Privacy policy

The controller of your data is:

For any request concerning personal data you can write to the email address above.

• Account data: email address, name (if you give one), chosen language and notification preferences.
• The business details you confirm: AFM, name, legal form, KAD codes, registered office, VAT status and the activity attributes you declare. For sole traders and liberal professions these details can identify a natural person, and we treat them as personal data.
• Figures you choose to give us: the turnover and the number of employees of your business, and the date you agreed to give them.
• Data about your use of the service: the acts you track, those you mark as being or not being yours, the deadlines you mark as done, the funding programmes you hide, notifications read and the emails we have sent you.
• Evidence of agreement: the date you accepted the terms and saw the privacy policy, the version and a truncated form of the IP address.
• Technical data: access and security logs, including IP address and browser type.
• Access requests: if you asked for access through the form on the site, the details entered there.

We do not collect special categories of data and we do not ask for card details: payments are processed by Paddle, and we have no access to the payment instrument's data.

• To provide the service (the account, the notifications, the personalised feed), on the basis of performance of the contract (Art. 6(1)(b) GDPR).
• To match acts that depend on company size using the turnover and number of employees you choose to give us, only with your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by deleting them from your profile; this does not affect what was done before.
• For the security of the service, preventing abuse, audit logs and defending our rights, on the basis of legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations, for example tax and accounting ones (Art. 6(1)(c) GDPR).
• For cookies or technologies that are not strictly necessary, only with your consent (Art. 6(1)(a) GDPR). We currently use none.

The emails we send you are part of the service you asked for. You can unsubscribe at any time, with one click, from any email or from Settings.

From GEMI, the General Commercial Registry, through the open data it publishes: name, legal form, KAD codes, registered office and status. For companies that publish their financial statements in GEMI, the turnover and balance-sheet total of the most recent statements. We take them from the AFM you enter and you confirm them before they are saved; the turnover is refreshed monthly from the same source.

VAT status, employees and the other activity attributes are declared by you. If you wish, you can also give the turnover and the exact number of employees, so that acts that depend on company size are matched more accurately; giving them is optional, and you can change or delete them at any time in your profile.

The municipalities you follow are chosen by you; the municipality of your registered office is added automatically from GEMI. We use them only to show you their local acts, and you can change them at any time in your profile.

When we present LexAlia to a business, we enter its AFM and take the public data about it from GEMI (name, legal form, KAD codes, registered office, and turnover from its published financial statements) to show which published acts would concern it.

We may send a business, by email, a report like the one in a presentation: the acts published recently that would concern it. We write only to a work address the business makes public (on its website, in the registers or in business directories), never to a personal address, and only when the service relates to its activity. Each message is sent individually, says where we found the address, links to this policy and lets you refuse with a simple reply.

We keep a list of the businesses we presented the service to or wrote to: the AFM, name, legal form, main KAD code, date of the presentation and how many acts would have been relevant, and for those we wrote to, the email address and the correspondence. For a sole trader the name contains a person's name, so it is personal data; so is an email address that contains someone's name.

The legal basis is our legitimate interest in presenting the service (Art. 6(1)(f) GDPR). The data is deleted 12 months after the last presentation or the last message or, sooner, at the business's request. You can object at any time by replying to the message or writing to the contact address in section 1. We then delete the business's data and keep only the email address, so that we do not write to you again.

The automatic match (“relevant”, “may be relevant”, “not relevant”) is the result of an automated evaluation: we compare the business's details with the scope of each act, extracted automatically from the official text. The evaluation is informational, has no legal effect on you and takes no decision on your behalf. You can correct it at any time by marking an act as being or not being yours.

Summaries are generated with an artificial intelligence model, starting only from the public text of the acts. We do not send your data or your business's data to the model provider: an act's summary is generated once and is the same for every user, and the matching against the business is done in our own system.

We use providers that process data on our behalf, under data processing agreements:

• Hetzner Online GmbH (Germany): hosting of the application and the database, in data centres in the European Union.
• Clerk, Inc. (USA): authentication, meaning the email address, name and session data.
• Resend, Inc. (USA): sending email, meaning the email address and message content.

Email correspondence with us, including messages to businesses we write to about the service, goes through Papaki (Greece), which hosts the lexalia.gr mailboxes, and through Gmail, the email service of Google Ireland Limited, where it is read and answered.

Paddle (Paddle.com Market Limited, United Kingdom, and its affiliates) processes subscription payments as Merchant of Record and is an independent controller for payment and billing data, under its own privacy policy.

When you order, we send Paddle the account's email address and the business's details: its name, AFM, VAT number (if any) and registered office, as recorded in GEMI, so that the invoice is issued in the business's name.

We may disclose data to authorities where the law requires it. We do not sell your data and do not use it for advertising.

The database is hosted in the European Union. The United States providers (authentication, email) and Google, for correspondence through Gmail, may process the data listed above outside the EEA; those transfers rely on the standard contractual clauses adopted by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework. Transfers to the United Kingdom rely on the European Commission's adequacy decision.

• Account and business data: for as long as the account exists. When the account is deleted they are removed immediately and permanently.
• The AFM of a business that used the free month, and the dates of that month: also after the account is deleted, with no link to the account or to the person who opened it, so that the free month can be given only once per business (legitimate interest, Art. 6(1)(f) GDPR).
• The content of emails sent: 90 days.
• Database backups: at most 30 days, after which they are overwritten.
• The audit log: keeps the fact that an action took place; after the account is deleted it no longer contains data identifying you.
• Access requests that were not completed: at most 12 months.
• Businesses we presented the service to or wrote to: 12 months after the last presentation or the last message.
• Turnover taken from the statements published in GEMI: for as long as the account exists; for businesses we presented the service to, 12 months after the last presentation. The turnover and number of employees you gave us: until you delete them or the account.
• The email address of a business that asked us not to write again: for as long as needed so that we do not write again.
• Billing documents: for the period required by tax and accounting law, by the Merchant of Record.

The legislation monitored and its summaries are not personal data and remain in the system.

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time where processing is based on it.

Two of them you can exercise directly: Settings → Download my data (access and portability) and Settings → Delete account (erasure, immediate and irreversible). For the others write to us at the contact address; we reply within one month.

If you consider that your data is processed unlawfully you may lodge a complaint with the data protection authority of the country where you live or work. In Greece this is the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr. As the controller is established in Romania, its lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.

Data is transmitted encrypted, access to it is restricted and logged, and each account sees only its own organisation's data. No system is completely secure; if we learn of a security breach affecting your data we will notify you as the law requires.

The service is for professionals and is not intended for anyone under 18.

We may update this policy. The version in force is the one published here, with its date of last update; material changes are communicated to you by email.