no. 7, of the GDPR is iltuoavvocato.com S.r.l. (hereinafter also «the Company» or the «Controller»), the legal entity operating the digital platform accessible at www.iltuoavvocato.com. The Company acts as a technological infrastructure supporting legal professionals and end users, without performing reserved legal professional activities.

As a legal entity, the data controller is the Company itself. The legal representative Massimo Ciuffreda acts in the name and on behalf of the Company for all matters concerning it, including those relating to personal data protection.

The Company has appointed a Data Protection Officer, whom data subjects may contact for any matter relating to the processing of their personal data and the exercise of the rights granted by the GDPR:

DPO

Avv. Renata d'Antonio

DPO email

dpo@iltuoavvocato.com

DPO certified email (PEC)

renata.dantonio@postecert.it

As part of registration and participation in the iltuoavvocato.com platform, the following personal data of Lawyer Partners is collected and processed:

3.1 Identity and contact data

• First and last name
• Email address (professional and/or personal)
• Telephone number (landline and/or mobile)
• Tax code
• Law firm address (street, postal code, city, province)

3.2 Professional data

• Bar association and registration number with the Bar Register of Lawyers
• Year of registration with the Bar Association
• Areas of specialisation and practice fields (e.g. civil, criminal, administrative, tax, labour law, etc.)
• Academic qualifications and continuing education certifications (mandatory professional updating pursuant to art. 11 of Law 247/2012, master's degrees, LLM, specialisations)
• Languages spoken and/or professionally practised
• Firm size (number of professionals, trainees and collaborators)
• Type of firm (sole practitioner, associated, Lawyers' Company S.t.A., S.r.l. between professionals)
• Any trade associations or professional networks of membership

The data referred to in this paragraph is largely provided directly by the lawyer at registration. Only data relating to Bar registration may also be verified through the public registers of the Bar Associations (see par. 4.3).

3.3 Data relating to the public profile on the platform

• Professional photograph (optional)
• Professional biography and presentation
• Indicative fees by type of service (if provided voluntarily)
• Ratings and reviews received from platform users

3.4 Technical and navigation data

• IP address and access data to the reserved portal
• Session logs and activity on the platform
• Feature usage data (messaging, calendar, case management)

3.5 Contractual and tax data

• Bank details or payment data (for crediting fees or invoicing the subscription service)
• Data for issuing invoices (name, VAT no./tax code, billing address)

Personal data is processed for the following purposes:

4.1 Registration and management of the professional profile

Legal basis: performance of a contract (art. 6, par. 1, lett. b, GDPR): the processing is necessary for registration on the platform, the creation of the lawyer's public profile and the management of the contractual relationship with the Company.

4.2 Matching with potential clients and management of assistance requests

Legal basis: performance of a contract (art. 6, par. 1, lett. b, GDPR): the processing is functional to the provision of the platform's main service, namely matching lawyer partners with users seeking legal assistance.

4.3 Verification of Bar registration and legal compliance

Legal basis: compliance with a legal obligation (art. 6, par. 1, lett. c, GDPR): the Company verifies registration with the Bar Register of Lawyers and complies with the obligations set out by applicable law (anti-money laundering pursuant to Legislative Decree 231/2007, electronic invoicing, tax obligations).

Source of the data (art. 14 GDPR): in order to verify actual Bar registration, the Company may consult the public registers maintained by the competent Bar Associations and the National Bar Council. Such freely accessible data is processed for the sole purpose of ascertaining the professional standing of the lawyer partner.

4.4 Service communications and technical support

Legal basis: performance of a contract (art. 6, par. 1, lett. b, GDPR): to send operational communications, system notifications, feature updates and technical support.

4.5 Commercial and promotional communications (marketing)

Legal basis: consent of the data subject (art. 6, par. 1, lett. a, GDPR): upon obtaining explicit consent, to send newsletters, offers, events and platform updates. Consent may be freely withdrawn at any time, without prejudice to the lawfulness of processing carried out before withdrawal.

4.6 IT security and fraud prevention

Legal basis: legitimate interest of the Controller (art. 6, par. 1, lett. f, GDPR): to ensure the security of the platform, prevent unauthorised access and fraudulent activity. The balancing between this interest and the rights of data subjects (Legitimate Interest Assessment) has been carried out by the Controller and is available upon written request.

4.7 Statistical analysis and service improvement

Legal basis: legitimate interest of the Controller (art. 6, par. 1, lett. f, GDPR): to analyse the use of the platform in aggregate and anonymised form in order to improve its functionality. The relevant balancing of interests is available upon written request.

4.8 Direct marketing to existing lawyer clients (soft opt-in)

Legal basis: legitimate interest of the Controller (art. 6, par. 1, lett. f, GDPR) in conjunction with art. 130, par. 4, of Legislative Decree 196/2003 (Privacy Code): where the lawyer partner has already established a contractual relationship with the Company, their email address may be used to send communications relating to services similar to those already used, without prejudice to the data subject's right to object to such processing at any time, including at the time of data collection and in each subsequent communication.

Data is processed using electronic and IT tools, in compliance with the principles set out in art. 5 GDPR (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality).

The Company adopts technical and organisational measures appropriate to the risk, including: encryption of data in transit (TLS/HTTPS), secure access authentication, database-level permission control (Row Level Security on Supabase/PostgreSQL), periodic encrypted backups and documented incident response procedures.

Data may be communicated or made accessible to the following categories of subjects, to the extent strictly necessary to achieve the stated purposes:

6.1 Processors pursuant to art. 28 GDPR

• Supabase Inc. — cloud infrastructure (PostgreSQL database, authentication, storage): servers located in the European Union (Frankfurt, eu-central-1); extra-EU transfers covered by Standard Contractual Clauses (SCC) pursuant to art. 46 GDPR
• Amazon Web Services, Inc. (AWS) — application hosting (FastAPI backend); any extra-EU transfer covered by SCC pursuant to art. 46 GDPR
• Stripe, Inc. — payment and invoicing management; transfer to the USA covered by SCC pursuant to art. 46 GDPR
• Openapi.com — provider of Qualified Electronic Signature (QES) pursuant to eIDAS Regulation (EU) 910/2014 and Legislative Decree 82/2005 (CAD), for signing contractual documents
• MailerLite UAB (or equivalent provider) — management of transactional and marketing email communications
• Any providers of technical support, maintenance and platform development services

6.2 Persons authorised to process data pursuant to art. 29 GDPR

The Company's staff and collaborators who process data as part of their duties, designated as authorised to process data with specific operational instructions.

6.3 Platform users

The data in the lawyer's public profile (first name, last name, bar, specialisations, professional presentation, photograph) is visible to registered users performing a search. This is information that the lawyer partner knowingly publishes in order to be found by potential clients.

6.4 Public authorities

Data may be communicated to judicial, administrative or supervisory authorities where required by law or by specific measures thereof.

Some processors (in particular Supabase Inc., AWS and Stripe) are based or use infrastructure outside the European Economic Area (EEA). Such transfers take place subject to adequate safeguards pursuant to Chapter V GDPR, specifically by means of Standard Contractual Clauses (SCC) adopted by the European Commission with Implementing Decision (EU) 2021/914.

The up-to-date list of processors and the safeguards adopted for extra-EU transfers is available upon written request addressed to privacy@iltuoavvocato.com.

Personal data is retained for the time strictly necessary to achieve the purposes for which it was collected, and in any case:

• Profile and contractual data — for the entire duration of the contractual relationship and, thereafter, for 10 years for tax and civil law purposes (art. 2220 and 2946 of the Italian Civil Code).
• Log and access data — for 12 months from registration, save for needs of ascertainment and legal defence.
• Marketing communications data (consent-based) — until consent is withdrawn or the contractual relationship ends.
• Tax and accounting data (invoices, payments) — 10 years pursuant to Presidential Decree 633/1972 and Presidential Decree 600/1973.

Once the retention periods have elapsed, data will be deleted or anonymised in a secure and irreversible manner.

As a data subject, the Lawyer Partner may exercise the following rights against the Controller at any time:

• Right of access (art. 15 GDPR) — to obtain confirmation as to whether personal data concerning them is being processed and to access its content.
• Right to rectification (art. 16 GDPR) — to obtain the correction of inaccurate data or the completion of incomplete data.
• Right to erasure / «right to be forgotten» (art. 17 GDPR) — to obtain the deletion of data, within the limits provided by law.
• Right to restriction of processing (art. 18 GDPR) — to obtain the restriction of processing in the cases provided by law.
• Right to data portability (art. 20 GDPR) — to receive one's data in a structured, commonly used and machine-readable format.
• Right to object (art. 21 GDPR) — to object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent (art. 7, par. 3, GDPR) — to withdraw consent at any time, without prejudice to the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (art. 77 GDPR) — to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), Piazza Venezia n. 11, 00187 Rome, or with the supervisory authority of the EU Member State where the data subject habitually resides.

Requests can be sent by email to privacy@iltuoavvocato.com. The Controller will respond within 30 days of receipt, with the possibility of an extension of a further 60 days in cases of particular complexity (art. 12, par. 3, GDPR).

Providing the data marked as mandatory at registration is necessary for the performance of the contract and for participation in the platform: failure to provide it prevents registration and use of the services.

Providing optional data (professional photograph, indicative fees, extended biographies) is free and failure to provide it does not affect use of the platform, although it may affect the appeal of the profile to potential clients.

Providing data for marketing purposes is entirely optional and based on the explicit consent of the data subject.

The Controller does not carry out processing based solely on automated decision-making, including profiling, that produces significant legal effects on data subjects pursuant to art. 22 GDPR.

Matching algorithms are used to suggest lawyer profiles to users based on objective criteria (geographical area, specialisation, availability, ratings). Such activity does not constitute an automated decision producing legal effects, being a search and recommendation function that does not affect the rights or professional status of the lawyer.

The use of the platform by the Lawyer Partner is subject to the Cookie Policy of iltuoavvocato.com S.r.l., available at https://www.iltuoavvocato.com/cookie-policy. In the area reserved for lawyers, technical cookies strictly necessary for the operation of the portal are used and, subject to consent, analytics cookies.

The Controller reserves the right to update this notice to adapt it to regulatory changes, new processing activities or changes to the services offered. Changes will be communicated through a notification on the platform or by email to the registered address. The updated version will always be available at https://www.iltuoavvocato.com/privacy-avvocati.

Version

1.0

Adoption date

17 June 2026

Drafting responsible

iltuoavvocato.com S.r.l., Legal & Compliance Area

Legal representative

Massimo Ciuffreda, Director

iltuoavvocato.com S.r.l. · Via Puglie n. 8, 71042 Cerignola (FG), Italy · VAT no. 04597260712 · info@iltuoavvocato.com · privacy@iltuoavvocato.com · www.iltuoavvocato.com