PRIVACY POLICY
Version of 1 October 2026
Notice provided pursuant to arts. 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and, where applicable, art. 122 of Legislative Decree 196/2003 ("Privacy Code"), as amended by Legislative Decree 101/2018.
1. Data controller
Data controller: Top Consulting Ltd., operator of the Legaless® platform, represented by its legal representative pro tempore, with registered office at Triq L-Imsida, GZR 1400, Gzira, Malta, registered with the Malta Business Registry under no. C 115432, VAT number MT3273-4036, email: supporto@legaless.it.
No Data Protection Officer (DPO) has been appointed, as the conditions of art. 37 GDPR do not apply.
The Platform and the Legaless® trademark are owned by Alessio D'Ascenzo (the "Licensor") and are used by the Controller under licence.
2. Roles and structure of the processing
The Legaless® Platform puts the User in touch with independent lawyers. It is important that the User understands who processes their data and for what purposes:
| Party | Role | Scope of processing |
|---|---|---|
| Top Consulting Ltd. (operator of Legaless®) | Independent controller and Processor (art. 28 GDPR) | Operation of the Platform, Account management, security, invoicing of the Fee, legal obligations incumbent on it; receipt, storage and transmission of the Case data (requests, documents, chat) for the drafting of Quotes, the assignment of engagements and communication between User and Lawyer.
Hosting, backup, maintenance and technical support of the Platform, on the Controller's documented instructions; does not use the data for its own purposes or to train artificial intelligence systems |
| Assigned lawyer | Independent controller | Performance of the Professional Engagement, drafting of documents, legal defence, ethical and anti-money-laundering (AML) obligations under Legislative Decree 231/2007 |
| Third-party Providers (Stripe, Openapi, Hostinger, etc.) | Processors or sub-processors, or independent controllers (see § 9) | Technical operation of the related features |
The Controller accesses Case data only to the extent necessary to prepare Quotes, assign engagements, provide assistance and ensure the security of the Platform, through authorised staff bound by confidentiality. The Lawyer is an independent controller and handles directly with the User their own privacy notice for professional, ethical and anti-money-laundering purposes.
Requests to exercise rights must be addressed to the competent controller according to the purpose of the processing (see § 7 and § 10).
3. Categories of data processed
Depending on the interaction with the Platform, the Controller processes:
a) Personal and contact details: first name, surname, email, telephone, residence, tax code, VAT number;
b) Identification data: copy of an identity document, where necessary to perform the Service or for the Lawyer's anti-money-laundering obligations (in that case the data are transmitted to the Lawyer, who processes them as independent controller under Legislative Decree 231/2007);
c) Account data: login credentials (encrypted), settings, preferences;
d) Case data: description of the case, uploaded documents, chat communications, quotes, mandates. They may include special categories of data (art. 9 GDPR) – e.g. data concerning health, sex life, racial or ethnic origin, political opinions, religious beliefs – where relevant to the legal case; and data relating to criminal convictions and offences (art. 10 GDPR);
e) Payment data: handled entirely by Stripe; the Controller only receives transaction data (amount, outcome, identifier);
f) Electronic signature data: handled by Openapi (telephone number for OTP, signature logs);
g) Usage data: IP address, access logs, browser type, operating system, pages visited, timestamps;
h) Communication data: messages sent through the internal chat and by email.
The User is responsible for the accuracy, completeness and updating of the data provided, and for the lawfulness of communicating third-party data.
4. Purposes and legal bases of the processing
| # | Purpose | Legal basis (art. 6 GDPR) | Legal basis for special categories (art. 9) |
|---|---|---|---|
| 4.1 | Creating and managing the Account | Performance of the contract (art. 6(1)(b)) | — |
| 4.2 | Providing the Platform's features (requests, quotes, chat, signature, payments) | Performance of the contract (art. 6(1)(b)) | Explicit consent where special categories of data are involved (art. 9(2)(a)); or the establishment, exercise or defence of legal claims (art. 9(2)(f)) |
| 4.3 | Compliance with the Controller's legal obligations (tax, accounting, orders from authorities, DSA) | Legal obligation (art. 6(1)(c)) | Art. 9(2)(g) (reasons of substantial public interest) where applicable |
| 4.4 | Platform security, fraud prevention, access logs | Legitimate interest (art. 6(1)(f)) | — |
| 4.5 | Customer support and complaint handling | Performance of the contract / legitimate interest | — |
| 4.6 | Sending service communications (notifications, Case updates) | Performance of the contract (art. 6(1)(b)) | — |
| 4.7 | Sending the Controller's newsletters / promotional communications | Consent (art. 6(1)(a)), which can be withdrawn at any time | — |
| 4.8 | Soft spam about similar Services already requested (art. 130(4), Legislative Decree 196/2003) | Legitimate interest, with the right to object | — |
| 4.9 | Defence of a right in court or out of court | Legitimate interest (art. 6(1)(f)) | Art. 9(2)(f) |
| 4.10 | Aggregate statistics and service improvement | Legitimate interest (art. 6(1)(f)) | — |
| 4.11 | Continuity of the Service if the Platform licence ends: communication of the data to the Licensor or to the party designated by the Licensor (see § 8) | Performance of the contract (art. 6.1.b) and legitimate interest in continuing the Cases in progress (art. 6.1.f) | Art. 9.2.f, limited to what is necessary to continue the Cases |
Mandatory or optional provision. Providing the data under points 4.1–4.6 is necessary to perform the Service: failure to provide it prevents use of the Platform. Providing data for purpose 4.7 is optional and does not affect use of the Platform.
AML processing. Processing related to anti-money-laundering due diligence, record-keeping and reporting obligations is carried out by the Lawyer as the obliged entity and independent controller under Legislative Decree 231/2007 (see § 7). The Controller does not act as an AML obliged entity.
5. Technological tools and artificial intelligence
The Controller may use automation tools and artificial intelligence models solely for internal editorial, organisational and management support purposes (e.g. drafting internal drafts, classifying requests, helping write standard quotes). These tools are not fed with Case data, nor used to take automated decisions producing legal effects on the User, nor to profile the User within the meaning of art. 22 GDPR. The Lawyer remains solely responsible for the professional assessments and for the content delivered to the User.
6. Processing methods and security
Data are processed using electronic tools and organisational procedures suitable for ensuring their security, integrity and confidentiality, in accordance with art. 32 GDPR. The measures adopted, including through the processor, include among others:
– encryption of sensitive data in transit (TLS) and at rest;
– two-factor authentication for privileged access;
– segregation of roles and the principle of least privilege;
– web application firewall (WAF), intrusion detection systems, anti-malware;
– periodic backups and disaster recovery procedures;
– incident management and data breach notification procedures under arts. 33-34 GDPR;
– periodic security audits.
Despite these measures, no IT system is entirely free of risk. The Controller undertakes to notify the competent supervisory authority and — where required — the User of any data breaches in accordance with applicable law.
7. Retention periods
The Controller and the Lawyer are independent controllers with separate retention obligations. This section governs retention by the Controller; for retention by the Lawyer, please refer to the Lawyer's own privacy notice, which the Lawyer provides directly to the User.
7.1 Retention by the Controller
| Category | Retention period |
|---|---|
| Data of Accounts in use | For the duration of the relationship |
| Data relating to completed Cases (Platform side) | Documents and chats of completed Cases: 24 months from completion. Quotes, mandates and transaction data: 10 years from completion of the Case (consistent with the limitation periods under art. 2946 of the Civil Code and with document retention obligations) |
| The Controller's tax and accounting records | For the period required by the tax and accounting rules applicable to the Controller, and in any case no longer than 10 years |
| Technical and security logs | Up to 12 months, unless retention is needed for investigations |
| Marketing data (consent) | Until consent is withdrawn, and in any case no longer than 24 months after the last interaction |
| Inactive account | After 24 months of inactivity, the User is asked to confirm whether they wish to keep the Account; if there is no reply within 30 days of the message, the Account is closed and the data deleted or anonymised (subject to the retention obligations above) |
7.2 Retention by the Lawyer
The Lawyer, as independent controller, retains the User's data for the periods and within the limits set by their own legal obligations, in particular:
– documentation in the professional file: for the time needed to defend the rights of the client and of the Lawyer, consistent with the applicable limitation periods (generally, at least 10 years from the end of the mandate, under art. 2946 of the Civil Code);
– AML documentation (customer due diligence, record keeping, reports): 10 years from the end of the ongoing relationship or from the performance of the occasional service, pursuant to art. 31 of Legislative Decree 231/2007;
– tax and accounting documentation: 10 years under art. 2220 of the Civil Code and art. 22 of Presidential Decree 600/1973.
7.3 Effects of the end of the relationship on the separate controllers
The end of the relationship with the Controller, or a deletion request addressed to the Controller, does not automatically affect the retention periods binding on the Lawyer, and vice versa. To obtain full deletion of the data, the User must exercise their rights separately against each controller. In any case, the legal limits on mandatory retention remain unaffected (e.g. AML, tax, defence of a right).
8. Recipients of the data
Data may be communicated to:
a) engaged Lawyers, as independent controllers, for the performance of the Professional Mandate and for the AML, professional conduct and tax obligations incumbent on them;
b) collaborators and authorised staff of the Controller, designated as persons authorised to process data and bound by confidentiality;
c) the Licensor, designated processor under art. 28 GDPR for hosting, backup, maintenance and technical support, and its sub-processors (currently Hostinger International Ltd.);
d) other technical service providers designated as processors under art. 28 GDPR (security, support, automation tools);
e) Third-party Providers for payments (Stripe), electronic signature (Openapi) and hosting (Hostinger), as specified in § 9;
f) Advisers (accountant, the Controller's lawyer) for professional obligations and defence;
g) Judicial and administrative authorities in the event of lawful requests (including the FIU and the Guardia di Finanza for AML purposes, upon lawful request);
h) if the licence to use the Platform ends for any reason, the Licensor or the party designated by the Licensor, which becomes their independent controller solely in order to ensure the continuation of the Service and of the Cases in progress (purpose 4.11). The User is informed of this as described in § 13.
Data are not disclosed to the public and are not transferred to third parties for their own direct marketing purposes.
9. Third-party Providers and transfers outside the EU
| Provider | Function | Location and transfers |
|---|---|---|
| Stripe Payments Europe Ltd. | Online payments, to the Controller's account or, where provided, to the Lawyer's Stripe account linked to the Platform | Based in the EU (Ireland). Any transfers to Stripe Inc. (USA) take place on the basis of the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework. |
| Openapi S.p.A. | eIDAS electronic signature | Registered office in the EU (Italy). |
| Hostinger International Ltd. | Hosting and infrastructure (sub-processor through the Licensor) | Based in the EU/EEA (European data centres). |
Any other providers may be indicated at the User's request by writing to supporto@legaless.it. Data are processed within the European Economic Area; for transfers outside the EU/EEA, where necessary, the Controller adopts the safeguards provided for in arts. 44-49 GDPR (adequacy decisions, Standard Contractual Clauses, supplementary measures).
10. User rights
The User may exercise the following rights at any time, within the limits of the law:
– Access (art. 15 GDPR) – find out which data are processed and obtain a copy;
– Rectification (art. 16) – correct inaccurate data or complete them;
– Erasure / right to be forgotten (art. 17) – request removal of the data, within the limits provided;
– Restriction (art. 18) – temporarily restrict the processing;
– Portability (art. 20) – receive the data in a structured, commonly used, machine-readable format and transmit them to another controller;
– Objection (art. 21) – object to processing based on legitimate interest or for direct marketing;
– Withdrawal of consent (art. 7.3) – at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
– Complaint to the supervisory authority (art. 77) – in the Member State of habitual residence, place of work or place of the alleged infringement. In particular: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garante@gpdp.it, www.garanteprivacy.it; or the authority of the State where the Controller is established, Information and Data Protection Commissioner (IDPC), Malta, www.idpc.org.mt;
– Not to be subject to automated decisions (art. 22) – the Controller does not take automated decisions producing significant legal effects.
Exercising rights against independent controllers
For data processed by the Controller, requests should be sent to supporto@legaless.it. For data processed by the Lawyer (performance of the Mandate, AML, professional conduct), requests should be sent directly to the Lawyer, who provides their own privacy notice.
Legal limits (e.g. AML, tax and right-of-defence retention obligations) may lead to certain requests being refused or deferred, with reasons given for the outcome.
The Controller responds within 30 days of receipt, extendable by a further 60 in complex cases (art. 12 GDPR).
11. Cookies
The use of cookies and similar technologies is governed by the specific Cookie Policy available on legaless.it, drawn up in accordance with the Italian Data Protection Authority's Provision of 10 June 2021.
12. Legal defence
The User's data may be used by the Controller, even after the relationship has ended, to establish, exercise or defend a right in court, within the limits of art. 9.2.f GDPR and of legal obligations.
13. Changes to this notice
The Controller reserves the right to update this notice. Changes will be communicated to the User via the Account and/or email. The current version is always available at legaless.it/privacy-policy/.
14. Minors
The Platform is intended exclusively for adults. The Controller does not knowingly collect data from minors. If the processing of a minor's data is detected, the Controller will delete it, unless otherwise authorised by the holder of parental responsibility pursuant to art. 8 GDPR.
15. Data collected before 1 October 2026
Until 30 September 2026 the controller of the data collected through the Platform was the previous operator. With the transfer of the relationships with Users to Top Consulting Ltd., the related personal data are transferred to Top Consulting Ltd., which becomes their controller from the effective date of the transfer for the same purposes set out in this notice. The previous controller retains only the data necessary to fulfil its legal obligations and to protect its rights, for the time strictly necessary for that purpose.
For definitions (including capitalised terms) in this document, please refer to the T&C.
