Privacy Policy

1. Data controller

The data controller is the law firm of Avv. Graziana Aiello, Via Davide Bertolotti 7, 10121 Turin, Italy, VAT no. 05428900871, reachable at info@avvocatoaiello.com.

The firm also operates through its Milan, Catania and Toronto (Canada) offices. No Data Protection Officer has been appointed; all requests should be addressed to the controller.

2. Personal data we process

We process the following categories of data:

3. Purposes and legal bases

4. Cookies and advertising tools

The site uses strictly necessary technical cookies, which do not require consent.

Where measurement or remarketing tools are enabled (e.g. Meta Pixel, Google Analytics, Google Ads), they are loaded only after you give express consent through the cookie banner. These tools may use online identifiers to measure conversions and show relevant ads on third-party platforms.

Consent may be withdrawn at any time by clearing cookies in your browser or by writing to the controller. Withdrawal does not affect the lawfulness of processing carried out beforehand.

5. Recipients and processors

Data may be disclosed to: correspondent lawyers and technical consultants, judicial and administrative authorities, our tax and accounting adviser, and IT service providers (hosting, email, website management) appointed as processors under Art. 28 GDPR.

Data is never disseminated publicly or sold to third parties for their own marketing purposes.

6. Transfers outside the EU

Some technology providers and our Toronto (Canada) office may involve transfers of data outside the European Economic Area. Canada benefits from a European Commission adequacy decision for organisations subject to PIPEDA; other transfers rely on the Standard Contractual Clauses adopted by the European Commission, with supplementary measures where required.

7. Retention periods

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR), and withdraw any consent given, by writing to info@avvocatoaiello.com. We reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Children

This website is not directed at children under 16. We do not knowingly collect their data without the consent of a person holding parental responsibility.

10. Changes

This notice may be updated. The version in force is always published on this page with its last-updated date (2026-09-02).

11. Whether providing data is mandatory

Contact fields marked as required in our forms are necessary to reply to your enquiry: without them we cannot respond. Optional fields (such as a description of your case or the amount involved) only help us assess the matter and may be left blank.

Data required to carry out an engagement is mandatory by law and by contract: refusal prevents the firm from accepting the instruction.

12. Data not collected from you

The firm may process data from sources other than the data subject: opposing parties, other lawyers, public registers, court documents, company and land registries, and information provided by a client about a third party. Such data is processed solely to establish, exercise or defend a legal claim and within the limits of the engagement (Art. 14 GDPR).

13. Advertising, social platforms and the Meta Pixel

The firm promotes its services through advertising platforms including Meta (Facebook and Instagram) and Google. If you consent to the "marketing" category in the cookie banner, the site may load the Meta Pixel and transmit — including server-side through the Conversions API — browsing events and technical identifiers (cookie ID, truncated IP address, user agent, referring URL).

Any contact details used for advanced matching or Custom Audiences are transmitted exclusively in hashed form (SHA-256) and cannot be reversed by Meta into plain text.

Limited to the collection and transmission of data through the Pixel and Conversions API, the firm and Meta Platforms Ireland Ltd. act as joint controllers under Art. 26 GDPR, on the basis of Meta's published Controller Addendum; subsequent processing is performed by Meta as an independent controller. The same structure applies to Google's measurement tools.

You may withdraw consent at any time through the "Cookie preferences" link in the footer and manage ad preferences in your Meta or Google account settings. The firm does not use special categories of data for ad targeting and does not build audiences based on an individual's health, legal proceedings or financial distress.

14. No automated decision-making

We do not take decisions based solely on automated processing, nor do we carry out profiling producing legal effects or similarly significant effects. Every enquiry is assessed by a qualified professional.

15. Security measures

Data is protected by technical and organisational measures appropriate to the risk: encryption in transit (HTTPS/TLS), individual access credentials, multi-factor authentication on critical systems, regular backups, data minimisation, locked storage for paper files, and confidentiality undertakings from staff and trainees, in addition to legal professional privilege.

16. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to the rights and freedoms of data subjects, the firm notifies the supervisory authority within 72 hours of becoming aware of it and, where the risk is high, informs the affected individuals without undue delay, describing the nature of the breach, the likely consequences and the measures taken.

17. Suppliers and processors

The firm uses suppliers appointed as processors under Art. 28 GDPR. The categories are listed below; an up-to-date named list is available on written request.

18. Exercising your rights and complaints

Send requests to info@avvocatoaiello.com, stating which right you wish to exercise. We reply free of charge within one month, extendable by two further months for particularly complex requests, with notice to you. We may ask you to verify your identity where there is reasonable doubt.

You may also lodge a complaint with the competent supervisory authority: the Italian Garante per la protezione dei dati personali (garanteprivacy.it), the CNIL in France, the Office of the Privacy Commissioner of Canada, or the authority of your country of residence.

Certain rights may be restricted where processing is necessary to establish, exercise or defend a legal claim, or where the data is covered by legal professional privilege.

19. Toronto office — PIPEDA and Québec Law 25

For users contacting the firm from Canada, processing also follows the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Québec residents, Law 25. In those cases consent is the primary basis for processing, you may request access to and correction of your data, and you may contact the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Data may be processed in Italy: Canadian users are informed that their data may be stored and processed outside Canada and may be accessible to competent authorities under local law.

Note: the Toronto office contact details published on this site are provisional and pending activation. Until the office is fully operational, the data controller remains the firm based in Turin, Italy.

20. Version and updates

Version of this notice: 2026-09-02. Previous versions are retained by the firm and available on request by email. Where changes materially affect consent, the cookie banner is shown again and the updated notice is published on this page before it takes effect.