1. What cookies are
Cookies are small text files that the visited websites send to the user’s device, where they are stored to be sent back to the same websites on the next visit. They are distinguished into technical cookies, necessary for operation, and profiling cookies, which require prior consent.
2. Cookies used
| Name | Type | Purpose | Duration | Provider | Consent |
|---|---|---|---|---|---|
| airlex-cookie-consent (localStorage) | Technical — necessary | Stores the preferences expressed in the cookie banner (necessary, analytics and marketing categories), together with the date and version of the notice, so as not to show the request again on every visit. | Until revoked or the browser data is cleared | air-lex.it (first party) | Not required |
| sb-<project>-auth-token (localStorage) | Technical — necessary | Stores the authentication session of editors accessing the restricted news-editing area. Not set for visitors of the public website. | Until logout (token expiring after 1 hour, renewable) | air-lex.it (first party, Supabase infrastructure) | Not required |
| NID | Third party — functional/preferences | Set by Google when the map embedded in the Offices and Contacts page loads; stores map display preferences and security parameters. | 6 months | Google Ireland Ltd. / Google LLC | Consent to activate the map |
| SOCS / CONSENT | Third party — necessary for the service | Set by Google to record the status of the user’s choices regarding its own services when using the embedded map. | From 13 months to 2 years | Google Ireland Ltd. / Google LLC | Consent to activate the map |
At present the website does not use analytics cookies, advertising profiling cookies or cross-site tracking tools: no Google Analytics, social pixels or remarketing tools are installed. The Analytics and Marketing categories remain available in the banner and will only be activated upon express consent, if and when such tools are introduced. The list is updated whenever the website’s tracking changes.
3. Legal bases and retention periods
The legal bases and retention periods indicated below are the same as those set out in the Privacy Policy (section “Purposes and legal bases of each processing activity”), to which reference is made for the complete picture of the firm’s processing activities.
| Cookie category | Legal basis | Retention |
|---|---|---|
| Necessary technical cookies (session, website security and anti-spam, access to the restricted area) | Legitimate interest in the functioning and security of the website — Art. 6(1)(f) GDPR; Art. 122 of Legislative Decree 196/2003 (consent not required) | Duration of the session or up to 7 days (access gate); technical logs max. 12 months |
| Recording of the preferences expressed in the banner (airlex-cookie-consent) | Legal obligation to demonstrate consent — Articles 6(1)(c) and 7(1) GDPR | Until revoked or the browser data is cleared; presented again upon each new version of the notice |
| Statistical analytics cookies (Analytics category, not active) | Data subject’s consent — Art. 6(1)(a) GDPR (revocable) | Max. 12 months from collection |
| Marketing and profiling cookies (Marketing category, not active) | Data subject’s consent — Art. 6(1)(a) GDPR (revocable) | Max. 12 months from collection |
| Third-party cookies activated by the office maps (Google Maps) | Data subject’s consent to the activation of the map — Art. 6(1)(a) GDPR | Duration set by the provider (from session to 24 months) |
Upon expiry of the indicated terms, data is deleted or irreversibly anonymised, except where it is necessary to retain it for the establishment, exercise or defence of a legal claim (Art. 6(1)(f) GDPR).
4. Managing and withdrawing consent
On the first visit a banner is shown allowing users to accept all cookies, reject the non-necessary ones, or individually select the Analytics and Marketing categories. Necessary technical cookies are always active because they are essential for the website to function. The choice is recorded with the date and version of the notice and may be changed or withdrawn at any time via the link present in the footer of every page of the website. Withdrawal does not affect the lawfulness of processing carried out beforehand.
It is also possible to block or delete cookies from the browser settings (Chrome, Safari, Firefox, Edge, “Privacy and security” section). Disabling technical cookies may impair certain website functions, including submission of the contact form.
5. Third-party services
The office maps are provided by Google Maps (Google Ireland Ltd. / Google LLC). Loading the map may involve the setting of cookies by the provider, subject to its own notice available at policies.google.com/privacy.
Data is hosted on infrastructure located within the European Economic Area; any transfers to third countries take place on the basis of an adequacy decision or standard contractual clauses approved by the European Commission, as indicated in the Privacy Policy.
6. Data controller and contacts
The data controller is AIR-LEX — Avvocati di Impresa Riuniti, with offices in Roma, Viale Bruno Buozzi 19 (00197) e Brescia, Via Settembrini 8 (25128). Non è stato designato un Responsabile della protezione dei dati (DPO): ogni richiesta in materia di protezione dei dati è gestita direttamente dal Titolare, che ha individuato un referente interno privacy.
To exercise the rights set out in Articles 15-22 GDPR — including withdrawal of consent, access, rectification, erasure, restriction and objection — or to request information: info@air-lex.it — tel. +39 06 56546814. It is always possible to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
7. Processing of personal data
For the complete picture of purposes, recipients, transfers outside the EU and data subjects’ rights, please see the Privacy Policy.
Last updated: August 2026.