Last updated: 17 March 2026 · Version 1.0
1. Data controller
ImmiLex Immigration Consulting S.r.l., VAT IT18476181005, registered in Italy. Contact: info@immilex.eu.
2. Data collected
- Identity and contact data: first name, last name, email address, phone number.
- Browsing data: IP address, browser type, pages visited, date and time of access.
- Voluntarily provided data: nationality, type of permit requested, notes and messages submitted via contact or booking forms.
- Payment data: securely processed by Stripe Inc. — ImmiLex does not store card details.
3. Purposes and legal basis
- Providing the consultancy service (Art. 6(1)(b) GDPR — performance of a contract).
- Responding to enquiries (Art. 6(1)(b) and (f) GDPR — legitimate interest).
- Tax and accounting obligations (Art. 6(1)(c) GDPR — legal obligation).
- Site improvement and anonymised statistics (Art. 6(1)(f) GDPR — legitimate interest).
- Marketing communications only with explicit consent (Art. 6(1)(a) GDPR).
4. Retention
Data relating to consultancy matters is retained for 10 years from closure, in accordance with Italian accounting and tax law. Contact data not followed by an engagement is deleted within 24 months. Browsing data is retained for a maximum of 26 months.
5. Recipients
- Stripe Inc. — payment processing.
- Resend Inc. — transactional email delivery.
- Vercel Inc. — hosting and infrastructure.
- Google LLC — Analytics (anonymised data) and Fonts.
- Collaborators and professionals bound by confidentiality obligations.
ImmiLex does not sell or transfer personal data to third parties for marketing purposes.
6. Transfers outside the EU
Some providers (Stripe, Vercel, Resend, Google) are based in the United States. Transfers are made on the basis of Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR).
7. Your rights
Under Articles 15–22 GDPR, you have the right to:
- Access your personal data;
- Rectify inaccurate or incomplete data;
- Obtain erasure of your data ("right to be forgotten");
- Restrict or object to processing;
- Receive your data in a portable format;
- Withdraw consent at any time, without prejudice to prior processing;
- Lodge a complaint with the competent supervisory authority.
To exercise your rights, write to info@immilex.eu. We will respond within 30 days.
8. Cookies
For detailed information on our use of cookies, please see our Cookie Policy.
9. Changes
We reserve the right to update this policy. Material changes will be notified via a notice on the site. The "Last updated" date at the top of this page always reflects the current version.