Privacy Policy

1. Introduction and scope

1. This Privacy Policy explains how [LEGAL ENTITY NAME], trading as "lotivano" (the "Firm", "we", "us", "our"), may collect and use personal information in connection with its website at [WEBSITE DOMAIN] (the "Website") and related communications.
2. This Policy focuses on personal information processed through the Website and during initial contact. Where the Firm is engaged to provide legal services, additional or different information-handling terms may apply under the relevant Engagement Agreement and the professional rules that bind the Firm.
3. We aim to reflect recognised data-protection principles — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. The precise rules that apply depend on the [JURISDICTION] and must be confirmed.

2. Who is responsible for your information

1. The controller responsible for your personal information is [LEGAL ENTITY NAME], of [REGISTERED ADDRESS], registered as [REGISTRATION / COMPANY NUMBER].
2. [IF APPLICABLE: The Firm has appointed a data protection officer / privacy contact, who can be reached at [DPO CONTACT]. If no such person is appointed, remove this clause rather than naming one.]
3. For general privacy queries, use the contact details in section 20.

3. Definitions

"Personal data" / "personal information"

information relating to an identified or identifiable natural person.

"Processing"

any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.

"Special category data"

personal data of a particularly sensitive nature that may attract additional protection under Applicable Law.

"Applicable Law"

the data-protection and privacy laws applicable to the Firm in the relevant [JURISDICTION].

4. Categories of personal data we may process

Depending on how you interact with us, we may process:

• Contact and identity details you provide, such as your name, email address, telephone number, and organisation.
• Inquiry information — the content of messages you send, including any details you choose to share about a potential matter.
• Correspondence — records of communications between you and the Firm.
• Technical information that may be generated automatically when you visit the Website, which may include your IP address and basic device or browser information, to the extent collected by the hosting environment. The specific technical data collected depends on the hosting configuration and must be confirmed: [HOSTING / SERVER LOG DETAILS].

We ask that you do not send special category data or confidential information through the Website before we have confirmed we can consider your matter and advised you how to communicate securely (see the Website Terms of Use). If you choose to provide such information, we will handle it in accordance with this Policy and Applicable Law.

5. How we collect personal data

1. Directly from you — when you contact us by email, complete an inquiry, or otherwise correspond with the Firm.
2. Automatically — limited technical information may be generated by the hosting environment when you visit the Website, as described in section 4. By default, the Website is built without analytics or tracking technologies (see section 16).
3. From third parties — where relevant to a prospective engagement, and only where permitted by Applicable Law, we may receive information from third parties such as those assisting with identity verification. Any such sources must be confirmed: [THIRD-PARTY SOURCES, IF ANY].

6. Purposes of processing

We may process personal data to:

• respond to your inquiry and decide whether we are able to consider your matter;
• carry out conflict checks and, where relevant, client identification and anti-money-laundering checks;
• communicate with you and manage our correspondence;
• operate, maintain, and secure the Website;
• comply with our legal, regulatory, and professional obligations; and
• establish, exercise, or defend legal claims where necessary.

We will not use your personal data for a new, incompatible purpose without providing further information and, where required, a lawful basis. Where we rely on a purpose that is compatible with the original purpose for which the data was collected, we will ensure that use remains fair and within your reasonable expectations.

7. Potential lawful bases

1. Where Applicable Law requires a lawful basis for processing, we expect to rely, as relevant, on one or more of the following, to be confirmed for the applicable regime:

• Steps prior to a contract / performance of a contract — to respond to your inquiry and take steps toward a possible engagement.
• Legitimate interests — to operate and secure the Website and to manage our correspondence, where not overridden by your interests and rights.
• Legal obligation — to comply with obligations such as conflict checks, record-keeping, and anti-money-laundering requirements.
• Consent — where we ask for it for a specific purpose; you may withdraw consent at any time without affecting prior processing.

Processing of any special category data requires an additional condition under Applicable Law, which must be identified before such data is processed: [SPECIAL CATEGORY CONDITION, IF RELEVANT].

8. Confidentiality and privilege

1. The Firm is subject to professional duties of confidentiality. Where an attorney–client relationship exists, communications may also be protected by legal professional privilege under Applicable Law.
2. These protections are distinct from, and additional to, data-protection rights. The Firm will not disclose privileged or confidential client information except as permitted or required by its professional obligations and Applicable Law, as further described in our Compliance and Law Enforcement Requests Policy.
3. Before an attorney–client relationship is formed, information you send may not attract these protections. Please follow the cautions in the Website Terms of Use.

9. Recipients and disclosure

1. We may share personal data, where necessary and lawful, with: our personnel on a need-to-know basis; service providers who support the Website or the Firm's operations under appropriate confidentiality and data-protection terms; professional advisers and insurers; and courts, regulators, or authorities where required.
2. The identity and role of any service providers, hosting provider, and other processors must be confirmed and listed before publication: [RECIPIENTS / PROCESSORS]. Do not list vendors that are not actually used.
3. We do not sell personal data. Any disclosure to authorities is handled in accordance with section 8 and our Compliance and Law Enforcement Requests Policy.

10. International transfers

1. If personal data is transferred to, or accessed from, a country other than the one in which it was collected, Applicable Law may require appropriate safeguards for that transfer.
2. Whether any such transfer occurs depends on the Firm's hosting and service arrangements, which must be confirmed. Any transfer mechanism or safeguard relied upon (for example, an adequacy decision or standard contractual clauses) must be identified before publication: [TRANSFER MECHANISM / SAFEGUARDS, IF ANY]. Do not assert safeguards that are not in place.

11. Retention

1. We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, professional, accounting, or reporting requirements, and to establish or defend legal claims.
2. Retention periods vary by the type of data and the applicable obligations. Specific periods and the criteria used to set them must be determined and stated before publication: [RETENTION PERIODS / CRITERIA]. Do not state a retention period that has not been decided.
3. When personal data is no longer required, we will delete or anonymise it in accordance with Applicable Law and our records policy.

12. Security

1. We take reasonable technical and organisational measures intended to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. The specific measures depend on the Firm's systems and must be confirmed: [SECURITY MEASURES SUMMARY].
2. No method of transmission or storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security, and any transmission is at your own risk.
3. Where Applicable Law requires, we will notify the relevant authority and affected individuals of a personal data breach within the applicable timeframes.
4. We limit access to personal data to those who need it for the purposes described in this Policy, and we expect any service provider that processes personal data on our behalf to act only on our instructions and to apply appropriate safeguards under a written arrangement, as required by Applicable Law.
5. You also have a role in security: please send information to us through appropriate channels, avoid including sensitive detail in an initial message, and follow any instructions we give about how to communicate securely once we are in contact.

13. Your rights

Subject to Applicable Law and to the Firm's professional and legal obligations, you may have some or all of the following rights:

• to be informed about how your personal data is used;
• to access the personal data we hold about you;
• to request correction of inaccurate or incomplete data;
• to request erasure in certain circumstances;
• to restrict or object to certain processing;
• to data portability in certain circumstances; and
• to withdraw consent where processing is based on consent.

1. Some rights are qualified. For example, they may not apply where the information is subject to legal professional privilege, where retention is required by law, or where complying would adversely affect the rights of others.
2. To exercise a right, contact us using the details in section 20. We may need to verify your identity and will respond within the period required by Applicable Law.
3. Exercising a right is free of charge in most cases. Where a request is manifestly unfounded or excessive, Applicable Law may permit us to charge a reasonable fee or to decline to act; if so, we will explain our reasons and any right you have to complain.

14. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing through the Website. If this changes, we will update this Policy and provide the information required by Applicable Law.

15. Children

The Website is intended for adults and is not directed at children. We do not knowingly collect personal data from children through the Website. If you believe a child has provided personal data, please contact us so we can take appropriate action.

16. Cookies and similar technologies

1. By default, this Website is built without analytics cookies, tracking technologies, or third-party embeds, and assets are self-hosted where feasible. Strictly necessary technical data may still be processed by the hosting environment to deliver the Website.
2. If cookies or similar technologies are introduced in future (for example, if analytics or embedded media are added), this section must be updated and, where Applicable Law requires, a compliant consent mechanism must be provided before those technologies are used: [COOKIE DETAILS, IF ANY].
3. You can usually control cookies through your browser settings. Blocking strictly necessary items may affect how the Website functions.

17. Third-party links

The Website may link to third-party sites. We are not responsible for the privacy practices of those sites. Please review their privacy notices before providing personal data to them.

18. Complaints

1. If you have a concern about how we handle your personal data, please contact us first using the details in section 20 so we can try to resolve it.
2. You may also have the right to lodge a complaint with the relevant supervisory authority in your [JURISDICTION]. The competent authority and its contact details must be confirmed before publication: [SUPERVISORY AUTHORITY / REGULATOR]. Exercising this right does not affect any other legal remedy available to you.

19. Changes to this policy

We may update this Policy from time to time. The current version will be posted on this page with an updated effective date. Where changes are significant, we will take reasonable steps to bring them to your attention where Applicable Law requires.

20. How to contact us

For privacy questions or to exercise your rights, contact privacy@lotivano.example or write to [LEGAL ENTITY NAME AND ADDRESS]. Please do not include sensitive or confidential information in an initial message.