LOG IN TO LEGALESS
Don't have an account yet?
Click here to sign up
Or
© 2026 LEGALESS® - All rights reserved
Version of 28 August 2026
Legaless® is a digital platform that provides a structured technology space enabling the User to get in touch with independent lawyers and manage their case online. Legaless® does not provide legal services and accepts no professional liability for the lawyers' work; in their relationship with the User, lawyers act with full autonomy, under their own exclusive ethical and professional responsibility.
Art. 1 – Introduction and purpose
1.1. This document (“T&C“) sets out the general terms of use of the Legaless® digital platform (hereinafter also the “Platform“), available at www.legaless.it , and the rights and obligations of the User who accesses it, under Legislative Decree no. 70 of 9 April 2003 (implementing Directive 2000/31/EC on electronic commerce), Regulation (EU) 2022/2065 (Digital Services Act), the Italian Consumer Code (Legislative Decree 206/2005) and other applicable law.
1.2. These T&C govern only the relationship between the User and the Owner of the Platform. They do not in any way govern the professional relationship between the User and the Lawyer, which is established through separate agreements between the parties and is governed by the relevant legislation and the rules of professional conduct for lawyers.
1.3. The T&C are accepted by ticking the relevant box (checkbox) when registering the Account or sending a Service request. If they are not accepted, the Platform cannot be used.
Art. 2 – Definitions
Account means the User's personal profile on the Platform, containing the related Data, through which the User can request the Services, monitor their Case and communicate with the Lawyer in charge.
AML means the rules on the prevention of money laundering and terrorist financing laid down in Italian Legislative Decree no. 231 of 21 November 2007, as amended.
Lawyer (both singular and plural) refers to the legal professional registered with the relevant Bar Association, who works with full professional and tax independence and who may be instructed by the User through the Platform. The Lawyer is independent of the Owner of the Platform and personally assumes every professional obligation towards the User.
Data means all information, documents and copies of documents shared by the User on the Platform or generated during its use.
IP Rights means the intellectual property rights of the Owner. This definition includes, by way of example and without limitation, all trademarks, copyright in the software, source code, graphical interface and editorial content, image rights, patents, rights in confidential information or innovative ideas, know-how, rights in business activities and trade names, domain names, whether registered or unregistered, and any other right or form of protection of an analogous or similar nature to any of them.
Fee means the consideration owed by the User to the Owner for the technology services offered through the Platform, included in the overall price shown in the Quote.
Professional Engagement means the separate document, signed directly between the User and the Lawyer, by which the User instructs the Lawyer to provide legal assistance for specific activities. The Owner of the Platform is not a party to the Professional Engagement.
Service Packages means the various plans offering legal services, in multiple or ongoing form, requested by the User through Legaless® and agreed with one or more Lawyers by means of specific agreements.
Case means the request for which the User has confirmed the instruction of the Lawyer, and which is handled within the Platform.
Quote means the overall price of the Service, including the Lawyer's fee and the Fee, generated automatically by the Platform on the basis of the parameters entered by the User or prepared manually by the Lawyer.
Third-Party Providers are the technology service providers used by the Platform:
– Third-party provider of electronic signature services on the Platform: Openapi S.p.A. (qualified service under Regulation (EU) 910/2014 — eIDAS, as amended by Regulation (EU) 2024/1183. Terms and conditions available at the link.
– Third-party provider of online payment services on the Platform: Stripe Payments Europe Ltd. Terms and conditions available at the link.
– Third-party provider of cloud hosting services for the Platform: Hostinger International Ltd. Terms and conditions available at the link.
By accepting these T&C the User confirms that they have read, understood and fully accepted the terms and conditions of each Third-party Provider available at the links above.
Service (singular or plural) means the specific legal assistance service requested by the User through Legaless® from one or more Lawyers.
T&C means this Terms and Conditions document, as updated from time to time.
Owner of Legaless® is Avv. Alessio D'Ascenzo, whose details are given in art. 18.
User (singular or plural) means the person (an adult individual, or a legal entity) resident in the European Economic Area (EEA) who uses Legaless®.
Art. 3 – Legal nature of the Platform
3.1 Legaless® is an information society service within the meaning of Legislative Decree 70/2003 and Regulation (EU) 2022/2065, which provides the User with a structured digital space to:
a) get in touch with one or more independent Lawyers;
b) receive Quotes, formalise engagements and sign documents electronically;
c) make online payments for the Services;
d) follow the progress of the Case and communicate with the assigned Lawyer;
e) store Case Data confidentially.
3.2 Unless otherwise provided, the Owner's activity is limited to providing, managing and maintaining the technology tool. Every professional service is provided exclusively by the Lawyer engaged by the User, with full autonomy.
3.3 The Lawyers on the Platform are professionals who are independent of the Owner in tax, organisational and professional terms.
There is no employment, quasi-employment, professional partnership, commercial agency, mandate or brokerage relationship between the Owner and the Lawyers. Each Lawyer:
a) invoices the User independently for their professional services;
b) is an independent controller of the User's personal data for the performance of the engagement received;
c) is covered by their own professional liability insurance under art. 12 of Law 247/2012;
d) is personally responsible for complying with ethical, tax, social security and anti-money-laundering obligations.
3.4 The Fee paid to the Owner is consideration for technology and organisational services. A Case is assigned to a particular Lawyer directly by the User's action or through neutral organisational criteria (area of expertise, availability, language), and in no case constitutes a recommendation, advice or guarantee as to the quality of the professional service.
Art. 4 – How the Platform works
4.1 Registration and Account. The User creates an Account by providing truthful, accurate and complete data. The User keeps their credentials safe with due care and is solely and directly responsible for all activity carried out through their Account. The Owner is not liable for unauthorised access or misuse attributable, even indirectly, to the User's conduct.
4.2 Service request and Quote. By filling in the relevant form, the User receives, where possible, an automatic Quote calculated on the basis of the information provided. For Services of variable complexity, the Quote is prepared manually by the Lawyer after reviewing the case.
4.3 Validity of the Quote. Unless expressly stated otherwise in the Quote, the Quote is valid for 30 (thirty) days from the date of issue, after which it lapses automatically. The Owner and the Lawyer reserve the right to withdraw or amend the Quote if the underlying circumstances change substantially (e.g. facts not disclosed by the User come to light, changes in the applicable lawyers' fee scales, conflicts of interest arising). The automatic Quote is calculated on the information provided by the User: if that information is untrue or incomplete, the Lawyer may redetermine the fee before the engagement is accepted and assigned.
4.4 Acceptance of the Quote and engagement. Once the User has received the Quote, they may accept it by paying through the channels provided by the Platform. The professional engagement, whether by acceptance of the quote or by signing the Professional Engagement where required, concerns only the relationship between User and Lawyer.
Signature by electronic signature through the Platform's system has evidential value under Regulation (EU) 910/2014 and Italian Legislative Decree 82/2005 (Digital Administration Code).
4.5 Subcontracting and assistance from the Lawyer's associates. The User acknowledges and accepts that the assigned Lawyer, in carrying out the professional engagement, may use their own office associates, qualified trainees, hearing substitutes and local agents, under their own exclusive direction and responsibility. The Lawyer remains the User's sole point of contact and sole controller of the related data, unless otherwise agreed. Any sub-engagements to specialist colleagues or lawyers from other Bars are handled by the Lawyer independently and notified to the User in advance where they involve additional costs.
4.6 Performance of the Service. The Lawyer performs the Service according to the terms agreed in the quote and/or the professional engagement.
Communications and updates on the status of the Case take place through the Platform's tools (internal chat, timeline, notifications). The User acknowledges that the Platform stores these communications for evidential and security purposes (see art. 16.3).
4.7 Payments and segregation of funds. Payments are made through the Stripe platform.
a) Sums paid by the User are handled by Stripe. The Lawyer is credited with the consideration for the professional service provided to the User. The Owner is entitled to the Platform Fee.
b) In any event, the Lawyer remains the sole provider of the legal service and the sole party responsible for performing and invoicing it to the User; the Owner is responsible for the tax treatment of the Fee.
4.8 Service Packages. Service Packages are governed by the specific terms agreed between User and Lawyer and set out in the offer. Any provision of ongoing or recurring services is governed by the individual agreement between User and Lawyer, including duration, cancellation arrangements and any unused hours.
Art. 5 – Consumer's right of withdrawal
5.1 A User acting as a consumer under the Italian Consumer Code has the right to withdraw from the contract concluded with the Platform within 14 (fourteen) days of its conclusion, without giving reasons and without any cost other than those provided for in art. 5.3 (arts. 52 et seq., Legislative Decree 206/2005), by sending an explicit statement to supporto@legaless.it.
5.2 Under arts. 51(8) and 59(1)(a) of the Italian Consumer Code, the consumer User – when accepting the Quote and in any case when the engagement is assigned – confirms their wish for performance of the Service to begin before the 14-day withdrawal period expires; if the consumer User intends to exercise the right of withdrawal under the Consumer Code, they must expressly request that performance be postponed by 14 days. Full performance of the Service results in loss of the right of withdrawal.
5.3. If the Service has been only partly performed at the time of withdrawal, the User must pay an amount proportionate to the services provided up to that point, including the Fee, without prejudice to any further consequences arising from professional work already begun (e.g. court proceedings in progress).
5.4 This article does not apply to Users that are legal entities or professionals acting in the course of their commercial, business, craft or professional activity.
Art. 6 – User obligations and warranties
6.1 The User undertakes to:
a) use the Platform in good faith, properly and in compliance with Italian and European law;
b) provide truthful, accurate, complete and up-to-date information, including so that the Quote can be calculated correctly;
c) not create false identities or impersonate others;
d) keep their credentials safe and promptly inform the Owner of any unauthorised access;
e) ensure that the Data shared does not infringe third-party rights (including intellectual property, privacy and professional confidentiality);
f) refrain from any conduct that could harm the Platform, the Owner, the Lawyers or other Users;
g) refrain from transmitting unlawful, fraudulent, obscene, discriminatory, defamatory or threatening content, or content containing viruses, malware or harmful code;
h) refrain from using the Platform for unlawful purposes or to develop competing services;
i) cooperate with the Lawyer by promptly providing the information, documents and elements needed to perform the Service and for any AML obligations binding on the Lawyer.
6.2 Indemnity. The User indemnifies and holds the Owner harmless against any claim, complaint, dispute, legal action or penalty, and against any damage, cost, charge and expense (including legal fees) arising, even indirectly, from breach of the obligations in this article, unlawful use of the Platform or dissemination of unlawful content.
6.3 Notice & Action (DSA). Under arts. 16 et seq. of Regulation (EU) 2022/2065, anyone who believes that content on the Platform is unlawful may send a reasoned notice to supporto@legaless.it, stating the content, its location and the reasons for the notice. The Owner assesses the notice and, where the conditions are met, removes or disables access to the content, informing both the notifier and the recipient.
Art. 7 – Anti-money laundering and conflicts of interest
7.1 The User acknowledges that, under Legislative Decree 231/2007, the Lawyer is subject to customer due diligence, record-keeping and suspicious transaction reporting obligations for services within their scope (in particular those listed in art. 12 of that decree). AML obligations are the exclusive responsibility of the Lawyer as the obliged entity, who carries them out as an independent controller of the related personal data and keeps the related records for the legal period (10 years). The Platform only provides the technology tools for collecting the data and documents requested by the Lawyer, without acting as an obliged entity. The User undertakes to provide the Lawyer, truthfully and promptly, with everything requested for due diligence purposes; failure to do so, or incomplete compliance, may lead the Lawyer to refrain from performing the Service under art. 42 of Legislative Decree 231/2007.
7.2 The prior check for potential conflicts of interest under arts. 24 and 68 of the Code of Conduct for Italian Lawyers is the exclusive competence and responsibility of the assigned Lawyer, before accepting the professional engagement. The Owner does not carry out, and is not required to carry out, any substantive check on the existence of conflicts of interest between the Cases handled on the Platform, and is not liable for any conflicts not detected by the Lawyer. If the Lawyer, even after accepting the engagement, detects a conflict of interest or other ethical reason to abstain, they must promptly inform the User and withdraw from the engagement in accordance with the rules of professional conduct; in that case the Platform, with the User's consent, may make the Case available for assignment to another available Lawyer.
Art. 8 – Obligations and liability of the Owner
8.1 The Owner undertakes to provide the Platform with the technical diligence that can reasonably be expected, as an obligation of means and not of result.
The Owner does not guarantee that the Platform is free from errors, interruptions or malfunctions, but will do its best to ensure they are resolved within a reasonable time.
8.2 The Owner accepts no liability, direct or indirect, for the professional activity of the Lawyers, for the quality, timeliness, accuracy, completeness or outcome of legal services, for any errors, omissions, delays or failures by the Lawyer, for the Lawyer's professional conduct, for any undetected conflicts of interest, for failure to comply or incorrect compliance with AML rules, or for any consequence arising from the professional engagement assigned. Any claim relating to professional activity must be addressed exclusively to the assigned Lawyer.
8.3 The Owner is not liable for malfunctions, interruptions, errors or breaches attributable to Third-party Providers (Stripe, OpenAPI, Hostinger, telecommunications operators, etc.), except in cases of wilful misconduct or gross negligence in selecting them. The relationship between the User and each Third-party Provider is governed by the relevant terms of use, which the User declares they have read, understood and accepted by accepting these T&C.
8.4 Limitation of liability. Except in cases of wilful misconduct or gross negligence, and without prejudice to the consumer's mandatory rights, the Owner's total liability to the User, on any basis (contract, tort, restitution), is in any event limited to the total amount of the Fee actually received by the Owner in relation to the User's Cases in the 6 (six) months preceding the event giving rise to liability.
8.5 Indirect damages, loss of profit, loss of opportunity, loss of data not attributable to the Owner, reputational damage and business interruption are excluded in all cases.
8.6 The Owner is not liable for failures due to force majeure, unforeseeable circumstances, acts of third parties or of the User, orders of the authorities, or cyber attacks despite the adoption of adequate security measures.
Art. 9 – Maintenance, suspension and changes to the Platform
9.1 The Owner may carry out maintenance, updates and security work on the Platform, keeping the impact on the User as low as possible. Where the work involves a significant suspension, the Owner gives reasonable advance notice.
9.2 The Owner may unilaterally suspend or change, in whole or in part, the Platform's features:
a) to comply with legal or regulatory obligations or orders from the authorities;
b) to deal with security threats, fraud, cyber attacks or data breaches;
c) because of supervening technical, economic or organisational needs.
9.3 The Owner may permanently discontinue the Platform with at least 20 (twenty) days' notice, during which the User can download their Data.
9.4 Changes to the T&C, justified by regulatory, technical or organisational reasons, are notified to the User 10 (ten) days in advance through their Account and/or by email. The User may withdraw at no cost within that period; if they do not withdraw, the changes are deemed accepted.
Art. 10 – Intellectual property
10.1 All IP Rights relating to the Platform, the “Legaless®” trademark (registered with the EUIPO), the software, source code, design, editorial content, template documents and every other element belong exclusively to the Owner. Nothing in these T&C involves any assignment or grant of those rights, even partial or temporary.
10.2 The Owner grants the User a licence to use the Platform that is personal, temporary, non-exclusive, non-transferable, non-sublicensable, revocable and limited to the duration of the relationship.
10.3 The User undertakes not to:
a) reproduce, modify, decompile, disassemble, reverse engineer, translate or adapt the software or create derivative works;
b) license, sell, rent, distribute or transfer access to the Platform to third parties;
c) carry out penetration or vulnerability tests, or DoS/DDoS attacks;
d) use the Legaless® trademarks, logos or distinctive signs without prior written authorisation.
10.4 The User retains ownership of the content they upload. However, they grant the Owner a non-exclusive, free and limited licence, valid for the duration of the relationship and for as long as needed to comply with legal retention obligations, to use that content solely to provide the Platform and for related technical and operational purposes.
10.5 Any opinions, comments, suggestions or feedback sent spontaneously by the User may be used by the Owner to improve the Platform, without giving rise to any obligation of payment or acknowledgement.
Art. 11 – Processing of personal data
11.1 The processing of the User's personal data is governed by the Privacy Policy, which forms an integral part of these T&C.
11.2 The User acknowledges and accepts that:
a) the Owner processes data as an independent controller for the Platform's technical and organisational purposes;
b) the assigned Lawyer processes data as an independent controller to perform the professional engagement and to meet the ethical, AML and legal obligations binding on them;
c) transmitting the Data to the Lawyer is a necessary condition for providing the requested Service.
11.3 Retention after termination of the relationship. The Owner and the Lawyer are independent controllers with separate, non-overlapping retention obligations. The end of the relationship between the User and the Owner, or a deletion request addressed to the Owner, does not affect the retention periods binding on the Lawyer under ethical rules (arts. 33 and 50 of the Code of Conduct for Italian Lawyers), AML rules (art. 31 of Legislative Decree 231/2007), tax rules (art. 2220 of the Italian Civil Code) and for the defence of their own rights (art. 9(2)(f) GDPR). Likewise, the end of the professional engagement between User and Lawyer does not affect the retention periods binding on the Owner under its own obligations. Data subject rights must be exercised separately with each controller for the data it is responsible for.
Art. 12 – Suspension of the User
12.1 The Owner may suspend or restrict the User's access to the Platform, even without notice, in the event of:
a) breach of the T&C or of applicable law;
b) conduct that could harm the Owner, the Lawyers, other Users or the security of the Platform;
c) late payment or non-payment for the Services;
d) orders or requests from the competent authorities;
e) supervening impossibility of supply.
12.2 The User is notified of the suspension, with the reasons and, where possible, the steps needed to restore access.
Art. 13 – Termination of the relationship
13.1 The relationship governed by the T&C is for an indefinite term from the date of acceptance.
13.2 Withdrawal by the User. The User may withdraw at any time using the account closure function in their private area, or by writing to supporto@legaless.it. 5 (five) days after the request, the Account and the Data for which the Owner is responsible are removed within the limits set out in the Privacy Policy (§7) and in art. 11.3 (subject to legal retention obligations). The User is responsible for downloading their Data before removal. Where Service Packages are in progress, the specific notice periods set out in them apply.
13.3 Withdrawal by the Owner. The Owner may withdraw at any time, without giving reasons and without compensation, by giving the User at least 20 (twenty) days' written notice.
13.4 Termination for breach. In the event of a serious breach of the T&C or of applicable law by the User, the Owner may terminate the relationship under art. 1456 of the Italian Civil Code with immediate effect, by written notice, without prejudice to its right to damages.
13.5 Once the relationship has ended, access to the Account is disabled and the Data is removed within the periods set out in art. 11.3.
The end of the relationship with the Owner does not affect any ongoing professional engagement with the Lawyer, which remains governed independently by its own terms.
Art. 14 – Assignment of the contract
14.1 The Owner may assign, in whole or in part, the relationship governed by the T&C, provided that the User's rights are not prejudiced. The User is notified of the assignment with reasonable notice.
14.2 The User acknowledges and specifically accepts, for the purposes of art. 1406 et seq. of the Italian Civil Code, that the Owner – as part of the organisational development of its business – may transfer the T&C, the User's Account and the related contractual relationships in progress to a company, including a newly incorporated one, carrying on the same activity of operating the Platform. This article constitutes the User's prior consent to the assignment under art. 1407 of the Italian Civil Code, subject to the following conditions:
a) the assignee takes over in full the Owner's rights and obligations towards the User, on the same terms;
b) the User is notified of the assignment at least 20 days in advance through their Account and/or by email;
Art. 15 – Force majeure
In the event of force majeure (natural events, conflicts, acts of the authorities, pandemics, large-scale cyber attacks, widespread network outages, etc.), the Owner's obligations are suspended for the duration of the event. If the event lasts more than 30 (thirty) consecutive days, either party may withdraw without compensation.
Art. 16 – Final provisions
16.1 The User declares that they have the legal capacity and powers needed to enter into these T&C, that they are of age (≥ 18 years) and, if a legal entity, that they are acting in the course of their business or profession, with the consequent exclusion of the rules of the Italian Consumer Code. When creating their account and/or requesting the Service, the User declares whether they are acting as a consumer or in the course of their business or profession..
16.2 The parties are independent contractors. The T&C do not create an employment, mandate, agency, partnership, joint venture or franchising relationship.
16.3 The User expressly accepts that the electronic records kept in the systems of the Platform and of the Third-party Providers, including communications, access logs, electronic signatures and payment confirmations, constitute evidence of the transactions and agreements concluded, provided the party they come from can be identified and their integrity is guaranteed.
16.4 Failure to exercise a right does not constitute a waiver. The invalidity or ineffectiveness of a clause does not affect the validity of the others.
16.5 The User may submit complaints or requests for help to supporto@legaless.it. Indicative response time: 5 working days.
16.6 ADR. Consumer Users may also contact the mediation bodies accredited under Legislative Decree 28/2010 and Legislative Decree 130/2015.
16.7 The following articles survive termination of the relationship: 6.2 (indemnity), 7 (AML and conflicts), 8 (liability), 10 (intellectual property), 11.3 (retention), 16.3 (evidence), 16.7, 17 (law and jurisdiction).
16.8 Words in the singular include the plural and vice versa; references to legislation are to the text in force; amounts are in euros.
Art. 17 – Governing law and jurisdiction
17.1 The relationship is governed by Italian law.
17.2 The parties will try to settle any dispute amicably. Failing that:
a) for consumer Users, the court of the consumer's place of residence or chosen domicile has jurisdiction, under art. 66-bis of the Italian Consumer Code;
b) for Users acting as a company or professional, the Court of Rome has exclusive jurisdiction, unless another court is mandatorily competent by law.
Art. 18 – Owner's details
Owner of Legaless®: Avv. Alessio D'Ascenzo Tax code: DSCLSS94H05A345U
Registered office: ROME (RM), Italy PEC: legaless@pec.it
Email: a.dascenzo@legaless.it
Single point of contact under arts. 11-12 of Regulation (EU) 2022/2065: supporto@legaless.it)
Trademark: Legaless® — registered with the EUIPO, no. 018727049
Clauses specifically approved under arts. 1341 and 1342 of the Italian Civil Code
For the purposes of arts. 1341 and 1342 of the Italian Civil Code, the User declares that they have read, understood and specifically approved the following clauses: Art. 3 (Legal nature of the Platform – no legal services provided by the Owner and independence of the Lawyers); Art. 4.3 (Validity and withdrawal of the Quote); Art. 4.5 (Subcontracting and assistance from the Lawyer's associates); Art. 4.7 (Payments – nature of the Fee); Arts. 5.3-5.4 (Early performance, loss and exclusions of the right of withdrawal); Art. 6 (User obligations and indemnity); Art. 7 (Anti-money laundering and conflicts of interest — exclusion of the Owner's liability); Art. 8 (Exclusion and limitation of liability, capped at 6 months of Fees); Art. 9 (Maintenance, suspension, unilateral changes); Art. 10 (Intellectual property and licences); Art. 11.3 (Separate retention periods for the Owner and the Lawyer); Art. 12 (Suspension of the User); Art. 13 (Termination of the relationship and withdrawal); Art. 14.2 (Prior consent to assignment to a future corporate vehicle); Art. 16.3 (Evidential value of electronic records); Art. 16.7 (Survival of clauses); Art. 17 (Governing law and jurisdiction).
Version of 28 August 2026
Notice given under arts. 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and art. 122 of Legislative Decree 196/2003 (“Italian Privacy Code”), as amended by Legislative Decree 101/2018.
1. Data controller
| Data controller: Avv. Alessio D'Ascenzo | Tax code: DSCLSS94H05A345U |
| Registered office: Rome (RM), Italy | PEC: legaless@pec.it |
| Email: a.dascenzo@legaless.it |
No Data Protection Officer (DPO) has been appointed, as the conditions of art. 37 GDPR do not apply.
2. Roles and structure of the processing
The Legaless® Platform connects the User with independent lawyers. It's important for the User to understand who processes their data and for what purposes:
| Party | Role | Scope of processing |
|---|---|---|
| Legaless® Controller | Independent controller | Operation of the Platform, Account management, hosting, security, invoicing, its own legal obligations; receiving, storing and transmitting Case data (requests, documents, chats) to prepare Quotes, assign engagements and enable communication between User and Lawyer |
| Assigned lawyer | Independent controller | Performance of the Professional Engagement, drafting of documents, legal defence, ethical and anti-money-laundering (AML) obligations under Legislative Decree 231/2007 |
| Third-party Providers (Stripe, OpenAPI, Hostinger, etc.) | Processors or independent controllers (see § 9) | Technical operation of the related features |
The Controller accesses Case data only to the extent needed to prepare Quotes, assign engagements, provide support and keep the Platform secure, through authorised staff bound by confidentiality. The Lawyer is an independent controller and handles their own privacy notice directly with the User for professional, ethical and anti-money-laundering purposes.
Requests to exercise your rights must be sent to the controller responsible for the relevant purpose of processing (see § 7 and § 10).
3. Categories of data processed
Depending on how the User interacts with the Platform, the Controller processes:
a) Personal and contact details: first name, last name, email, phone, residence, tax code, VAT number;
b) Identification data: a copy of the ID document, where needed to perform the Service or for the Lawyer's anti-money-laundering obligations (in that case the data is passed to the Lawyer, who processes it as an independent controller under Legislative Decree 231/2007);
c) Account data: login credentials (encrypted), settings, preferences;
d) Case data: description of the case, uploaded documents, chat messages, quotes, engagement letters. These may include special categories of data (art. 9 GDPR) – e.g. data about health, sex life, racial or ethnic origin, political opinions or religious beliefs – where relevant to the legal case; and data relating to criminal convictions and offences (art. 10 GDPR);
e) Payment data: handled entirely by Stripe; the Controller receives only transaction data (amount, outcome, identifier);
f) Electronic signature data: handled by OpenAPI (phone number for the OTP, signature logs);
g) Usage data: IP address, access logs, browser type, operating system, pages visited, timestamps;
h) Communication data: messages sent through the internal chat and by email.
The User is responsible for the accuracy, completeness and currency of the data provided, and for the lawfulness of disclosing third-party data.
4. Purposes and legal bases of processing
| # | Purpose | Legal basis (art. 6 GDPR) | Legal basis for special categories (art. 9) |
|---|---|---|---|
| 4.1 | Creating and managing the Account | Performance of the contract (art. 6(1)(b)) | — |
| 4.2 | Providing the Platform's features (requests, quotes, chat, signature, payments) | Performance of the contract (art. 6(1)(b)) | Explicit consent where special categories of data are involved (art. 9(2)(a)); or the establishment, exercise or defence of legal claims (art. 9(2)(f)) |
| 4.3 | Compliance with the Controller's legal obligations (tax, accounting, orders from authorities, DSA) | Legal obligation (art. 6(1)(c)) | Art. 9(2)(g) (reasons of substantial public interest) where applicable |
| 4.4 | Platform security, fraud prevention, access logs | Legitimate interest (art. 6(1)(f)) | — |
| 4.5 | Customer support and complaint handling | Performance of the contract / legitimate interest | — |
| 4.6 | Sending service communications (notifications, Case updates) | Performance of the contract (art. 6(1)(b)) | — |
| 4.7 | Sending the Controller's newsletters / promotional communications | Consent (art. 6(1)(a)), which can be withdrawn at any time | — |
| 4.8 | Soft spam about similar Services already requested (art. 130(4), Legislative Decree 196/2003) | Legitimate interest, with the right to object | — |
| 4.9 | Defence of a right in court or out of court | Legitimate interest (art. 6(1)(f)) | Art. 9(2)(f) |
| 4.10 | Aggregate statistics and service improvement | Legitimate interest (art. 6(1)(f)) | — |
Mandatory or optional provision. Providing the data under points 4.1–4.6 is necessary to perform the Service: failure to provide it prevents use of the Platform. Providing data for purpose 4.7 is optional and does not affect use of the Platform.
AML processing. Processing related to anti-money-laundering due diligence, record-keeping and reporting obligations is carried out by the Lawyer as the obliged entity and independent controller under Legislative Decree 231/2007 (see § 7). The Controller does not act as an AML obliged entity.
5. Technology tools and artificial intelligence
The Controller may use automation tools and artificial intelligence models solely for internal editorial, organisational and management support (e.g. drafting internal documents, classifying requests, helping write standard quotes). These tools are not fed with Case data, nor used to take automated decisions producing legal effects for the User, nor to profile the User within the meaning of art. 22 GDPR. The Lawyer remains solely responsible for professional assessments and for the content delivered to the User.
6. Processing methods and security
Data is processed using electronic tools and organisational procedures designed to ensure its security, integrity and confidentiality, in accordance with art. 32 GDPR. The measures adopted include, among others:
– encryption of sensitive data in transit (TLS) and at rest;
– two-factor authentication for privileged access;
– segregation of roles and the principle of least privilege;
– web application firewall (WAF), intrusion detection systems, anti-malware;
– regular backups and disaster recovery procedures;
– incident management and data breach notification procedures under arts. 33-34 GDPR;
– regular security audits.
Despite these measures, no IT system is entirely risk-free. The Controller undertakes to notify the Italian Data Protection Authority and — where required — the User of any data breaches in accordance with applicable law.
7. Retention periods
The Controller and the Lawyer are independent controllers with separate retention obligations. This section covers retention by the Controller; for retention by the Lawyer, please refer to the Lawyer's own privacy notice, which the Lawyer provides directly to the User.
7.1 Retention by the Controller
| Category | Retention period |
|---|---|
| Data of Accounts in use | For the duration of the relationship |
| Data relating to completed Cases (Platform side) | Documents and chats from completed Cases: 24 months from completion. Quotes, engagement letters and transaction data: 10 years from completion of the Case (in line with the limitation periods under art. 2946 of the Italian Civil Code and the record-keeping obligations under art. 2220 of the Italian Civil Code) |
| The Controller's tax and accounting records | 10 years (art. 2220 of the Italian Civil Code and art. 22 of Presidential Decree 600/1973) |
| Technical and security logs | Up to 12 months, unless retention is needed for investigations |
| Marketing data (consent) | Until consent is withdrawn, and in any case no longer than 24 months after the last interaction |
| Inactive account | After 24 months of inactivity, the User is asked to confirm whether they wish to keep the Account; if there is no reply within 30 days of the message, the Account is closed and the data deleted or anonymised (subject to the retention obligations above) |
7.2 Retention by the Lawyer. The Lawyer, as an independent controller, retains the User's data for the periods and within the limits required by their legal obligations, in particular:
– professional case file documents: for as long as needed to defend the rights of the client and of the Lawyer, in line with the applicable limitation periods (as a general rule, at least 10 years from the end of the engagement, under art. 2946 of the Italian Civil Code);
– AML documents (due diligence, record-keeping, reports): 10 years from the end of the ongoing relationship or from performance of the occasional service, under art. 31 of Legislative Decree 231/2007;
– tax and accounting documents: 10 years under art. 2220 of the Italian Civil Code and art. 22 of Presidential Decree 600/1973.
7.3 Effect of termination on the separate controllers. Ending the relationship with the Owner, or a deletion request addressed to the Owner, does not automatically affect the retention periods binding on the Lawyer, and vice versa. To obtain full deletion of their data, the User must exercise their rights separately with each controller. In any event, the limits laid down by law for mandatory retention (e.g. AML, tax, defence of a right) continue to apply.
8. Recipients of the data
Data may be disclosed to:
a) Assigned Lawyers, as independent controllers, to perform the Professional Engagement and for their AML, ethical and tax obligations;
b) The Controller's associates and authorised staff, designated as persons authorised to process data and bound by confidentiality;
c) Technical service providers designated as processors under art. 28 GDPR (hosting, maintenance, security, support, automation tools);
d) Third-party Providers for payments (Stripe), electronic signature (OpenAPI) and hosting (Hostinger), as specified in § 9;
e) Advisers (the Controller's accountant and lawyer) for professional compliance and defence;
f) Judicial and administrative authorities in the event of lawful requests (including the Financial Intelligence Unit (UIF) and the Guardia di Finanza for AML purposes, on lawful request). Data is not disseminated and is not transferred to third parties for their direct marketing purposes.
9. Third-party providers and transfers outside the EU
| Provider | Function | Location and transfers |
|---|---|---|
| Stripe Payments Europe Ltd. | Online payments | Based in the EU (Ireland). Any transfers to Stripe Inc. (USA) take place on the basis of the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework. |
| Openapi S.p.A. | eIDAS electronic signature | Registered office in the EU (Italy). |
| Hostinger International Ltd. | Hosting and infrastructure | Based in the EU/EEA (European data centres). |
Any other providers can be named on request by writing to supporto@legaless.it. For transfers outside the EU/EEA, where needed, the Controller adopts the safeguards provided for by arts. 44-49 GDPR (adequacy decisions, Standard Contractual Clauses, supplementary measures).
10. User rights
The User may exercise the following rights at any time, within the limits of the law:
– Access (art. 15 GDPR) – find out what data is processed and obtain a copy;
– Rectification (art. 16) – correct inaccurate data or complete it;
– Erasure / right to be forgotten (art. 17) – ask for the data to be removed, within the limits provided;
– Restriction (art. 18) – temporarily restrict processing;
– Portability (art. 20) – receive the data in a structured, commonly used, machine-readable format and transmit it to another controller;
– Objection (art. 21) – object to processing based on legitimate interest or for direct marketing;
– Withdrawal of consent (art. 7(3)) – at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
– Complaint to the supervisory authority – Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11, 00187 Rome, garante@gpdp.it, www.garanteprivacy.it;
– Not to be subject to automated decisions (art. 22) – the Controller does not take automated decisions producing significant legal effects.
– Exercising rights with independent controllers. For data processed by the Legaless® Controller, requests should be sent to supporto@legaless.it. For data processed by the Lawyer (performance of the Engagement, AML, professional conduct), requests should be sent directly to the Lawyer, who provides their own privacy notice.
Legal limits (e.g. AML, tax and legal-defence retention obligations) may lead to some requests being refused or deferred, with reasons given.
The Controller responds within 30 days of receipt, extendable by a further 60 days in complex cases (art. 12 GDPR).
11. Cookies
The use of cookies and similar technologies is governed by the separate Cookie Policy available on legaless.it, drawn up in accordance with the Italian Data Protection Authority's Decision of 10 June 2021.
12. Legal defence
The User's data may be used by the Controller, even after the relationship has ended, to establish, exercise or defend a legal claim, within the limits of art. 9(2)(f) GDPR and the law.
13. Changes to this notice
The Controller may update this notice. Changes will be communicated to the User through their Account and/or by email. The current version is always available at legaless.it/privacy-policy/.
14. Minors
The Platform is intended only for adults. The Controller does not knowingly collect data from minors. If processing of a minor's data is detected, the Controller will delete it, unless otherwise authorised by the holder of parental responsibility under art. 8 GDPR.