Privacy Policy and GDPR Addendum

Last updated: October 2026

Your privacy is important to us. This Privacy Policy (the "Privacy Policy") applies to the personal information that Ferrante, PLLC (“Ferrante,” “we” or “us”) collects and explains our information practices and your related choices with regard to such information.

1. Scope

This Privacy Policy applies to the personal information we collect related to our:

• Websites, including https://www.ferrantelawfirm.com/, and the services available through our websites (together, our "Sites");
• Events, marketing and business development activities;
• Business communications and other online and offline business interactions; and
• Legal and professional services.

Collectively, we refer to the above as our “Services.” Additional or different privacy notices may apply to certain of our Services. If a different or supplemental privacy notice applies, this will be clearly disclosed to you. This Privacy Policy does not apply to the personal information that we collect about employees and other personnel, contractors, or applicants and candidates.

2. Information We Collect

We may collect information directly, as well as from third parties or automatically related to the use of our Sites and Services.

Information Collected Directly

We may collect personal information about you (such as your name, address, telephone number, fax number, e-mail address, etc.) directly from you. For example, personal information may be collected when you fill out a 'Contact Us' form, sign up for our mailing lists, register for events we host or sponsor, submit information as part of certain online services, or otherwise provide us personal information through the Sites and Services. Generally, the information we collect includes your:

• Name, company name and title/position.
• Email address, phone number, mailing address and contact details.
• Contact preferences and interests.
• Business affiliations.
• Information provided in conjunction with our Services.
• Other information related to your request or inquiry, or that you provide when you communicate, engage or otherwise interact with us or the Services.

Automatically-Collected Information

When you visit our Site, our hosting provider may automatically record standard log information, such as your IP address, browser type, operating system, the pages you visit and the date and time of your visit. Our Site does not use tracking or advertising cookies, pixel tags or analytics tools.

Information Received from Third Parties

We may collect or receive information about individuals from service providers, and other third parties, such as our clients, representatives and professional advisers, content providers, government authorities and public sources and records.

3. Use of Personal Information

We use the personal information we collect in order to respond to your request or inquiry and in the ordinary course of conducting our business. Generally, we use the personal information that we collect as follows:

Providing Support and Services

To operate our Sites, provide our Services, communicate with you about your use of the Sites or Services, provide troubleshooting and technical support, respond to your inquiries, fulfill your orders and requests, process your payments, communicate with you, and for similar service and support purposes.

Responding to Your Requests

To respond to your inquiries, fulfill your orders and requests, and otherwise consider or process your request.

Personalization

To tailor content we may send or display to you, including to offer location customization and personalized help and instructions on our Sites, and to otherwise personalize your experiences.

Newsletters, Mailing Lists and Direct Marketing

For direct marketing purposes, including to send you newsletters, client alerts and information we think may interest you. If you are located in a jurisdiction that requires opt-in consent to receive electronic marketing messages, we will only send you such messages if you opt-in to receive them.

Analytics and Improvement

To better understand how users access and use our Sites and other Services, and for other research and analytical purposes, such as to evaluate and improve our Services and business operations and to develop services and features.

Protect Legal Rights and Prevent Misuse

To protect the Sites, Services and our business operations; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of us or any person or third party, and to respond to actual or potential legal claims against us.

Comply With Legal and Ethical Obligations

In order to respond to legal process (e.g., court orders, subpoenas or warrants) or regulator investigations and inquiries, or where otherwise required by law or our legal, regulatory or ethical obligations.

General Business Operations

Where necessary, for the administration of our general business, accounting, recordkeeping, audit, compliance and legal functions.

4. Disclosure of Personal Information

Ferrante is an international law firm based in New York, Milan and Rome, and any information that we collect or that you provide to us may be shared and processed by any of our offices. We will not rent or sell your personal information, nor will we share it with third parties, outside of Ferrante, for their own marketing purposes.

We may share personal information with the following categories of third parties:

• Third party service providers that provide services to us or to whom we outsource certain services, such as data hosting or software or technology services.
• Our professional advisers, such as lawyers and accountants.
• Government and/or regulatory authorities.
• Professional indemnity insurers.
• Regulators, tax authorities and/or corporate registries.

In addition, we may disclose personal information to other third parties under the following circumstances:

Comply With Law, Legal Process and Ethical Obligations

To comply with the law and our ethical obligations or respond to legal process or regulator investigations and inquiries, or where otherwise required by law or our ethical obligations. For example, we may disclose information in response to subpoenas, court orders and/or other lawful requests by regulators and/or law enforcement, including responding to national security or law enforcement disclosure requirements.

Performance of Legal Services

To the extent required or necessary for our provision of legal services. For example, to our clients, with respect to the relevant legal services we provide to them, or to respond to other parties in legal matters for which we have been engaged as legal counsel.

Protect and Defend Rights

Where we believe it necessary to respond to claims asserted against us, enforce or administer our agreements and terms, or for fraud prevention, risk assessment and investigation, and to protect and defend the rights, property or safety of Ferrante, our clients and customers, or others.

We may also share aggregate or de-identified information with third parties for research, marketing, analytics and other purposes, provided such information does not identify a particular individual.

5. Cookies and Similar Devices

Our Sites do not use tracking or advertising cookies, pixel tags or analytics tools. If we add them in the future, they will only run with your consent, which you can give or withdraw at any time through the cookie notice ("Cookie settings" at the bottom of every page), and we will update this Privacy Policy.

Cookies

Cookies are alphanumeric identifiers that a website transfers to your computer's hard drive through your web browser for record-keeping purposes. Our Sites do not use cookies to track your activities. Your choice in the cookie notice is kept only in your browser (local storage), so that the notice does not appear again. Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block them in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether.

Clear Gifs, Pixel Tags and Other Technologies

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer's hard drive, clear GIFs are embedded invisibly on web pages. Our Sites do not use clear GIFs (also referred to as web beacons, web bugs or pixel tags).

Log Files

Most browsers collect certain information, such as your IP address, device type, screen resolution, operating system version, and internet browser type and version. This information is gathered automatically and stored in log files.

6. Direct Marketing

As noted, we may send periodic promotional emails to you, and where required by law, we will obtain your consent to do so. You may opt out of such communications at any time by following the opt-out instructions contained in the email or email us at info@ferrantelawfirm.com. If you opt out of receiving emails about recommendations or other information we think may interest you, we may still send you emails about your account or any services you have requested or received from us.

7. International Transfers

Ferrante is an international law firm based in New York, Milan and Rome; when you submit personal information to us, or when others provide personal information to us, we will receive it and process it in the United States and in Italy, and in other locations where we have service providers. In order to provide services, we also may need to transfer your personal information to locations in other jurisdictions.

8. Access, Correction and How to Contact Us

If you would like to review the personal information we have collected about you via the Sites, or request that we update or delete it, or if you have any questions or concerns about the Privacy Policy for Ferrante or its implementation, please contact us at info@ferrantelawfirm.com.

9. Our Commitment to Security

We employ security measures to prevent unauthorized access to information that we collect online. However, we cannot guarantee the security of your personal information.

10. Revisions to Our Privacy Policy

We reserve the right to revise this Policy or any part of it from time to time. Please review the Policy periodically for changes. If we make material changes, we will endeavor to provide notice ahead of such changes, such as by email or through a notice on our Sites.

11. Additional Privacy Information for California Residents

In this section, we provide additional information to California residents, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”). This section does not apply to publicly available information lawfully made available by state or federal government records, deidentified information, aggregate consumer information, or other personal information that is exempt under the CCPA (such as information covered by the Health Insurance Portability and Accountability Act).

While our collection, use and disclosure of personal information varies based upon our relationship and interactions with you, in this section we describe, generally, how we have collected and disclosed personal information about California residents in the prior 12 months, and the rights California residents have under the CCPA regarding this personal information.

Categories of Personal Information That We Collect and Disclose

The table below identifies the categories of personal information (as defined by the CCPA) that we have collected about consumers in the prior 12 months, as well as how we have disclosed such information for a business purpose (subject to our applicable legal and ethical obligations).

In addition to the above, we may disclose the personal information that we collect to others, as necessary to comply with applicable laws or our legal and ethical obligations. We do not sell personal information about California residents, including those we have actual knowledge are younger than 16.

Categories of Sources of the Personal Information that We May Collect

As further described in the Information we collect section above, we may collect personal information directly from individuals, as well as from third parties and other sources:

• Service providers
• Judicial and quasi-judicial bodies
• Regulatory and government entities
• Affiliates
• Legal support firms
• Clients
• Parties and related parties in legal matters
• Public sources and records
• Social networks

CCPA Rights

In general, California residents have the following rights with respect to their personal information:

• Do-not-sell (opt-out): to opt-out of our sale of their personal information. We do not sell personal information about California consumers, including those we have actual knowledge are younger than 16.
• Right of deletion: to request deletion of their personal information that we have collected about them and to have such personal information deleted (without charge), subject to certain exceptions.
• Right to know: with respect to the personal information we have collected about them in the prior 12 months, to require that we disclose the following to them (up to twice per year and subject to certain exemptions):
  • categories of personal information collected
  • categories of sources of personal information
  • categories of personal information about them we have disclosed for a business purpose or sold
  • categories of third parties to whom we have sold or disclosed for a business purpose their personal information
  • the business or commercial purposes for collecting or selling their personal information
  • a copy of the specific pieces of personal information we have collected about them
• Right to non-discrimination: the right not to be subject to discriminatory treatment for exercising their rights under the CCPA.

Submitting CCPA Requests

California residents may submit CCPA requests to know (access) and requests to delete their personal information through one of the following methods:

• Online by emailing info@ferrantelawfirm.com
• By phone at +1-212-308-4440

When you submit a request to know or a request to delete, we will take steps to verify your request by matching the information provided by you with the information we have in our records. You must provide your name and contact information to verify your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual by contacting us by email at the above link; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

GDPR Addendum

Ferrante has developed this EU GDPR Privacy Addendum (the "GDPR Privacy Addendum") to provide additional information about how we handle personal information that is subject to the GDPR when we are the controller of that information. In this GDPR Privacy Addendum, we use the term "GDPR" to include the EU General Data Protection Regulation, as well as associated national laws.

This GDPR Privacy Addendum explains how Ferrante handles the personal information we collect from individuals through the Site, the personal information we collect when individuals engage with us or use our products or services (our "Services") and the personal information we receive about individuals as a result of providing the Services to third parties, whenever personal information is subject to the GDPR.

For the purposes of this GDPR Privacy Addendum, "personal information" means any information relating to an identified or identifiable person.

1. Purpose of this Addendum

This GDPR Privacy Addendum explains how we process personal information that is subject to EU data protection laws, and also sets out individuals' rights related to our processing of such personal information.

2. Who Are We and What Do We Do?

Ferrante is an international law firm based in New York, Milan and Rome. Our offices provide legal services in accordance with the relevant laws of the jurisdictions in which they operate.

Ferrante is the data controller of personal information subject to the GDPR that we collect and process in connection with the Services.

Please note that, depending on which of our offices you engage with in relation to the Services, the entity operating that office may also be a data controller responsible for processing your personal information in relation to the Services.

3. Personal Information We Collect

We may collect personal information in the course of our business, including through your use of our Site, when you contact us or request information from us, when you engage our Services or as a result of your relationship with one or more of our staff and clients. When we require personal information from you in order to fulfill a statutory or contractual requirement, or where such information is necessary to enter into a contract or is otherwise an obligation, we will inform you and indicate the consequences of failing to do so.

Registrations, Subscriptions, Forms

If you register with us via the Site, sign up to receive news and information from us, or communicate with us through or related to the Site, we may collect the following personal information:

• Your name, job title and company.
• Contact information for you, including the company you work for and email address.
• Demographic information, such as your address, preferences and interests.
• Other information relevant to the provision of Services.

Client Matters

From individuals who are clients and prospective clients, or are representatives of clients and prospective clients, we may collect the following personal information:

• Your name, the named Ferrante client, the name of the company you work for (if different) and your job title.
• Contact information for you, the named Ferrante client, and the company you work for (if different), including address, fax, phone number and email address.
• Payment information (including bank account and wire details), billing instructions and preferences (including to whom to direct invoices). Relevant information so that we can perform conflicts of interest checks.
• Relevant information as required by regulatory Know Your Client and/or Anti Money Laundering regulations and as part of our client intake procedures. This may possibly include evidence of source of funds, at the outset of and possibly from time to time throughout our relationship with clients, which we may request and/or obtain from third party sources. The sources for such verification may include documentation, which we request from the client or prospective client or through the use of online or public sources or both.
• Information you provide to us for the purposes of attending meetings and events, including dietary requirements, which may reveal information about your health or religious beliefs.
• Information that you provide to us as part of the provision of Services to you, which depends on the nature of your engagement with Ferrante.
• Other information relevant to the provision of Services.

Related Parties and Client Representatives

Ferrante is primarily engaged by corporate entities and clients (i.e., legal entities), and those legal entities are not data subjects (i.e., natural persons to whom personal information relates). However, as part of our engagement with these clients, we may receive personal information about individuals. For example, we may receive names, contact details and other information relating to:

• Officers, representatives and/or personnel of our corporate clients or prospective clients, as well as their affiliated and related entities.
• Adverse parties in a matter or potential matter, such as claimants, plaintiffs, defendants and other adverse parties.
• Related parties in a matter or potential matter.
• Vendors and suppliers of our corporate clients or prospective clients.
• Current and former legal advisors, consultants and other professional advisors of our corporate clients or prospective clients.
• Government and/or law enforcement entities and their representatives.

If you are an individual whose personal information is processed by us as a result of providing the Services to others (including individual clients and corporate clients), we will process a variety of different personal information depending on the Services provided.

We might also need to process personal information in relation to other third parties instructed either by our own clients or other persons or companies involved in providing the Services to our client (e.g., other law firms, experts etc.).

Mailing Lists

For clients and prospects, we also collect information to enable us to market our Services, which may be of interest to you. For this purpose, we collect:

• Name and contact details.
• Other business information, such as job title and the company you work for.
• Areas or topics that interest you.
• Additional information may be collected, such as events you attend and if you provide it to us, dietary preferences which may indicate data about your health or religious beliefs.

4. Purpose and Legal Bases for Our Use of Your Personal Information

Our processing of personal information is justified by a "legal basis", that is, a specific condition. We may use personal information for the following purposes, in each case as justified by a legal basis:

Fulfilment of Services

We use personal information to enable us to perform the Services, respond to your requests and deliver our Services, to provide legal advice and related Services for which you have engaged us, verify your identity, and carry out requests made by you on the Site or in relation to our Services.

Client Services

We use personal information to provide and operate our Site and the Services, to communicate with you about your use of the Site and Services, to respond to your inquiries, to provide troubleshooting, to fulfill your requests, to bill you for our Services, to collect payments, to respond to complaints and inquiries, to provide technical support, and to provide other client service and support.

Business Administration and Legal Compliance

We use personal information for the following business administration and legal compliance purposes:

• To perform and maintain information for the purposes of performing conflicts of interest searches.
• To comply with our legal obligations (including Know Your Client, Anti-Money Laundering, Anti-Bribery, conflicts or similar obligations including, but without limitation, maintaining regulatory insurance).
• To enforce our legal rights. To investigate and/or settle inquiries or disputes.
• To comply with any applicable law, court order, other judicial process, law enforcement requests or the requirements of a regulator.
• To enforce our agreements with you.
• To protect the rights, property or safety of us or third parties, including our other clients and users of the Site or our Services.
• To maintain our records.
• To process business transaction data, such as in connection with a merger, or a restructuring, or sale.
• To use as otherwise required or permitted by law, consistent with these purposes.

Marketing and Promotions

We may use personal information for marketing and promotional purposes, such as to send you news and newsletters, or to otherwise contact you about products or information we think may interest you, by email and direct (postal) mail. We may also use it develop new Services and determine how to market our Services.

Client Development

We may use personal information in order to respond to Requests for Proposals, prepare for and present pitches and other proposals, and identify potential business opportunities. Largely, this involves our collection and use of non-personal business information about current, former and prospective corporate clients. However, we may also process limited personal information about individuals (name, current and former company, current and former title, contact information and similar information).

Client Insight and Analytics

We use personal information to better understand how you and others use our Services, so that we can improve our Site and Services, develop new features, tools, offerings, services and the like, and for other research and analytical purposes. We may also use the information we collect to understand how visitors use our Site. We may use this information and the insights we have derived for marketing purposes (see the marketing section above for further details), or to make decisions about events, news and information that may be of interest to clients, prospective clients, Site users and others.

Prevent Misconduct, Abuse and Misuse

Subject to our professional and ethical duties, we use personal information where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or violations of our terms of engagement. We also use personal information to protect and secure the Site and our information systems and networks.

5. Sharing Your Personal Information

Ferrante is an international law firm based in New York, Milan and Rome, and any information that we collect or that you provide to us may be shared and processed by any of our offices.

We may also share personal information with a variety of the following categories of third parties as necessary:

• Our professional advisers, such as lawyers and accountants.
• Government and/or regulatory authorities.
• Professional indemnity insurers.
• Regulators, tax authorities and/or corporate registries.
• Third parties to whom we outsource certain services, such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT Support service providers, and document and information storage providers.
• Third parties engaged in connection with our Services, such as counsel, arbitrators, mediators, clerks, witnesses, court reporters, court, opposing party and their lawyers, document review platforms and experts, such as tax advisors.
• Third party service providers to assist us with client insight analytics.
• Third party postal or courier providers who assist us in delivering our postal marketing campaigns to you, or delivering documents related to a matter.

6. Third Party Contractors and Other Data Controllers

As mentioned above, we may appoint sub-contractor data processors as required to deliver the Services, such as, without limitation, document processing and translation services, confidential waste disposal, IT systems or software providers, IT Support service providers, and document and information storage providers, who will process personal information on our behalf and at our direction. We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal information appropriately and according to our legal and regulatory obligations.

Further, we may appoint external data controllers where necessary to deliver the Services (for example, but without limitation, accountants, attorneys, consultants and other third-party experts including, but without limitation, our network of affiliates, as well as other law firms). When doing so, we will comply with our legal and regulatory obligations in relation to the personal information including, but without limitation, putting appropriate safeguards in place.

7. Our Use of Cookies and Similar Technologies

Our Site does not use tracking or advertising cookies, pixel tags or analytics tools. Section 5 of the Privacy Policy above explains how the Site works and what happens if this changes.

8. Where We Transfer Your Personal Information

Ferrante has offices in New York, Milan and Rome; when you submit personal information to us, or when others provide personal information to us, we will receive it and process it in the United States and in Italy. In order to provide the Services, we also may need to transfer your personal information to locations in other jurisdictions (including between our offices).

If you are based within the European Union/European Economic Area (EEA), please note that where necessary to deliver the Services, we will transfer personal information to countries outside the EEA (including to our New York office).

You have a right to obtain details of the mechanism under which your personal information is transferred outside of the EEA by contacting info@ferrantelawfirm.com.

9. Retention of Personal Information

In general, we will retain relevant personal information of Site visitors for at least three years from the date of our last interaction with you and in compliance with our obligations under applicable laws, or for longer if we are required to do so according to our regulatory obligations or professional indemnity obligations, or where we believe necessary to establish, defend, or protect our legal rights and interests or those of others.

We generally retain files and information regarding client engagements and matters for which we have been retained for at least seven years from the date of our last interaction with the relevant client, in compliance with our obligations under applicable laws, or for longer where required by our regulatory obligations, professional indemnity obligations, or where we believe necessary to establish, defend, or protect our legal rights and interests or those of others. We may then destroy such files without further notice or liability.

10. Confidentiality and Security of Your Personal Information

We are committed to keeping personal information secure and we have implemented appropriate information security policies, rules and technical measures to protect the personal information that we have under our control from unauthorized access, improper use or disclosure, unauthorized modification and unlawful destruction or accidental loss. Please note that no transmission over the Internet is completely secure or error-free, and that the information security policies, rules and technical measures utilized and maintained by us may be subject to compromise.

All of our partners, employees, consultants, workers and data processors (i.e., those who process your personal information on our behalf, for the purposes listed above), who have access to, and are associated with the processing of personal information, are obliged to respect the confidentiality of such personal information.

11. How to Access Your Information and Your Other Rights

You have the following rights in relation to the personal information we hold about you:

Your Right of Access

If you ask us, we will confirm whether we are processing your personal information and, if necessary, provide you with a copy of that personal information (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.

Your Right to Correction (Rectification)

If the personal information we hold about you is inaccurate or incomplete, you are entitled to request to have it corrected. If you are entitled to have information corrected and if we have shared your personal information with others, we will let them know about the rectification where possible. If you ask us, we will also tell you, where possible and lawful to do so, with whom we have shared your personal information so that you can contact them directly.

Your Right to Erasure

You can ask us to delete or remove your personal information in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we have shared your personal information with others, we will let them know about the erasure where possible. If you ask us, we will also tell you, where it is possible and lawful for us to do so, with whom we have shared your personal information with so that you can contact them directly.

Your Right to Restrict (Block) Processing

You can ask us to restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information or you object to us. If you are entitled to restriction and if we have shared your personal information with others, we will let them know about the restriction where it is possible for us to do so. If you ask us, we will also tell you, where it is possible and lawful for us to do so, with whom we have shared your personal information so that you can contact them directly.

Your Right to Data Portability

You have the right, in certain circumstances, to receive a copy of personal information we've obtain from you in a structured, commonly used and machine-readable format, and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.

Your Rights in Relation to Automated Decision-Making and Profiling

You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.

Your Right to Withdraw Consent

If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you have the right to withdraw that consent at any time.

Your Right to Lodge a Complaint with The Supervisory Authority

If you have a concern about any aspect of our privacy practices, including the way we have handled your personal information, you can report it to the relevant supervisory authority.

Please note that some of these rights may be limited where we have an overriding legitimate interest or legal obligation to continue to process the personal information, or where the personal information may be exempt from disclosure due to applicable law, the applicable rules of professional conduct, attorney-client privilege, legal professional privilege, other applicable privileges or protections, or professional secrecy obligations.

12. Children

The Site is not for use by children under the age of sixteen (16) years, and we do not knowingly collect, store, share or use the personal information of children under 16 years. If you are under the age of 16 years, please do not provide any personal information, even if prompted by the Site to do so. If you are under the age of 16 years and you believe you have provided personal information to us, please ask your parent(s) or guardian(s) to notify us and we will delete all such personal information.

13. Changes to This GDPR Privacy Addendum

We may make changes to this GDPR Privacy Addendum from time to time, to reflect changes in our practices. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where we materially change this Policy, we will take steps to notify you (such as by posting a notice on the Site or via email), and where required by applicable law to obtain your consent.

14. How to Contact Us?

If you have any questions about this GDPR Privacy Addendum or want to exercise your rights set out in this GDPR Privacy Addendum, please contact us at info@ferrantelawfirm.com.