Privacy Policy
Last updated: 28 October 2026
Introduction
This Privacy Policy explains how personal data is processed when you visit gangitechlaw.com (the "Website"), contact us through the Website, or use the AI assistant available on the Website. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
This Policy does not cover the processing of personal data in the course of a professional engagement. Clients receive a separate privacy notice when an engagement is signed.
Data controller
The data controller is Avv. Paolo Maria Gangi, practicing under the name Gangi Tech Law ("GTL", "we", "us" or "our"), lawyer registered with the Rome Bar Association.
Office: via G.G. Belli n. 39, 00193, Rome, Italy.
VAT number: 15655341004.
Email: info@gangitechlaw.com.
Personal data we process and why
The table below sets out, for each activity, the personal data we process, the purpose, the legal basis and how long we keep the data.
| Activity | Personal data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Browsing the Website | IP address, browser and device information, pages visited, date and time of access | Operating the Website, ensuring its security and preventing abuse | Our legitimate interest in the security and proper functioning of the Website (Article 6(1)(f) GDPR) | Technical logs are kept by our hosting provider for the period set by its systems and no longer than necessary for the security and proper functioning of the Website. We do not keep our own copies, except where strictly necessary to investigate a security incident and for the duration of that investigation. |
| Contact form and emails | First and last name, telephone number, email address, subject and content of your message and any information you choose to include | Answering your request and, where relevant, assessing a possible engagement, including a conflict of interest check | Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR); for requests unrelated to a possible engagement, our legitimate interest in answering them (Article 6(1)(f) GDPR) | 12 months from our last exchange if no engagement follows; if an engagement follows, the retention periods in the client privacy notice apply |
| AI Assistant | Your questions and the answers generated, technical data about the session | Answering general questions about GTL, its areas of practice and how to contact us; monitoring and improving the quality and security of the service | Our legitimate interest in providing information about our services in response to your questions (Article 6(1)(f) GDPR) | Our AI service provider deletes conversations within 30 days. The access logs of our server, which record IP address, date and time but not the content of conversations, are kept for up to 14 days. Conversations flagged by the AI provider's automated systems as a possible breach of its usage policies may be kept by that provider for up to 2 years. We keep conversations longer only where needed to investigate misuse of the service. |
| Legal obligations and defence of rights | Data from any of the activities above, as needed | Complying with legal obligations and establishing, exercising or defending legal claims | Legal obligation (Article 6(1)(c) GDPR) and our legitimate interest in defending our rights (Article 6(1)(f) GDPR) | For the time required by law or until the relevant limitation periods expire |
Providing your data through the contact form is voluntary. The fields marked as required are needed to answer your request; if you do not provide them, we will not be able to reply.
Please do not include in your messages, or in your questions to the AI Assistant, special categories of personal data (such as health data), data relating to criminal matters, or personal data of third parties that is not strictly needed. If you do, we will process that data only to the extent strictly necessary to handle your request, or delete it.
The AI Assistant
The AI Assistant is an automated system powered by artificial intelligence. It answers general questions about GTL and does not provide legal advice. Your conversation is sent, through a connection service that we operate on servers provided by Hetzner Online GmbH in the European Union, to our AI service provider, Anthropic Ireland, Limited, which provides the Claude family of AI models (the specific model in use may change over time). Both providers act as our processors under data processing agreements. Our connection service does not record the content of conversations. Under Anthropic's commercial terms, which govern our use of the service, Anthropic may not use your conversations to train its models.
The AI Assistant does not take any decision about you. No decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you is taken through the Website.
Cookies
The Website does not use analytics, profiling or advertising cookies, nor any other cookie or similar technology that requires your consent. The tools used on the Website are described below.
- Website platform. The Website is built and hosted on Webflow. In its current configuration, Webflow does not store cookies on your device, and we have not installed analytics, advertising or social media tracking tools.
- Cookie notice. On your first visit, a notice informs you that the Website uses only technical tools. When you close it, your browser's local storage keeps a record of this choice, so that the notice is not shown again. This information stays on your device and is not sent to us.
- AI Assistant. The AI Assistant does not store any information on your device. The conversation is kept only in the memory of the open page and is lost when you close or reload it.
- Fonts and technical components. To display the Website correctly, its fonts are served from Webflow's content delivery network and some scripts are loaded from the jsDelivr network and from Webflow's content delivery network. These requests do not set cookies, but your browser necessarily transmits your IP address to those servers.
- Newsletter. If you subscribe to the GuardrAIl newsletter through the form on the Website, the email address you enter is sent directly to Substack, Inc., which manages the subscription under its own terms and privacy policy.
- Domain. The domain gangitechlaw.com is registered with Aruba S.p.A., which acts only as the Website's domain registrar. Aruba does not place cookies on the Website and is not involved in delivering its pages.
Because the Website uses only technical tools that are strictly necessary for its operation, your consent is not required, in accordance with Article 122 of the Italian Personal Data Protection Code, which implements Article 5(3) of Directive 2002/58/EC, and with the Guidelines on cookies and other tracking tools adopted by the Italian Data Protection Authority on 10 June 2021. For transparency, a notice displayed on your first visit informs you of this. If we introduce cookies or tools that require your consent, we will update this section and ask for your consent before using them. You can in any case manage or delete cookies and stored data through your browser settings.
Who receives your data
Your personal data is accessed by the controller and, where necessary, by collaborators of GTL who are bound by professional secrecy or by confidentiality obligations. It may also be processed by the following service providers, acting as our processors under data processing agreements:
- Webflow, Inc., located in the USA, which hosts the Website and manages the contact form.
- Google Ireland Limited, located in Ireland, which provides our email and office services.
- Anthropic Ireland Limited, located in Ireland, which provides the AI models that power the AI Assistant.
- Hetzner Online GmbH, located in Germany, which provides the servers hosting the technical service that connects the AI Assistant to Anthropic.
- Aruba SPA, located in Italy, which hosts the general email info@gangitechlaw.com.
We may also disclose personal data to public authorities where required by law. We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
Transfers outside the European Economic Area
Some of our service providers are established in, or process data from, the United States. These transfers take place on the following bases:
- Webflow, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to it are covered by the adequacy decision adopted by the European Commission on 10 July 2023 under Article 45 of the GDPR. Its data processing agreement also includes the standard contractual clauses adopted by the European Commission, which would apply if that adequacy decision ceased to be in force.
- Anthropic Ireland, Limited and Google Ireland Limited are established in the European Union. Where data is processed by their affiliates or subprocessors in the United States, the transfer is governed by the standard contractual clauses included in their data processing terms (Article 46 of the GDPR). Google LLC is also certified under the EU-U.S. Data Privacy Framework.
When you visit the Website, your browser also connects directly to the networks that deliver its fonts and scripts (see the Cookies section), whose servers may be located outside the European Economic Area.
You can request a copy of the relevant safeguards by writing to info@gangitechlaw.com.
Security
We adopt appropriate technical and organizational measures to protect personal data against loss, misuse and unauthorized access, taking into account the nature of the data and the risks of the processing.
Your rights
Under Articles 15 to 22 of the GDPR, and within the limits set by law, you have the right to:
- access your personal data and receive a copy of it.
- have inaccurate data corrected and incomplete data completed.
- have your data erased.
- restrict the processing of your data.
- receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller, where the processing is based on a contract and carried out by automated means.
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest.
To exercise your rights, write to info@gangitechlaw.com. We will reply without undue delay and in any event within one month, which may be extended in the cases provided for by the GDPR.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place.
Minors
The Website is intended for professionals and businesses and is not directed at minors. We do not knowingly collect personal data of persons under 18.
Changes to this Policy
We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. Material changes will be highlighted on the Website.