Privacy Policy
& Cookie Policy

The controller of personal data is:

For any questions regarding the processing of your personal data, you may contact us at the email address above.

When you use the site or the platform, we may collect the following categories of data:

a) Data from the contact form:

• Full name
• Email address
• Phone number (optional)
• Subject and message content

b) Technical data (automatic):

• IP address (for technical security)
• Browser and device type
• Date and time of the visit
• While the page loads, your browser requests fonts from Google Fonts and the map from Google Maps, which transmits your IP address to Google LLC

c) Internal platform data (only for accounts opened by invitation):

• Name, email address, phone number
• Password — stored only in hashed form, never in plain text
• Licence number and bar association, where provided
• Professional data the user records in the platform (cases, clients, documents, deadlines)

The platform is a working tool of the firm: accounts are opened only by invitation from OnLaw Office and used by its collaborators. It is not a service open to the public.

Please do not send sensitive data through the contact form: health information, data on criminal proceedings, confidential documents or data about other people. Describe the matter in general terms; if the engagement proceeds, we will collect such data later through a protected channel and with the appropriate notice. Sensitive data you nevertheless send voluntarily is processed only to assess your request, on the basis of article 9 of Law 124/2024, and deleted if the engagement does not proceed.

Your data is processed for the following purposes:

We apply the principle of storage limitation (article 6, Law 124/2024):

• Contact data: Kept until the exchange with you ends and no longer than 12 months after the last contact, unless a contractual relationship is established. The copy of the message held by the form provider (Formspree) is deleted automatically after 30 days.
• Technical data (logs): Kept for up to 90 days, solely for technical security.
• Platform accounts: Kept while the account is active and for up to 12 months after it is closed; closure can be requested at any time by email.
• Legal/contractual records: Kept for the statutory periods in force (up to 10 years under tax legislation).

After the expiry of the retention period, data is deleted or anonymised.

Your personal data is not sold, traded or shared with third parties for marketing purposes.

They may be made available only to processors acting on our instructions under a contract pursuant to article 26 of Law 124/2024, and to public authorities where the law requires it:

• Vercel Inc. (USA) — hosting and delivery of the site; processes the technical data of each visit.
• Supabase Inc. — database and document storage for the platform; servers located in Frankfurt (EU).
• Formspree Inc. (USA) — the service that forwards contact-form messages to our email and stores them for up to 30 days.
• Google LLC (USA) — fonts (Google Fonts) and the map (Google Maps) loaded on the site; receives your IP address when the page loads.
• Public authorities — only where required by law or by court order.

The contact form runs on Formspree: your message reaches us by email and a copy is held temporarily by Formspree (up to 30 days), after which it is deleted automatically. We use it for no other purpose and do not share it with third parties.

The platform database is located within the European Union (Frankfurt). For site hosting, the contact form and Google services, data is also processed in the United States of America.

In the absence of an adequacy decision by the Commissioner for that country, the transfer relies on the appropriate safeguards provided for in articles 39–41 of Law 124/2024: our processing agreements with these providers include standard contractual clauses for data protection. Copies of the relevant documents can be requested at our email address.

Under articles 13–20 of Law 124/2024 you have the following rights:

• Right to information (article 13) — to be informed about the processing
• Right of access (article 14) — to obtain a copy of your data
• Right to rectification and erasure (article 15) — to correct inaccurate data or request its deletion
• Right to be forgotten (article 16) — to request deletion also from parties with whom the data was shared
• Right to restriction (article 17) — to restrict processing
• Right to data portability (article 18) — to receive your data in a readable electronic format
• Right to object (article 19) — to object to processing
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing

If you consider that your rights have been infringed, you may lodge a complaint with the Commissioner (article 86, Law 124/2024):

Under article 88 of Law 124/2024 you are also entitled to compensation for damage suffered as a result of unlawful processing.

No. OnLaw Office does not use any automated decision-making or profiling system (article 20, Law 124/2024) in relation to site visitors, clients or platform users.

This policy may be updated from time to time to reflect legal changes or changes in our practice. The updated version will be published on this page with the date of update. We encourage you to review it periodically.

Current version: September 2026