PRIVACY NOTICE AND AI

PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 (GDPR)

Dear Madam / Dear Sir / Dear Sirs

_____________________________________________

  • Data Controller

The Data Controller is “Archè Studio Legale” (hereinafter the Firm), with registered office in Genoa, Via Bartolomeo Bosco 15/7, VAT No. 02424940993.

  • Categories of personal data processed

The processing activities will concern the following categories of data:

  • identification data and/or company name and contact details (telephone number, email address);
  • tax data (tax code and/or VAT No.), administrative data and bank details (IBAN);
  • special categories of personal data under Article 9 GDPR and data relating to criminal convictions and offences under Article 10 GDPR, where necessary in connection with the engagement;
  • data and information contained in correspondence, records, documents and communications relating to the engagement, including data concerning counterparties, witnesses, consultants and other third parties.
  • Purposes, legal basis and retention period for data processing

The personal data of Data Subjects will be processed for the following purposes:

A

Purpose

Proper and complete performance of the professional engagement, in judicial or extrajudicial matters.

Legal basis

Performance of the engagement, contract or requested pre-contractual measures (Art. 6(1)(b) GDPR). For special-category data: Art. 9(2)(f) GDPR, where necessary for the establishment, exercise or defence of legal claims.

For data relating to criminal convictions and offences: Art. 10 GDPR and Art. 2-octies of Legislative Decree No. 196/2003.

Retention period

10 years from the end of the engagement, unless longer retention is required by law or necessary to protect legal rights.

B

Purpose

Compliance with statutory, administrative, tax and accounting obligations and, where applicable, anti-money laundering obligations.

Legal basis

Compliance with a legal obligation (Art. 6(1)(c) GDPR).

Retention period

For the periods prescribed by applicable law (generally 10 years for administrative, tax and accounting records).

C

Purpose

Protection of the Controller’s rights and management of disputes or litigation, including before the courts.

Legal basis

The Controller’s legitimate interest in protecting its rights (Art. 6(1)(f) GDPR).

Retention period

For the duration of the dispute or proceedings and until the expiry of the applicable limitation or forfeiture periods.

D

Purpose

Sending by email regulatory or case-law updates, publications and events organised or sponsored by the Firm.

Legal basis

Optional consent of the Data Subject (Art. 6(1)(a) GDPR).

Retention period

Until the Data Subject withdraws consent.

The provision of data necessary to perform the engagement and comply with legal obligations is required; failure to provide such data may prevent the establishment or continuation of the relationship. Providing data for purpose D is optional and refusal to consent has no consequences for the engagement. Once the retention period has expired, the data will be erased or anonymised, unless further retention is required by law or necessary to protect legal rights.

  • Disclosure of data and transfers to third countries

Your personal data may be disclosed, to the extent necessary for the purposes set out above, to:

  • consultants, accountants, other lawyers, collaborators and professionals providing services related to the engagement;
  • providers of IT, management software, cloud, email, document storage and, where used, AI-based services, which may act as processors pursuant to Article 28 GDPR;
  • banks, insurance companies and other entities to which disclosure is necessary for performance of the engagement or compliance with legal obligations;
  • judicial or administrative authorities and other public bodies, in the cases provided for by law.

Data are generally processed within the European Economic Area. Where specific providers entail transfers to third countries, such transfers will take place in compliance with Articles 44 et seq. GDPR, on the basis of an adequacy decision or the other safeguards provided for by the GDPR. Information on the safeguards applied may be requested from the Controller.

  • Use of artificial intelligence tools

Pursuant to Article 13 of Law No. 132 of 23 September 2025, the Firm informs the Client that, in performing the engagement, it may use artificial intelligence tools exclusively for activities instrumental and supportive to the professional activity, such as, by way of example, document organisation, research, outlining, formal review, text comparison, preparation of working drafts and drafting support.

The Lawyer’s professional intellectual work shall in all cases remain predominant. Artificial intelligence tools will not replace professional judgment, legal assessment, professional responsibility, final review or the Firm’s defence or advisory decisions.

Any use of such tools will take place in compliance with professional secrecy, confidentiality, data protection law and the Lawyer’s professional conduct obligations. Documents and information received from the Client will be handled with the necessary safeguards and will not be used in a manner incompatible with the fiduciary nature of the professional relationship.

  • Automated decision-making and dissemination of data

Your personal data are not disseminated or subject to decision-making based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the Data Subject.

  • Rights of the Data Subject

In the cases and under the conditions provided for by Articles 15-22 GDPR, the Data Subject may:

  • request access to personal data and their rectification, completion, erasure or restriction of processing, and exercise the right to data portability where the relevant conditions are met;
  • object to processing in the cases provided for by Article 21 GDPR;
  • withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
  • lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).

To exercise their rights, Data Subjects may contact the Controller by telephone at 010.0897500 or by email atinfo@arche-lex.net or at the Firm’s registered office.

The Controller will respond within one month of receiving the request; this period may be extended by a further two months in the cases provided for by Article 12(3) GDPR, with the Data Subject being informed within the first month.