Cross-border legal support
Information notice
Last updated: 4 November 2026
This notice explains how personal data are processed when you visit crossborderlawyers.it or contact the firm through it. It is provided under Article 13 of Regulation (EU) 2016/679 (the GDPR) and the Italian Personal Data Protection Code, Legislative Decree No 196 of 30 June 2003, as amended by Legislative Decree No 101 of 10 August 2018 (the Code). The use of cookies is described in the cookie policy.
Avv. Roberta Scarpellini, Studio Legale Scarpellini
Via Vincenzo Monti 8, 20123 Milan, Italy
Email: counsel@crossborderlawyers.it · Telephone: +39 02 4003 1477
Browsing data. As with any website, the systems that run the site record certain technical data: IP address, date and time of the request, page visited, type of browser and device. They are needed to run the site and protect it from misuse.
Data you send to the firm. If you use the form on the site, write an email or telephone, you provide your contact details (name, law firm, email, telephone) and whatever you choose to tell us about the case.
Health data and data relating to offences. A case description may include information about the health of your client or of their family, or about criminal proceedings. The GDPR gives these data stricter protection (Articles 9 and 10). Please keep the first message to what is needed to understand the situation, and do not attach documents: details and documents are exchanged once we have spoken.
Replying to your enquiry and assessing the case. Processing is necessary to take steps at the request of the data subject before a possible engagement (Article 6(1)(b) GDPR) and, as regards information about the referring firm and its client, for the legitimate interest in responding to professional enquiries (Article 6(1)(f) GDPR). Health data are processed because they are necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Data relating to offences are processed within the limits of Article 10 GDPR and Article 2-octies(3)(e) of the Code, which allows processing for the same purposes of defence.
Performing the engagement. If the enquiry leads to a professional engagement, further processing is described in the notice provided when the engagement is agreed.
Complying with legal obligations, for example tax and accounting obligations (Article 6(1)(c) GDPR).
Running the site and keeping it secure, on the basis of the firm’s legitimate interest (Article 6(1)(f) GDPR).
Measuring visits to the site in statistical form, only with the consent given through the cookie banner (Article 6(1)(a) GDPR). Consent can be withdrawn at any time from the cookie policy page.
Providing your data is a choice. Without contact details, however, the firm cannot reply to your enquiry.
Information received, including before any engagement, is treated in accordance with the professional secrecy and confidentiality that Article 6 of Law No 247 of 31 December 2012 and Article 28 of the Italian Code of Conduct for Lawyers (Codice deontologico forense) impose on lawyers, their associates and their staff.
The data are known to the lawyer in charge and to the firm’s associates authorised to process them (Article 29 GDPR and Article 2-quaterdecies of the Code). Providers of the technical services the firm needs, such as website hosting, email and IT maintenance, may process them on the firm’s behalf as processors under Article 28 GDPR.
Only after an engagement, and to the extent needed to perform it, may the data be disclosed to the consultants involved in the case (forensic doctors, specialists, accident reconstruction experts, other lawyers), to judicial authorities and to opposing parties, including insurance companies.
The data are not published or sold to third parties for marketing purposes. An up-to-date list of processors is available from the controller on request.
Google Analytics, active only with consent, may involve the transfer of data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Article 45 GDPR). When a referring firm is established outside the European Economic Area, correspondence with that firm about the case takes place on the basis of Article 49(1)(e) GDPR, where necessary for the establishment, exercise or defence of legal claims. Other transfers take place only with the safeguards provided by Articles 44 to 49 GDPR.
When a law firm refers a case, it may send us personal data about its client and the client’s family. The referring firm remains responsible for having informed its client that the data are shared with an Italian lawyer for the purpose of assessing the case. Where the firm receives data that were not provided by the data subject, information under Article 14 GDPR is given at the first useful opportunity, unless the data must remain confidential under an obligation of professional secrecy (Article 14(5)(d) GDPR).
Enquiries that do not lead to an engagement are kept for 12 months from the last contact and then deleted. If an enquiry leads to an engagement, the data are kept for the duration of the engagement and, after it ends, for ten years, the ordinary limitation period under Italian law (Article 2946 of the Civil Code), to protect the rights of the firm and of the client.
Browsing data are kept for the time strictly necessary to run and secure the site. The record of your cookie choices is kept for 365 days.
At any time you may ask the controller for access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing (Articles 15 to 22 GDPR), by writing to counsel@crossborderlawyers.it. Consent given for cookies may be withdrawn at any time, without affecting processing already carried out (Article 7(3) GDPR).
These rights may be restricted where exercising them could actually and concretely prejudice the exercise of a right in legal proceedings (Article 2-undecies(1)(e) of the Code).
If you believe that the processing infringes the law, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Article 77 GDPR), www.garanteprivacy.it, or with the supervisory authority of the Member State where you live or work.
This notice may be updated, for example if the services used by the site change. The date of the latest update is shown at the top.