Privacy Policy

What data this website collects, why, for how long, and how to exercise your rights.

Last updated: 26 September 2026

This is a courtesy translation. In case of any discrepancy, the Italian version prevails.

1. In short

This is the website of a law firm. It presents the firm, its lawyers, its practice areas and an archive of legal articles. It requires no registration, sends no newsletters, sells nothing and carries no advertising.

Browsing data exists only in the server logs and in a cookie-free visit counter that does not identify people (see section 4).
Cookies are technical only, which is why no consent is requested (see the Cookie Policy).
The personal data the site actually processes is what you choose to send: through the contact form, by email or when requesting online advice.
No data is sold, transferred or used for commercial or advertising purposes.

2. Data controller

The data controller is Studio Legale Ballati, with offices at Via delle Mura Urbane, 30, 51100 Pistoia (PT), VAT no. 00298110479, in the person of the head of the firm, Franco Ballati, lawyer.

For any matter concerning personal data you can write to [email protected].

No Data Protection Officer (DPO) has been appointed: none of the cases provided for by Article 37 of the Regulation applies.

3. The data the site processes

The table summarises every processing operation carried out by the site, its legal basis and how long the data is kept.

Processing	Data	Legal basis	Retention
Web server logs	IP address, date and time, page requested, outcome, browser and operating system	Legitimate interest (Art. 6(1)(f)): operation and security of the site	Short periods, unless needed to investigate abuse or a crime
Visit statistics	An irreversible daily fingerprint (see section 4), page, duration, device type	Legitimate interest (Art. 6(1)(f)): knowing which pages are read	Raw data 120 days; anonymous daily totals without limit
Contact form	Name, email, optional phone, subject, text of the request, site language, date and time of submission, IP address	Pre-contractual measures taken at the data subject's request (Art. 6(1)(b)); consent for any special-category data (Art. 9(2)(a))	Stored in the site's private management area, on the web server (see section 5), until the firm has handled it; deleted within twelve months of receipt, unless an engagement follows (see below)
Email and online advice requests	Whatever you write and attach	Pre-contractual measures (Art. 6(1)(b)); for special-category data, consent or the establishment, exercise or defence of legal claims (Art. 9(2)(a) and (f))	As above

A request addressed to a law firm may by its nature contain information about a personal, family, financial or judicial matter, and therefore also data belonging to special categories (Article 9 of the Regulation) or relating to criminal convictions and offences (Article 10). Such data is processed solely to assess the request and for any engagement that follows, by professionals bound by legal privilege.

If the request leads to an engagement, the data becomes part of the case file and is kept for the duration of the professional relationship and for ten years after it ends, as required by anti-money-laundering legislation and the rules on keeping professional records. Processing carried out within an engagement is governed by the notice given to the client when the mandate is conferred.

Providing the data requested by the form is necessary to receive a reply: without it, the request cannot be handled. No automated decision-making and no profiling takes place.

4. Visit statistics, without cookies

To know how many people read the site and which pages, a counter hosted on the same domain is used: it does not belong to third parties and uses no cookies. For each page view it records a fingerprint calculated from the IP address, the browser and a random value that changes every day and is deleted after two days: from that moment the fingerprint can no longer be linked to any person, not even by those who run the system.

Neither the origin, nor the geographical location, nor demographic data is recorded; the site is not linked to browsing on other sites.
Raw rows are deleted after 120 days; only daily totals remain (page views, visitors, reading time), which contain no personal data.
There is no Google Analytics, no advertising pixel and no other third-party tool.

5. Who else processes this data

The site does not share data with advertisers or analytics platforms. To operate, it relies on the following parties, which process part of the data on behalf of the firm and under contract:

The provider hosting the web server, in a data centre in the European Union (Germany): content, logs, statistics and the requests sent through the contact form reside there, saved in a private area accessible only to the firm.
The firm's email service provider: email correspondence passes through it. The site's contact form does not send emails.
Cloudflare, Inc., which protects the site from attacks and speeds up delivery: it sees the IP addresses of visitors. It is a US company; the transfer is governed by the European Commission's standard contractual clauses and by its participation in the EU-US Data Privacy Framework.
Where the request makes it necessary: the firm's associates and local counsel, technical consultants, judicial authorities, with the safeguards of legal privilege.

The office map is provided by Google Maps and is loaded only at your request: until then Google receives no data (see the Cookie Policy).

6. Your rights

At any time you can request access to the data concerning you, its rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest; you can also withdraw any consent given, without affecting the lawfulness of processing already carried out.

Requests go to [email protected]. The firm replies within one month, as provided by Article 12 of the Regulation, and asks for an identity document only when necessary to verify who is writing.

If you believe your data is processed unlawfully you can lodge a complaint with the Italian Data Protection Authority (Garante) or apply to the courts.

7. Security

The site is only reachable over an encrypted connection (HTTPS). Requests sent through the form are stored in a private area protected by personal credentials, accessible only to the firm's lawyers and secretarial staff, who are bound by legal privilege and trained in data processing. Ordinary email, however, is not end-to-end encrypted: for confidential documents it is advisable to agree a more secure delivery method with the firm.

The site is not aimed at children under fourteen and does not knowingly collect data about them.

8. Changes to this notice

If anything changes, a new service, a different tool, a new provider, this page will be updated together with the date shown at the top. Previous versions can be requested from the firm.