Last updated · 20 October 2026

Privacy policy

This notice describes how CM CUBE S.R.L. processes the personal data of visitors to lexmap.it. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Data controller

The data controller is CM CUBE S.R.L., registered office at Via Cerere 41, 00175 Rome (RM), Italy — entered in the Rome Companies Register under tax code and registration number 18663971002, REA RM-1798964, VAT number 18663971002, share capital € 10,000.00 fully paid up.

For any matter concerning personal data you may write to lexmap.info@cmcube.it or to the certified address cmcube@namirialpec.it, which is useful when a request needs a legally certain date.

Data protection officer

CM Cube has not appointed a data protection officer, because none of the conditions that would make the appointment mandatory under Article 37(1) GDPR applies: the company is not a public authority, its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data or data relating to criminal convictions and offences on a large scale.

Data protection requests should therefore be addressed directly to the controller, at the addresses given above.

Scope of this notice

This notice covers the lexmap.it website, which presents the three LexMap product lines, the Osservatorio and the interface previews. In other words, it covers people who visit the site.

It does not cover the processing of documents a customer uploads into the LexMap product: that happens under contract, where the law firm or the organisation remains the data controller and CM Cube acts as processor under Article 28 GDPR, with a dedicated agreement.

The corporate site cmcube.it has its own privacy notice.

Personal data we process

The site processes three categories of data, and no others.

Browsing data

These are the data that internet communication protocols generate by their very nature on every page request: IP address, date and time of the request, address of the requested resource, request method and outcome, response size, browser and operating system type, and the referring page where present. They are not collected in order to identify anyone, but they could allow identification if combined with data held by third parties.

Visit measurement data, only with your consent

If you accept the statistics cookie, Google Analytics 4 collects data on how the site is used: pages viewed and navigation events, pseudonymous identifiers held in cookies, device and browser data, and an approximate location derived from the IP address, which Google Analytics 4 does not store. Without consent these data are not collected.

Data you send us

If you write to lexmap.info@cmcube.it we process your email address and whatever the message contains: name, firm or organisation, contact details, and the substance of your request.

The forms on this site

Some pages show forms. The demo request form on the Penale page opens your device's mail client with the request already composed: no data leaves this site. The application forms on the collaboration pages (pilot firms and LexMap Legal Product Specialist) work the same way: they open your mail client with a message composed from what you typed, without sending anything from the site. The Osservatorio newsletter sign-up works the same way: it opens your mail client with a message already composed, and your subscription starts when you send it.

The real contact channel, and the only one, is the email address given above.

The product previews

The site hosts navigable previews of the LexMap interface, built on a fictional demonstration case file. The names, facts, documents and amounts they show are invented and refer to no real person and no real proceeding. The previews run entirely in the browser: they neither upload nor send documents.

Purposes of processing and legal bases

Serving the site

Browsing data are used to deliver the requested pages, to check that the site works, and to derive statistical information in aggregate form, which identifies no one. Legal basis: the controller's legitimate interest in keeping the site working and available (Article 6(1)(f) GDPR).

Site usage statistics

With your consent, measurement data are used to understand how the site is read, for example which pages are visited and from what kind of device, and to improve its content and operation. Legal basis: consent (Article 6(1)(a) GDPR; Article 122 of the Italian Personal Data Protection Code). Consent can be withdrawn at any time.

Site security

The same data make it possible to detect and counter abuse, intrusion attempts and other harmful conduct, and may be used to establish liability in the event of computer crimes committed against the site. Legal basis: legitimate interest (Article 6(1)(f); recital 49 GDPR expressly recognises network and information security as a legitimate interest).

Replying to messages

Data contained in messages are used to read, assess and answer the request. Legal basis: steps taken at the data subject's request prior to entering into a contract, where the message concerns a demo or a possible collaboration (Article 6(1)(b)); legitimate interest in handling correspondence in all other cases (Article 6(1)(f)).

Whether providing data is required

Browsing data are technically inseparable from a web page request: there is no way to visit the site without generating them.

Consent to visit statistics is optional: declining it does not limit browsing of the site in any way.

Writing to LexMap, by contrast, is entirely optional, and the only consequence of not doing so is that we cannot reply.

Cookies and tracking tools

The site uses two technical cookies of its own and, only after your consent, the Google Analytics 4 cookies for visit statistics. There are no advertising pixels, social network plugins or profiling tools. The typefaces are served from the site's own domain.

List of cookies

  • lexmap_consent: first-party technical cookie, remembers your choice on visit statistics with version and date. Duration: 183 days. No consent required.
  • lexmap_demo_intro: first-party technical cookie, remembers which demos have already been introduced. Duration: 180 days. No consent required.
  • _ga: Google Analytics 4 cookie, distinguishes visitors. Duration: 2 years, renewed at every visit. Set only after “Accept”.
  • _ga_0BHNC51KW8: Google Analytics 4 cookie, keeps the session state. Duration: 2 years, renewed at every visit. Set only after “Accept”.

The lexmap_demo_intro cookie concerns the demos. Anyone opening a demo first meets a short introduction to what they are about to see, and may ask not to see it again: only in that case does the site record the choice, whose content is the list of demos already introduced. It carries no identifier, does not allow anyone to be recognised, is not disclosed to anyone and never leaves the browser.

How consent is given and withdrawn

On your first visit a banner offers two choices of equal prominence, “Accept” and “Reject”; closing it with the X counts as rejecting. You can change your choice at any time from the “Cookie preferences” link in the footer of the site: withdrawal stops measurement and deletes the _ga cookies. The demo pages have no footer: the link is not available there, and the choice can be changed from any other page of the site. The banner is shown again after 183 days or if the purposes change.

The choice is stored only in your browser, in the cookie named above, with version and date: there is no server-side record of consents, and if you delete your browser cookies the choice must be made again. Without consent a visit generates no requests to third parties.

The hosting infrastructure may set, for its own operational needs, cookies strictly necessary to deliver the pages: these are technical cookies, exempt from consent and not used for profiling. You can in any case always block or delete cookies from your browser settings.

Automated decision-making and profiling

There is no automated decision-making, including profiling, within the meaning of Article 22 GDPR. The site builds no profiles of its visitors and takes no decisions concerning them.

Recipients of the data

Data are not disseminated, not sold, and not disclosed to third parties for marketing purposes.

They may be processed, as processors appointed under Article 28 GDPR or as independent controllers depending on their role, by:

  • the hosting provider, which hosts the site on cloud infrastructure located in the European Union;
  • Google Ireland Limited, as processor for Google Analytics 4, under the data processing terms accepted in the measurement property, and only for those who give consent;
  • the email provider operating the lexmap.info@cmcube.it mailbox;
  • the provider of the certified email service;
  • advisors and professionals assisting the company, to the extent necessary;
  • the competent authorities, where disclosure is required by law.

An up-to-date list of processors can be requested at the addresses given above.

Transfers outside the EEA

The site is hosted on infrastructure located in the European Union. Google Analytics 4 data, collected only with consent, may however be transferred to the United States to Google LLC, which adheres to the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); the standard contractual clauses of Article 46 GDPR provide a further safeguard.

Should a provider process them outside the European Economic Area for support or service continuity purposes, the transfer takes place on the basis of an adequacy decision of the European Commission or of the standard contractual clauses provided for by Article 46 GDPR, together with any supplementary measures required.

Retention periods

Browsing data are kept for the technical time needed to operate and secure the site, and in any case for no longer than twelve months, save for any further retention needed to establish liability in the event of computer crimes committed against the site.

Google Analytics 4 data are kept for 2 months, a period set in the measurement property. Cookies last as stated in the section on cookies: 183 days for the choice, 2 years for the Google Analytics 4 cookies.

Email messages and the data they contain are kept for twenty-four months from the last contact. If the exchange gives rise to a contractual relationship, the documents forming part of it follow the retention periods laid down by law, in particular the ten-year period under Article 2220 of the Italian Civil Code.

Security measures

All connections to the site use HTTPS with TLS encryption. The site is published as a set of static pages: there is no user database, and no server-side application code that processes personal data. Access to the mailbox is restricted to the people who need it.

Your rights

Within the limits set by the GDPR you may at any time request:

  • access to your personal data and a copy of them (Article 15);
  • rectification of inaccurate data and completion of incomplete data (Article 16);
  • erasure of your data (Article 17);
  • restriction of processing (Article 18);
  • data portability, where processing is automated and based on contract or consent (Article 20);
  • to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)), from the “Cookie preferences” link in the footer;
  • to object to processing based on legitimate interest, on grounds relating to your particular situation (Article 21): this covers browsing data and the handling of correspondence.

Requests go to lexmap.info@cmcube.it or to the certified address cmcube@namirialpec.it. They are free of charge and answered within one month, extendable by a further two months where a request is particularly complex (Article 12(3)).

Lodging a complaint

If you believe that the processing of your data infringes the law, you may lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it, or seek a judicial remedy.

The site links to external sites, in particular cmcube.it and onelogic.it. Once you leave lexmap.it this notice no longer applies: the destination sites have their own notices and their own controllers.

Changes to this notice

This notice may be updated to reflect changes to the site, to the services used, or to applicable law. The date shown at the top of the page is that of the current version; material changes will be flagged on this same page.