Privacy notice

Last updated: 5 November 2026. This notice covers this website and its contact forms. Any professional engagement is subject to further information and checks.

1. Controller and contact details

Massa Law Firm – Attorney Patrizia Massa, Via Castelfranco Veneto, 4 – 31100 Treviso (TV), Italy. Phone: +39 0422 410182. Email: info@studiolegaleavvocatomassa.it. Certified email (PEC): patriziamassa@pec.ordineavvocatitreviso.it.

2. Data processed and required fields

We process the information entered in the form (first name, surname, email, any phone number, practice area, topic and message), the request reference, date and notification status. Required fields are marked: without them we cannot process the form; you can also contact us by email or phone. Phone number and practice area are required in the Italian, Spanish and French forms and optional in the English form.

Operation and security also involve IP addresses, HTTP request data and technical information. The initial language uses the approximate country supplied by the host; a functional cookie remembers an express language choice for one year. We do not request the device’s precise location. The application antispam check uses an HMAC-derived IP identifier and does not store the plain IP in the request tables. Infrastructure providers may process their own technical logs. The form does not accept attachments: provide only what is necessary for initial contact, without documents or medical, criminal or other particularly confidential details. The Firm will indicate an appropriate channel for further information.

3. Purposes and legal bases

Handling requests for assistance and pre-contractual steps requested by the data subject: Art. 6(1)(b) GDPR.
Responding to other communications and protecting the service against abuse: the Firm's legitimate interests in managing communications and security, Art. 6(1)(f) GDPR, taking account of the data subject's rights.
Complying with legal obligations and addressing legal protection needs: Art. 6(1)(c), or, where applicable, Art. 6(1)(f) GDPR.
Loading the optional embedded Google map: the user's specific choice, as explained in the Cookie policy.

The form checkbox acknowledges this notice and requests a reply; it is not marketing consent. We do not use requests for newsletters, advertising or profiling. We do not make solely automated decisions producing legal or similarly significant effects.

4. Processing, recipients and providers

Data is processed electronically and may be accessed by authorised Firm personnel. Requests are recorded in Supabase and notified to the Firm's mailbox through Google Workspace; Vercel hosts the website and its server functions. Technical providers process data under their respective roles and applicable agreements. Appointed professionals or authorities may also receive data where necessary and legally applicable. Request data is not published on the website.

Your browser contacts Google Maps only after you choose to load the map; Google's privacy policy also applies to that service. Ordinary external links do not embed those services in the page.

5. Location and international transfers

The primary database and intake function are configured in Ireland (Supabase, eu-west-1); Vercel server functions are configured in Dublin (dub1). This does not mean that all provider operations take place exclusively in the EU: content delivery, logs, support, email and subprocessors may involve processing or access from other countries.

Any transfers outside the European Economic Area are governed by Chapter V GDPR and the applicable agreements, through adequacy decisions or, where needed, standard contractual clauses and supplementary measures. You may ask the Firm for information and a copy of the relevant applicable safeguards, subject to legal limits. References: Vercel DPA, Supabase DPA, Google Workspace.

6. Retention

Requests are retained for as long as needed to handle them and any follow-up, taking account of their nature, status and the need to document communications. Where a professional relationship begins, retention obligations relating to the engagement and protection of rights also apply. Technical data follows the security purposes and retention periods applicable to the services used. Backups follow their retention cycle. Automatic deletion of requests is not enabled: the Firm reviews and deletes them when no longer needed, subject to legal obligations or protection needs.

7. Rights and complaints

Subject to GDPR conditions, you may exercise rights of access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact info@studiolegaleavvocatomassa.it. You may complain to the Italian Data Protection Authority or the competent supervisory authority under Art. 77 GDPR.

8. Changes

Changes to this notice will be published on this page with an updated date.