Privacy Policy / Datenschutzerklärung

1. Data Controller

The entity responsible for data collection and processing is:

Please note: Our Irish phone number connects you to our central support team in Germany. We do not maintain a physical office in Ireland.

LexLogik UG is established in the European Union (Germany); Article 27 GDPR (representative outside the Union) does not apply. Where applicable, supervisory questions can be addressed to the Irish Data Protection Commission (DPC) - see section 11.

2. Collection and Storage of Personal Data

When you access our website, your browser automatically sends information to our website server (log files).

• Information: IP address, date/time, accessed file, referrer URL, browser type/operating system.
• Purpose: Ensuring a smooth connection, system security, and administration.
• Legal Basis: Art. 6 (1) (f) GDPR (legitimate interest).

Retention: Log files are deleted automatically after 14 days unless a security-relevant incident requires extended retention.

Business outreach & onboarding emails

Where we send you informational or follow-up emails about LexLogik to a business email address (for example after a phone call, an introduction, or as part of a 12-day onboarding series for individuals who filled in the login form), we process your email address, optionally your name and firm, and the context of the outreach.

• Legal basis: legitimate interest in B2B business development with regulated professionals (Art. 6 (1) (f) GDPR). Where a freely given consent is in place (for example, ticking a newsletter checkbox on the login form), the legal basis is consent (Art. 6 (1) (a) GDPR), which can be withdrawn at any time.
• Processors: email delivery via our processor Mailgun (Sinch); editorial outreach may also be sent from our ordinary business inboxes.
• Retention: until you object or the purpose lapses. If you opt out via the unsubscribe link, your address is moved to a suppression list.

Suppression list: we keep your unsubscribed email address together with the date of the opt-out for the sole purpose of reliably excluding it from future LexLogik mailings. This processing rests on our overriding interest in honouring your objection on a lasting basis (Art. 6 (1) (f) GDPR, see Recital 47); deleting the suppression list would undermine that protection.

3. Cloudflare (Security & Performance)

We use services from Cloudflare, Inc. (USA/EU) to protect our infrastructure against bot attacks (DDoS) and to optimize website loading times.

• Important: Cloudflare is only used for the delivery of the web interface. Documents uploaded for processing are transmitted directly to our servers in Germany and do not pass through Cloudflare's infrastructure.
• Legal Basis: Art. 6 (1) (f) GDPR (IT infrastructure security).
• International transfers: Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF); transfers to the US rely on the DPF and, where required, on EU Standard Contractual Clauses.

4. Stripe (Payment Processing)

For the billing of "Counsel" and "Professional" plans, we use the payment service provider Stripe (Stripe Payments Europe Ltd., Ireland / Stripe Inc., USA).

• When you subscribe to a paid plan, your payment data (credit card, bank details) is transmitted directly to Stripe. LexLogik does not store full credit card information.
• Legal Basis: Art. 6 (1) (b) GDPR (performance of a contract).
• International transfers: Stripe is certified under the EU-U.S. Data Privacy Framework (DPF); transfers to the US rely on the DPF and, where required, on EU Standard Contractual Clauses.

5. Self-hosted Analytics (Data Privacy Focused)

We do not use Google Analytics or Meta Pixels. For statistical analysis of page views, we use a self-hosted analysis tool on our own servers in Germany.

• IP addresses are anonymized immediately.
• No data is passed on to third parties.
• Legal Basis: Art. 6 (1) (f) GDPR (reach measurement without personal reference).

6. Cookies

Today we only use cookies we classify as strictly necessary to operate and secure the service (for example login/session integrity). We do not deploy advertising or analytics cookies on this marketing site as described in section 5.

• Under the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011), Reg. 5, consent is typically required for non-essential cookies and similar storage. We currently use only cookies that we classify as strictly necessary; what counts as strictly necessary depends on purpose and current Data Protection Commission (DPC) guidance, which can evolve.
• If we introduce optional analytics or marketing cookies (or similar tags), we will obtain consent through a banner before setting them.

7. Disclosure of Data

Your content data (documents) is never passed on to third parties unless there is a legal obligation. For payment processing, only the necessary master data is transmitted to Stripe.

8. Uploaded documents (Zero-Retention architecture)

Documents that you upload for processing (PDFs, images, scans, attachments) are handled under a strict zero-retention paradigm. We use a least-data approach designed for the confidentiality requirements of Irish solicitors and the duty of confidentiality under the Solicitors Acts and the Law Society of Ireland's Guide to Professional Conduct.

• Processing in volatile environments: document content is processed in volatile RAM instances or temporarily encrypted session partitions on dedicated hardware in Germany.
• Automatic deletion: source files and processed results are deleted immediately after the workflow ends (download or session close); we do not create backups of client document content.
• No AI training: document content is never used to train, fine-tune or evaluate machine learning models - neither ours nor any third party's.
• No third-party AI APIs: OCR and analysis run on our own infrastructure; document content is not sent to OpenAI, Google, Anthropic or other external AI providers.
• Legal basis: Art. 6 (1) (b) GDPR (performance of contract) for processing requested by you, combined with technical and organisational measures under Art. 32 GDPR.

9. Data Security

We use strong encryption (TLS 1.3 in transit, AES-256 at rest where data is stored at all). Production systems are hosted in Germany with Hetzner Online GmbH in ISO 27001-certified data centres; we maintain strict access controls, multi-factor authentication for administrative access and audit logging for our systems and operations. Further detail is available in our Technical and Organisational Measures (TOMs) and the data sheet linked from the security whitepaper.

10. Sub-processors

We engage a small set of vetted sub-processors strictly for operating the service. Engagement is governed by data processing agreements compliant with Art. 28 GDPR.

• Hetzner Online GmbH (Germany) - hosting of dedicated servers and ISO 27001-certified data centres for document processing infrastructure.
• Cloudflare, Inc. (USA/EU) - DDoS mitigation and frontend delivery for the marketing website. Document content is not routed through Cloudflare (see section 3).
• Stripe Payments Europe Ltd. / Stripe, Inc. (Ireland / USA) - payment processing for paid plans (see section 4).
• Email and transactional infrastructure for account, billing and support communications.

We will inform customers of any changes to this list in line with our DPA. A current sub-processor list is available on request at info@lexlogik.com.

11. Your Rights (Data Subject Rights)

Under the GDPR and the Irish Data Protection Act 2018, you have the right to:

• Access (Art. 15), Rectification (Art. 16), and Erasure (Art. 17).
• Restriction of processing (Art. 18) and Data portability (Art. 20).
• Object to processing (Art. 21) and withdraw consent (Art. 7 (3)) at any time.
• Complaint: You have the right to lodge a complaint with the Irish supervisory authority - the Data Protection Commission (DPC).

We typically respond to data subject requests within one month (Art. 12 (3) GDPR). To exercise your rights, please email info@lexlogik.com.

Right to object to direct marketing (anytime, free of charge, no formalities)

You have the right to object at any time to processing of your email address for direct-marketing purposes (sales follow-ups, onboarding tips, future campaigns) under Art. 21 (2) GDPR. After such an objection, we will no longer use your address for these purposes.

In practice: every marketing email we send ends with an unsubscribe link. A single click is sufficient; no confirmation reply or sign-in is required. The unsubscribed address is added to our suppression list and excluded from all LexLogik outbound channels (sales follow-ups, onboarding, future campaigns).

Alternatively, a plain email to info@lexlogik.com is enough; we will remove the address from our distribution list manually.

12. Automated decision-making and profiling

We do not carry out automated decision-making within the meaning of Art. 22 GDPR (decisions producing legal or similarly significant effects on individuals without human involvement) and we do not engage in profiling on this service.

13. Personal data breaches

In the event of a personal data breach, we notify the Data Protection Commission (DPC) without undue delay and, where feasible, within 72 hours of becoming aware of the breach in line with Art. 33 GDPR. Where the breach is likely to result in a high risk to data subjects' rights and freedoms, we will notify affected individuals without undue delay in line with Art. 34 GDPR.