Privacy Policy
How Galgano Legal collects, uses and protects personal data in connection with the website at galganolegal.com.
This policy concerns the website at galganolegal.com (the “website”). It does not cover the handling of personal data within a legal mandate. That is governed by the terms of engagement agreed with the client and by professional secrecy.
The firm processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and its ordinances. Where the EU General Data Protection Regulation (GDPR) applies — for example where services are offered to persons in the European Union — the firm also aims to meet its requirements.
Who is responsible
The controller responsible for the processing described in this policy is the practice trading as Galgano Legal.
| Registered office | Cassarate, 6900 Lugano |
|---|---|
| Company identification number | P.IVA 02549490379 |
| Data protection enquiries | contact@galganolegal.com |
Enquiries sent through the website
The contact page contains an enquiry form. It asks for your name, email address, the type of matter and a description of the matter, and optionally your telephone number and company. Both these details and the date of the enquiry are recorded in a database hosted for the firm. The firm's reference for the enquiry and the language of the website are recorded with them.
Each submission also records the browser's user agent string and a salted hash of your IP address. The form includes a hidden field and measures how long it took to complete, to detect automated submissions. The hash cannot readily be reversed to your address; it is used to limit repeated submissions from the same connection, to three within an hour. Enquiries are not passed to a third-party form service.
If you have already browsed the site and accepted cookies, the enquiry is also linked to the pages you read, so that the firm can see how you arrived and what you were interested in. If you did not accept cookies, no such link is made.
If the server component of the site is unavailable, the form cannot be submitted. It then shows a message directing you to the firm's email address and stores nothing.
Location and network information
When you send an enquiry, the firm records the country, region and city that your internet connection appears to be in, together with the name of the network operator that announced your connection and its time zone. This is derived from your IP address, which is not stored: the address itself is used to look up the information and then discarded, and only the result is kept.
The firm also checks whether the connection appears to come from a virtual private network, a proxy, an anonymising network or a hosting server rather than an ordinary access network. The check compares the name of the network operator against a list of known VPN, proxy and hosting operators. This is a routine precaution against fraudulent and automated enquiries and does not affect how your enquiry is handled.
The outcome of that check, and the location information above, are visible to the firm's administrators. A connection that looks anonymised is shown as such beside the enquiry. The check is a signal, not a conclusion: many people use a VPN for ordinary reasons, and a connection that looks ordinary is not thereby trustworthy.
The lookups described above are made against a database held on the firm's own server. No external service is asked to resolve your address, and it is not disclosed to any provider for that purpose.
On your first visit the site looks up the country your connection appears to be in, so that it can show you the Italian or the English edition. That result is kept for 30 days. Nothing else about the visit is recorded unless you accept cookies: if you do not, the only trace is that lookup, and it is deleted with the rest of the cache.
The visitor log
If you accept cookies, the site records a short first-party log of your visit: the pages you read, the page you arrived from, and the time of each visit. It is used to understand which parts of the site are useful and to see whether enquiries are coming from the public pages or from search engines. The log is held on the firm's own server and is not sent anywhere else. It contains no advertising identifier, is not shared with any third party, and is not used to build a profile of you across other websites.
The log records the same location and network information as an enquiry, and the browser you are using. The record of your visit — including the location and network details it holds — is deleted after 90 days. An enquiry you send is a business record and is kept on its own schedule, with its own copy of those details.
The site also looks at each enquiry for signs that it was sent by a machine rather than a person: how long the form took to fill in, how many links the message contains, and whether the text contains something a browser would act on. Where one of these is present, the enquiry is marked so that it is read with care. It is never used to refuse an enquiry, and an enquiry is never discarded on the strength of it.
How enquiries are handled
The firm reads enquiries in a password-protected administration area, to which only authorised administrators can sign in. Access relies on a session cookie named “gl_admin”, which is set only when an administrator signs in. It is not accessible to scripts in the browser and ends when the administrator signs out or the session expires. A notification may be sent by email to an address chosen in the administration area.
Administrators can also download enquiries as a spreadsheet. Administrators are bound by professional secrecy.
Please do not send confidential documents
An enquiry does not itself create a lawyer–client relationship. That arises only once the firm has confirmed the engagement, as described in the Legal Notice. Do not send confidential documents or sensitive information through the form. The firm will tell you how to share documents once an engagement is in place.
Technical data and server logs
The server that delivers the website records technical data about each request, normally including the IP address of the device making it, the date and time, the page requested, the referring page, the browser and operating system, and the outcome of the request. These records are used to keep the website available and secure, to detect misuse and to investigate incidents.
Cookies and similar storage
The site sets a cookie called “gl-detected” when you first arrive, because it cannot choose the language of a page without one. It holds the language that was worked out for you, so that the country of your connection is looked up once rather than on every page. It is set again a month later, when the decision is taken anew. If you use the language control at the top of the page, a second cookie, “gl-pref”, holds the language you chose, for a year. Each holds a two-letter language code and nothing else, neither is sent to anyone else, and neither is used to identify you on any other website.
Beyond those, the pages you visit set no cookies unless you accept them. For visitors who accept cookies, the site stores a single entry in the browser's local storage, under the key “gl-cookie-consent”, recording whether you chose “Accept all” or “Essential only” on the cookie banner. The entry remains on your device until you clear it, and it is not sent to the firm.
The site also sets one cookie, named “gl_vid”, when you accept cookies. It holds a random identifier that links the pages you read to one another and, if you later send an enquiry, to that enquiry. It contains no information about you, cannot be read by scripts on the page, and is removed after twelve months. It is not used to identify you on any other website.
The session cookie “gl_admin” is set for signed-in administrators only. The Cookie Policy sets out the details.
Purposes and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Enquiry details and correspondence | To read and answer your enquiry, to check for conflicts of interest and to take steps towards a possible mandate | Your consent, which you give on the form, and the firm's legitimate interest in answering enquiries (FADP; Art. 6(1)(a) and (f) GDPR) |
| Salted IP hash and time of submission | To protect the form from repeated automated submissions | The firm's legitimate interest in securing the website (FADP; Art. 6(1)(f) GDPR) |
| Location and network operator, derived from the IP address | To identify the jurisdiction the enquiry comes from, to carry out conflict checks, and to recognise fraudulent or automated enquiries | The firm's legitimate interest in assessing the reliability of enquiries and in taking steps towards a possible mandate (FADP; Art. 6(1)(f) GDPR), and where the GDPR applies its equivalent in Art. 6(1)(b) |
| Assessment of whether the connection is anonymised | To recognise fraudulent, automated and unsolicited enquiries | The firm's legitimate interest in securing the website and in taking steps towards a possible mandate (FADP; Art. 6(1)(f) GDPR) |
| Indicators that an enquiry was sent by a machine | To recognise automated and fraudulent enquiries, and to have them read with care | The firm's legitimate interest in securing the website and in taking steps towards a possible mandate (FADP; Art. 6(1)(f) GDPR) |
| Visitor log: pages read, referring page, time of visit, browser | To understand how the website is used and to improve it | Your consent, given on the cookie banner (FADP; Art. 6(1)(a) GDPR) |
| Server log data | To deliver the website, keep it available, detect and prevent misuse and investigate incidents | The firm's legitimate interest in operating a secure website (FADP; Art. 6(1)(f) GDPR) |
| Local storage entry recording your cookie choice | To remember your choice, so that you are not asked again | Storage necessary to provide the service you requested |
| Cookies “gl-pref” and “gl-detected”, holding a language code | To show the site in the language you chose, or in the one that was worked out for you when you arrived, so that the country of your connection is looked up once | Storage necessary to provide the service you requested |
| Cookie “gl_vid”, holding a random identifier | To link the pages you read to one another and to an enquiry you later send | Your consent, given on the cookie banner (FADP; Art. 6(1)(a) GDPR) |
| Administrator session cookie (“gl_admin”) | To keep an administrator signed in and to restrict access to the administration area to that administrator | The firm's legitimate interest in protecting the administration area (FADP; Art. 6(1)(f) GDPR) |
Where the firm relies on legitimate interests, it weighs those interests against your interests and fundamental rights. Consent may be withdrawn at any time with effect for the future; see Withdrawing consent.
Analytics
The website measures its own use with a first-party log held on the firm's server, as described above. It runs only after you have accepted cookies, and nothing is sent to a third-party analytics service. The site loads no third-party scripts, no advertising identifiers and no embedded content from other domains.
If the firm later adds an external analytics or advertising tool, this section and the Cookie Policy will be updated before it is enabled.
Who receives data
Enquiries are stored on the firm's hosting account. The firm does not sell personal data. It shares data only where necessary for the purposes above, where you have asked it to, or where the law requires it.
| Location lookup | The country, city and network operator are resolved against a database held on the firm's own server. No provider receives your IP address for this purpose. |
|---|---|
| Professional advisers, courts and authorities | Where a matter requires it, the firm may share data with notaries, courts, authorities, opposing parties or their representatives, insurers and other advisers. This arises from the mandate rather than from the website. |
Where a provider processes data on the firm's behalf, the firm aims to have a written agreement in place requiring it to act only on instructions and to protect the data adequately.
International transfers
Depending on where the firm's hosting and email services are established, data may be stored or processed outside Switzerland or the European Economic Area. Where it is transferred to a country without an adequate standard of data protection, the firm aims to rely on safeguards recognised under Swiss law or, where applicable, on a statutory derogation.
Retention
| Enquiry that does not lead to a mandate | Kept as a business record, and deleted when the firm's rules on conflict-of-interest checks and limitation periods allow. The website does not delete enquiries by itself: one is removed only deliberately, by somebody with access to the administration area. |
|---|---|
| Server logs | One month, after which they are deleted or anonymised, unless a longer period is needed to investigate an incident. |
| Cookie choice | Remains on your device until you choose again or clear your browser data. |
| Visitor log | 90 days since the last visit, after which the record of the visit, including the location and network details it holds, is deleted, unless a longer period is needed to investigate an incident or to defend against a claim. |
| Location lookups | Cached against a salted hash of the address for 30 days, then the cache entry is deleted. |
| Mandate records | Where an enquiry leads to a mandate, records are kept as professional and statutory rules require, outside the scope of this website policy. |
Your rights
Under the FADP and, where it applies, the GDPR, and subject to the conditions and exceptions in that law, you have the right to access the personal data held about you and to have inaccurate data corrected. You may also ask for data to be deleted or for its processing to be restricted, object to processing based on legitimate interests, and withdraw consent. Where the GDPR applies, you also have a right to data portability.
The FADP allows these rights to be restricted in defined circumstances. For example, access may be refused where it would disclose a matter covered by a lawyer's professional secrecy or would impair the rights of another person. Where a request is refused, the firm explains the ground so far as it is permitted to do so.
How to exercise your rights
Write to contact@galganolegal.com, or send a letter to the firm's registered office, given at the top of this policy. To protect your data, the firm may ask you to prove your identity before acting on a request. Requests are answered within the period set by the applicable law.
Withdrawing consent
Each enquiry is sent on the consent you give on the form. You may withdraw that consent at any time by writing to contact@galganolegal.com. Withdrawal applies for the future: it does not affect processing that has already taken place, and it may not end processing the firm must continue where the law requires it. To withdraw your cookie choice, see the Cookie Policy.
Complaints
You may complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Where the GDPR applies, you may complain to the supervisory authority of the EU member state in which you live, work or where the alleged infringement occurred.
Changes to this policy
This policy is reviewed when the website or the providers behind it change, or when the law changes. The version published on this page applies from the date it is published.
This policy forms part of the information about the website, together with the Cookie Policy and the Legal Notice. Questions may be sent through the contact page.