Cookie policy

Information on cookies and tracking technologies used by this website.

Last updated: 2026-09-18

This English version is a courtesy translation of the Italian text, which is the only authoritative version and prevails in case of discrepancy.

Version 1.0 — English courtesy translation, 18 September 2026

Pursuant to Art. 122 of Legislative Decree No. 196/2003 (Privacy Code) as amended by Legislative Decree No. 101/2018, Art. 13 of Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC as amended by Directive 2009/136/EC ("ePrivacy"), and the Guidelines of the Italian Data Protection Authority (Garante) of 10 June 2021 ("Provv. Cookie 2021")

1. What is a cookie

Cookies are small text files that websites visited by the user send to their device (computer, tablet, smartphone), where they are stored to be retransmitted to the same site on the next visit. Similar technologies (pixel tags, web storage, fingerprinting) produce similar effects and are likewise governed by this Cookie Policy. The Site does not use tracking pixels or fingerprinting techniques.

Cookies can be classified by:

2. Cookies used by the LX20 website

The website lx20lawfirm.com (managed by LX20 Law Firm S.T.A. S.r.l., with registered office at Via San Raffaele 1, 20121 Milan — "LX20" or "Owner") uses the types of cookies listed in the following sections.

2.1 Technical and functional cookies (necessary — do not require consent)

These are cookies strictly necessary for the functioning of the site and for the provision of the service requested by the user, pursuant to Art. 122, paragraph 1, of the Privacy Code. They cannot be disabled without compromising the usability of the site. They do not require consent pursuant to the Garante's "Provv. Cookie 2021".

| Name | Type and origin | Duration | Purpose | |---|---|---|---| | __cf_bm | First-party cookie set by the hosting infrastructure (Cloudflare, Inc., on behalf of the hosting provider Lovable) | 30 minutes | Protection of the site against malicious automated traffic (bot management); it does not read or store user-identifying data | | __dpl | First-party cookie set by the hosting platform (Lovable) | 7 days | Routing of the request to the correct published version of the site | | lx20.cookie.consent.v1 | First-party local web storage (localStorage) | Until deleted by the user | Storage of the choice made on the cookie banner (accept/reject) and of the Cookie Policy version | | lx20_logo_revealed_v2 | First-party session web storage (sessionStorage) | Until the browser tab is closed | Avoids repeating the logo animation on every page within the same visit | | sb-*-auth-token | First-party local web storage (localStorage, Supabase) | Until logout or session expiry | Authentication of the session in the Personal Area/Portal; present only after login with credentials |

The site language is determined by the page address (/it, /en) and does not involve cookies.

2.2 Analytics cookies (require prior consent if third-party or not anonymized)

They allow the Owner to collect aggregate information on the use of the site (number of visitors, most viewed pages, average session duration, navigation paths) to improve the service. LX20 exclusively uses analytics tools configured to respect privacy by default (IP anonymization, no transmission of user identifiers, no cross-site tracking, no fingerprinting).

| Cookie name / tool | Origin | Duration | Purpose | Consent | |---|---|---|---|---| | Plausible Analytics (script plausible.io) | Plausible Insights OÜ (Estonia, EU) — cookieless | — (no cookies or storage) | Aggregate traffic statistics (page views, referrers, device) without persistent identifiers or cross-site tracking; data processed in the EU | Not required (cookieless, no personal data stored) |

No other analytics tools are used.

2.3 Profiling and marketing cookies (require explicit consent)

At the time of writing, the LX20 website does NOT use profiling, retargeting, advertising, or cross-site tracking cookies. Should they be introduced in the future, this Cookie Policy will be updated, and the user will be invited to express their preferences again. No profiling processing will be activated without free, specific, informed, and unambiguous consent pursuant to Art. 6(1)(a) of the GDPR and Arts. 12, 13, and 7 of the GDPR.

2.4 Cookies from embedded third-party services

The site may embed content published on third-party platforms (e.g., YouTube videos, LinkedIn embeds, maps). These platforms may set their own cookies when the user interacts with the content. LX20 uses the "social plugin with consent" (Click-to-Load) technique: third-party content is not loaded by default and is only loaded after the user explicitly clicks on the content, following prior information about the setting of cookies by the third party.

Potential categories (if activated):

| Service | Origin | Purpose | Third-party's Privacy Policy | |---|---|---|---| | YouTube (video embed) | Google Ireland Limited, Ireland | Playback of embedded video | policies.google.com/privacy | | LinkedIn (professional badge, share button) | LinkedIn Ireland Unlimited Company | Display of professional sharing widget | linkedin.com/legal/privacy-policy | | Vimeo (alternative videos) | Vimeo Inc., United States | Playback of embedded video | vimeo.com/privacy |

3. Managing Preferences

The user can manage their cookie preferences at any time through:

(a) The consent banner shown on the first visit, which allows the user to accept all cookies, reject those that are not strictly necessary.

(b) The "Manage Cookie Preferences" link located at the bottom of every page of the site, which reopens the configuration panel at any time.

(c) Browser settings, through which it is possible to delete, block, or restrict cookies at a general level. Instructions vary depending on the browser used:

Completely disabling cookies and web storage may compromise the functionality of some sections of the site (in particular the Personal Area, which requires technical cookies for authentication).

4. First- and Third-Party Cookies — Legal Basis

| Category | Legal Basis | |---|---| | Technical and functionality cookies | Art. 122, para. 1, of the Privacy Code (exemption from consent for strictly necessary cookies) and Art. 6, para. 1, lett. f), GDPR (legitimate interest of the Controller in providing a functional and secure site) | | Analytical cookies (anonymised first-party) | Art. 122, para. 1, of the Privacy Code (exemption if anonymised pursuant to the 2021 Cookie Guidelines), or Art. 6, para. 1, lett. a), GDPR (consent) if not anonymised | | Third-party analytical cookies | Art. 6, para. 1, lett. a), GDPR (consent) | | Profiling and marketing cookies | Art. 6, para. 1, lett. a), GDPR (free, specific, informed, and unambiguous consent) | | Embedded third-party content (Click-to-Load) | Art. 6, para. 1, lett. a), GDPR (consent given by clicking on the content) |

5. Transfer of Data Outside the European Union

Some cookies and similar technologies may involve the transfer of personal data (e.g., IP address, device identifiers) to countries outside the European Economic Area, particularly the United States. In such cases, LX20 ensures that the transfer is carried out in compliance with Articles 44 et seq. of the GDPR, through the safeguards outlined in the general Privacy Policy (§7).

6. Rights of the Data Subject

The user has the right at any time to:

For the exercise of privacy rights in general (access, rectification, erasure, restriction, objection, portability), please refer to the general Privacy Policy, §9, and contact us at [info@lx20lawfirm.com](mailto:info@lx20lawfirm.com).

7. Updates

This Cookie Policy may be periodically updated, particularly in the event of one of the following circumstances:

The most recent version is always available at the URL https://lx20lawfirm.com/en/cookie-policy. In the event of substantial changes, the user will be invited to review their preferences.

8. Contacts

For any request or clarification regarding this Cookie Policy:

*Cookie Policy prepared in accordance with Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC, as amended by Directive 2009/136/EC (ePrivacy), as well as the "Guidelines on cookies and other tracking tools" issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021.*

LX20
Caricamento…