Legal
Privacy Policy
Version 2 · Effective: October 15, 2026
This Privacy Policy explains how Ferrante, PLLC (“Ferrante,” “the firm,” “we,” “us” or “our”) collects, uses, shares, protects and retains personal information, and the rights you have over it. It is written to meet the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the Italian Personal Data Protection Code (Decreto legislativo 30 giugno 2003, n. 196, as amended, the “Italian Privacy Code”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), the California Online Privacy Protection Act, the other U.S. state privacy laws that may apply, and New York law, including the professional rules that govern lawyers in New York and in Italy.
1. Summary
- We use personal information to answer inquiries, check for conflicts of interest, provide legal services, meet our legal and professional obligations, run our website and, with your agreement, keep in touch.
- Information about clients and their matters is protected by attorney-client confidentiality and professional secrecy, in addition to data protection law.
- We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to make decisions about you by automated means alone.
- Our website uses only technologies that are strictly necessary for it to work. Any optional cookie runs only with your consent, as explained in our Cookie Policy.
- You can access, correct or delete your information, and exercise the other rights described below, by writing to info@ferrantelawfirm.com.
2. Who we are and how to contact us
Ferrante, PLLC is a law firm with offices in New York, Milan and Rome.
- New York (principal office): 5 West 19th Street, 10th Floor, New York, NY 10011, United States. Phone +1 (212) 308-4440.
- Milan: Via Manzoni 42, 20121 Milan, Italy.
- Rome: Via Leonida Bissolati 54, 00187 Rome, Italy.
- Privacy requests and questions: info@ferrantelawfirm.com, with “Privacy request” in the subject line.
Data controller. Ferrante, PLLC operates this website and is responsible for the processing described in this policy. For information handled by our offices in Italy, write to info@ferrantelawfirm.com and we will tell you which entity acts as controller.
3. Scope of this policy
This policy applies to personal information we process in connection with:
- our website, ferrantelawfirm.com, and the communications you send us through the contact details it shows;
- inquiries from prospective clients and the checks we carry out before accepting a new matter;
- the legal services we provide to our clients, including information about individuals connected with a matter, such as family members, employees, directors, shareholders, beneficial owners, counterparties, witnesses and other parties;
- our events, firm updates, business development and relationships with other professionals;
- our suppliers, service providers and their representatives;
- job and internship applications (see section 20).
It does not apply to our own staff, who receive a separate notice. When we act for a client, the terms of our engagement letter and our professional duties also apply; if they conflict with this policy, the stricter protection for your information prevails.
4. Professional secrecy and confidentiality
Lawyers are bound by duties of confidentiality that go beyond data protection law. Our New York lawyers are bound by the New York Rules of Professional Conduct, including Rule 1.6 on confidentiality of information, which can extend to the identity of our clients, and Rule 1.18, which protects information a prospective client shares once we have agreed to discuss a possible engagement. Our lawyers admitted in Italy are bound by professional secrecy under Italian law and the Italian Code of Conduct for Lawyers (Codice deontologico forense). We never disclose client information or the existence of a client relationship except as permitted by these rules, with the client’s consent, or as required by law.
Attorney-client privilege and professional secrecy may limit some of the rights described in this policy. For example, under Article 2-undecies(1)(e) of the Italian Privacy Code, rights may be restricted where exercising them could cause actual and concrete prejudice to defensive investigations or to the exercise of a right in court. If we restrict a request for this reason, we will tell you, unless doing so would itself cause that prejudice. In that case you may exercise your rights through the Garante under Article 160 of the Italian Privacy Code.
5. Personal information we collect
Depending on how you interact with us, we may collect the following categories of personal information:
- Identity and contact details: name, title, company, role, postal address, email address, telephone numbers.
- Inquiry and matter information: the content of your inquiry, the facts and documents of the matter, correspondence, notes of meetings and calls, and information about other parties involved.
- Identification and due diligence: date and place of birth, nationality, identity documents, tax identification numbers, information about beneficial owners, and the information we need to check conflicts of interest and, where the law requires it, to verify a client’s identity and the purpose of the engagement under anti-money laundering rules.
- Immigration matters: passport and visa details, immigration and travel history, education and employment history, family relationships, financial information, and other information required by the authorities to which an application is submitted.
- Corporate, real estate, employment and intellectual property matters: information about shareholders, directors, officers, employees, landlords, tenants, licensees and counterparties, as the matter requires.
- Billing and payment information: invoicing details, bank details, payment records.
- Professional relationships: information about other professionals involved in a matter, and their contact details.
- Events and updates: registration details, dietary or access requirements you choose to share, attendance, and your preferences for firm updates.
- Website technical information: IP address, browser and device type, operating system, pages requested, referring page, date and time of the request, recorded in the server logs of our hosting provider.
- Choices stored in your browser: your cookie preferences and, if you use them, your accessibility settings (see the Cookie Policy).
- Sensitive information, only where a matter requires it (see section 8).
Providing personal information is voluntary, but if you do not provide what a matter requires, we may be unable to answer your inquiry, accept the engagement, meet our legal obligations or provide the services you request.
6. Where we obtain it
- directly from you, when you contact us, meet us, engage us or attend our events;
- from our clients, about individuals connected with their matters;
- from other parties to a matter and their advisers, and from courts, government agencies and consulates;
- from public sources, such as company registers, land registers, court records, professional directories, press and professional networking sites;
- from people who refer you to us, and from other professionals we work with;
- from service providers that help us verify identity or carry out checks required by law;
- automatically, from your browser, when you visit our website.
When we receive information about you from someone else, for example from a family member or employer in an immigration matter, this policy is our notice to you under Article 14 GDPR. We do not notify you separately where the information must remain confidential under professional secrecy (Art. 14(5)(d)) or where notifying you would be impossible or involve disproportionate effort (Art. 14(5)(b)).
7. How we use personal information and our legal bases
We use personal information only for the purposes below. Where the GDPR applies, each purpose relies on the legal basis shown.
| Purpose | Examples | Legal basis under the GDPR |
|---|---|---|
| Answering inquiries and taking on new matters | Replying to you, scheduling meetings, assessing whether we can act, checking conflicts of interest | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in answering inquiries and avoiding conflicts (Art. 6(1)(f)); compliance with professional obligations (Art. 6(1)(c)) |
| Providing legal services | Advising, drafting, negotiating, preparing and filing applications, representing clients before authorities and courts | Performance of our contract with the client (Art. 6(1)(b)); for individuals connected with a matter who are not our clients, our and our client’s legitimate interest in the proper handling of the matter (Art. 6(1)(f)) |
| Legal and regulatory obligations | Identity verification and record-keeping under anti-money laundering law where applicable, tax and accounting records, responding to lawful requests from authorities, professional record-keeping | Compliance with legal obligations (Art. 6(1)(c)) |
| Billing and firm administration | Invoicing, collecting payments, managing our accounts and relationships with suppliers | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Firm updates and events | Sending legal updates and invitations, organizing events | Your consent (Art. 6(1)(a)); for existing clients, our legitimate interest in keeping them informed about similar services, within the limits of Article 130(4) of the Italian Privacy Code (Art. 6(1)(f)) |
| Running and securing our website | Delivering pages, preventing misuse, diagnosing errors, remembering your choices | Our legitimate interest in a secure, working website (Art. 6(1)(f)); for optional cookies, your consent (Art. 6(1)(a)) |
| Protecting rights and handling claims | Establishing, exercising or defending legal claims, including our own; dealing with complaints | Legitimate interests (Art. 6(1)(f)); legal obligations (Art. 6(1)(c)) |
| Business operations | Quality control, insurance, audits, IT management, and any reorganization or transfer of the firm | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that assessment and object at any time (section 15). Where we rely on consent, you can withdraw it at any time, without affecting what we did before.
8. Sensitive information
Some matters, especially immigration matters, require special categories of personal information under Article 9 GDPR (for example health information from medical examinations, or information revealing racial or ethnic origin or religious beliefs) and information about criminal convictions and offences under Article 10 GDPR (for example the criminal history questions in a visa application). We process this information only when a matter requires it and only:
- with your explicit consent (Art. 9(2)(a));
- where it is necessary for the establishment, exercise or defence of legal claims (Art. 9(2)(f)); or
- where another condition of Article 9 applies;
and, for criminal records information, as permitted by Article 10 GDPR and Article 2-octies of the Italian Privacy Code. Access to this information is designed to be limited to the people working on the matter.
9. Firm updates and events
We send legal updates and event invitations only to people who have asked for them or agreed to receive them, and to clients about services similar to those they already use, as Article 130 of the Italian Privacy Code allows. Every email update will identify the firm and include our postal address and a link to unsubscribe, and you can also write to info@ferrantelawfirm.com. We will honor unsubscribe requests within 10 business days, as the U.S. CAN-SPAM Act requires, and keep a record of them so that we do not contact you again. We never sell or rent our contact lists.
10. Cookies and similar technologies
Our website uses only technologies that are strictly necessary for it to work and to remember the choices you make. Optional cookies, such as analytics or advertising cookies, are used only after you give consent through our cookie banner, and only for the categories you accept. You can change your choice at any time from “Cookie settings” at the bottom of every page. Our Cookie Policy lists every technology in use, its purpose and its duration.
Do Not Track and Global Privacy Control. Our website does not track visitors across third-party websites over time, and does not allow third parties to collect information about your online activities through it. We treat a Global Privacy Control signal sent by your browser as a refusal of optional cookies and as a request to opt out of any sale or sharing of personal information. Because there is no common standard for “Do Not Track” signals, we do not respond to them separately; with no tracking on our website, the outcome is the same.
11. Who we share personal information with
We share personal information only as needed for the purposes in section 7, under confidentiality, and in line with our professional duties:
- Our offices in New York, Milan and Rome, when they work together on an inquiry or a matter;
- our network of affiliates and others involved in a matter at the client’s request, with the client’s agreement where required;
- government agencies, consulates, courts and registries, when we file applications or documents on a client’s behalf, including U.S. immigration authorities and the U.S. Department of State, and Italian authorities and courts;
- other parties to a matter and their advisers, as the matter requires;
- service providers acting on our instructions, such as providers of IT, hosting, email and cloud services, document management, video conferencing, electronic signature, payment and accounting services, under contracts that require them to protect the information and use it only to serve us;
- our professional advisers, auditors and insurers;
- regulators, bar authorities and law enforcement, when required by law, regulation or a binding order;
- a successor or acquirer, in the event of a merger, reorganization or transfer of all or part of the firm, under confidentiality;
- anyone else, with your consent.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not disclose it to third parties for their own direct marketing.
12. International transfers
Because we work across the United States and Italy, and some of our service providers operate in other countries, personal information may be transferred outside the European Economic Area, in particular to the United States. When personal information protected by the GDPR is transferred to a country that the European Commission has not recognized as providing an adequate level of protection, we use one of the safeguards the GDPR provides:
- the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, when the recipient is certified under it;
- standard contractual clauses approved by the European Commission, with additional measures where needed;
- where no other safeguard applies, the derogations in Article 49 GDPR, for example where the transfer is necessary to perform a contract with you or in your interest, such as filing an application with U.S. authorities on your behalf, or to establish, exercise or defend legal claims.
You can ask us for information about the safeguard that applies to your information and, where applicable, for a copy of it.
13. How long we keep personal information
We keep personal information only as long as needed for the purpose for which it was collected, and then for the period the law, our professional rules or the limitation periods for possible claims require. After that, we delete it or anonymize it.
| Information | How long we keep it |
|---|---|
| Inquiries that do not lead to an engagement | As long as needed to answer you and to keep a record of our conflict check, and then we delete it |
| Client files | For the duration of the engagement and afterwards for the period required by the professional rules and laws that apply to the matter, and as long as needed to establish, exercise or defend legal claims. Original documents of lasting value, such as wills and deeds, are returned to the client or kept safely as the professional rules require |
| Accounting and billing records | At least seven years, as required for New York law firms by Rule 1.15(d) of the New York Rules of Professional Conduct, and for the period required by Italian tax and accounting law where applicable |
| Anti-money laundering records | Where Italian anti-money laundering law applies, ten years from the end of the professional relationship (Decreto legislativo 21 novembre 2007, n. 231) |
| Firm updates and events | Until you unsubscribe or withdraw consent. We keep the unsubscribe record so we do not contact you again |
| Website server logs | For the limited period set by our hosting provider’s log rotation |
| Choices stored in your browser | Cookie choice: valid for 12 months, then replaced when you choose again. Accessibility settings: until you reset them. Both stay on your device and are never sent to us |
| Job applications | For the duration of the selection process and, with your consent, longer to consider you for future openings |
14. Security and data breaches
We maintain administrative, technical and physical safeguards designed to protect personal information, as required by New York General Business Law, Section 899-bb (part of the New York SHIELD Act), and Article 32 GDPR. These measures are designed to include access limited to the people who need it, confidentiality obligations for everyone at the firm, encrypted connections to our website, and contracts that require our service providers to protect the information.
No method of transmission or storage is completely secure. Email in particular is not a secure channel: please do not send confidential information until we have confirmed in writing that we can represent you.
If a personal data breach occurs, we notify the competent supervisory authority within 72 hours where Article 33 GDPR requires it, and the people affected without undue delay where Article 34 GDPR requires it. For New York residents, we give notice as required by New York General Business Law, Section 899-aa, within 30 days of discovering a breach, and notify the New York Attorney General, the Department of State, the Division of State Police and, where applicable, the Department of Financial Services.
15. Your rights in the European Union and in Italy
If the GDPR applies to the processing of your personal information, you have the right to:
- access your personal information and receive a copy (Art. 15);
- have inaccurate information corrected and incomplete information completed (Art. 16);
- have your information erased, where the law allows (Art. 17);
- restrict our use of it in certain cases (Art. 18);
- receive information you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller, where the processing is based on consent or contract and carried out by automated means (Art. 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to any use of your information for direct marketing (Art. 21);
- withdraw your consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3));
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Art. 22). We do not make such decisions.
We answer within one month of receiving your request. Where a request is complex or we receive many, we may extend this by two further months and will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive. We may ask you for information to confirm your identity. Rights may be limited by law, including by our duties of professional secrecy and by Article 2-undecies of the Italian Privacy Code (section 4). Under Article 2-terdecies of the Italian Privacy Code, the rights of a deceased person may be exercised by anyone who has an interest of their own, acts to protect the deceased person as their agent, or acts for family reasons worthy of protection, unless the law prohibits it or, for information society services, the deceased person prohibited it in a written statement given to us.
Complaints. You have the right to lodge a complaint with the supervisory authority of the EU Member State where you live, work or where an alleged infringement took place. In Italy, the authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy; www.garanteprivacy.it; certified email (PEC) protocollo@pec.gpdp.it. We would appreciate the chance to address your concern first.
16. Additional information for California residents
This section applies to California residents to the extent the CCPA applies to us, and supplements the rest of this policy. It describes our practices in the 12 months before the effective date above and serves as our notice at collection.
| Category (CCPA) | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, postal and email address, phone number, IP address, government identifiers such as passport number | Service providers; government agencies, consulates and courts; other parties to a matter and their advisers; our affiliates |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Signature, bank and payment details, education and employment history, as a matter requires | Service providers; government agencies; our affiliates |
| Characteristics of protected classifications | Age, citizenship, national origin, marital status, as a matter requires (for example in immigration matters) | Government agencies, consulates and courts; our affiliates |
| Commercial information | Records of services provided and payments | Service providers; our professional advisers and auditors |
| Internet or network activity | Website server logs | Our hosting provider |
| Professional or employment-related information | Job title, employer, employment history | Government agencies; other parties to a matter; our affiliates |
| Education information | Degrees, transcripts, as an immigration matter requires | Government agencies and consulates |
| Sensitive personal information | Passport and other government identifiers, citizenship or immigration status, health information, as a matter requires | Government agencies, consulates and courts, as the matter requires |
| Inferences | None | Not applicable |
- Sources: the sources listed in section 6.
- Purposes: the business and commercial purposes listed in section 7.
- Sale and sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
- Sensitive personal information: we use it only for the purposes permitted by Section 7027(m) of the CCPA regulations, such as providing the services you request, and not to infer characteristics about you.
- Retention: as described in section 13.
Your rights. You have the right to know what personal information we have collected about you, its sources, purposes and recipients, and to receive a copy in a portable format; to request deletion; to request correction of inaccurate information; to opt out of any sale or sharing; to limit the use of sensitive personal information beyond permitted purposes; and not to be discriminated against for exercising these rights.
How to exercise them. Email info@ferrantelawfirm.com with “California privacy request” in the subject line, call +1 (212) 308-4440, or write to the address in section 2. We confirm receipt within 10 business days and respond within 45 calendar days, which we may extend by a further 45 days with notice. We act on requests to opt out or to limit the use of sensitive personal information within 15 business days. We verify your identity by matching information you provide with information we hold, to a degree that reflects the sensitivity of the request. You may use an authorized agent, who must provide your signed permission; we may still ask you to verify your identity directly. Our professional duties of confidentiality may prevent us from deleting or disclosing some information; if so, we will explain why.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).
17. Residents of other U.S. states
Several U.S. states, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, give their residents privacy rights similar to those above, such as the rights to access, correct, delete and obtain a copy of personal information and to opt out of targeted advertising, sale and profiling. Where one of these laws applies to us, you may exercise these rights as described in section 16. If we decline your request, you may appeal by replying to our decision with “Appeal” in the subject line; we will respond within the time your state’s law sets and, if we deny the appeal, tell you how to contact your state Attorney General.
18. New York
New York residents are protected by the New York SHIELD Act, which requires reasonable safeguards for private information and notice of security breaches (section 14), and by the confidentiality rules that govern our lawyers (section 4).
19. Children
Our website is not directed to children, and we do not knowingly collect personal information online from children under 13 (or under 14 in Italy, under Article 2-quinquies of the Italian Privacy Code) without the consent of a parent or guardian. When a matter involves a minor, for example a family-based immigration application, we receive the minor’s information from a parent or legal guardian and process it only for that matter. If you believe we have collected a child’s information without proper consent, contact us and we will delete it, unless the law or a pending matter requires us to keep it.
20. Job applicants
If you apply to work with us, we use your application, CV and references to assess your candidacy, on the basis of steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in recruiting (Art. 6(1)(f)). Only the people involved in recruiting see it. We keep it for the period in section 13 and, with your consent, longer to consider you for future openings.
21. Other provisions
Links and social media. Our website links to other websites, such as LinkedIn. Their own privacy policies apply when you visit them, and we are not responsible for their practices.
Accuracy. Please help us keep your information accurate by telling us about changes.
Languages. If this policy is published in other languages and there is a difference, the English version prevails, unless local law requires otherwise.
22. Changes to this policy
We review this policy at least once a year and update it before we change how we collect or use personal information. The version and effective date at the top show the latest update. If a change materially affects how we use information we already hold, we will tell you before it applies and, where the law requires, ask for your consent.
- Version 2, October 2026. Replaces the Privacy Policy and GDPR Addendum.
- Version 1, October 14, 2026. First published.
23. Contact
For any question about this policy or to exercise your rights: info@ferrantelawfirm.com, +1 (212) 308-4440, or by mail to Ferrante, PLLC, 5 West 19th Street, 10th Floor, New York, NY 10011, United States.