Privacy policy

The controller of your data is:

For any request concerning personal data you can write to the email address above.

• Account data: email address, name (if you give one), chosen language and notification preferences.
• The business details you confirm: CUI, name, legal form, CAEN codes, VAT status and the activity attributes you declare. For sole traders and liberal professions these details can identify a natural person, and we treat them as personal data.
• Data about your use of the service: the acts you track, those you mark as being or not being yours, notifications read and the emails we have sent you.
• Evidence of agreement: the date you accepted the terms and the privacy policy, the version accepted and a truncated form of the IP address.
• Technical data: access and security logs, including IP address and browser type.
• Access requests: if you asked for access through the form on the site, the details entered there.

We do not collect special categories of data and we do not ask for card details: payments are processed by Paddle, and we have no access to the payment instrument's data.

• To provide the service (the account, the notifications, the personalised feed), on the basis of performance of the contract (Art. 6(1)(b) GDPR).
• For the security of the service, preventing abuse, audit logs and defending our rights, on the basis of legitimate interest (Art. 6(1)(f) GDPR).
• To comply with legal obligations, for example tax and accounting ones (Art. 6(1)(c) GDPR).
• For cookies or technologies that are not strictly necessary, only with your consent (Art. 6(1)(a) GDPR). We currently use none.

The emails we send you are part of the service you asked for. You can unsubscribe at any time, with one click, from any email or from Settings.

From official public registers: ANAF (VAT status, activity status and, from the annual financial statements ANAF publishes, turnover and average number of employees) and the Trade Register, through the open data published on data.gov.ro (CAEN codes, legal form). We take them from the CUI you enter and you confirm them before they are saved. Turnover and the number of employees are updated monthly from the same source: turnover is as reported, and you can change the number of employees in your profile.

When we present LexAlia to a business, we enter its CUI and take the public data about it from the ANAF and Trade Register records (name, legal form, CAEN codes, registered office, and turnover and average number of employees from its published financial statements) to show which published acts would concern it.

We may send a business, by email, a report like the one in a presentation: the acts published recently that would concern it. We write only to a work address the business makes public (on its website, in the registers or in business directories), never to a personal address, and only when the service relates to its activity. Each message is sent individually, says where we found the address, links to this policy and lets you refuse with a simple reply.

We keep a list of the businesses we presented the service to or wrote to: the CUI, name, legal form, main CAEN code, date of the presentation and how many acts would have been relevant, and for those we wrote to, the email address and the correspondence. For a sole trader (PFA) or an individual or family business, the name contains a person's name, so it is personal data; so is an email address that contains someone's name.

The legal basis is our legitimate interest in presenting the service (Art. 6(1)(f) GDPR). The data is deleted 12 months after the last presentation or the last message or, sooner, at the business's request. You can object at any time by replying to the message or writing to the contact address in section 1. We then delete the business's data and keep only the email address, so that we do not write to you again.

The automatic match (“relevant”, “may be relevant”, “not relevant”) is the result of an automated evaluation: we compare the business's details with the scope of each act, extracted automatically from the official text. The evaluation is informational, has no legal effect on you and takes no decision on your behalf. You can correct it at any time by marking an act as being or not being yours.

Summaries are generated with an artificial intelligence model, starting only from the public text of the acts. We do not send your data or your business's data to the model provider: an act's summary is generated once and is the same for every user, and the matching against the business is done in our own system.

We use providers that process data on our behalf, under data processing agreements:

• Hetzner Online GmbH (Germany): hosting of the application and the database, in data centres in the European Union.
• Clerk, Inc. (USA): authentication, meaning the email address, name and session data.
• Resend, Inc. (USA): sending email, meaning the email address and message content.

Email correspondence with us, including messages to businesses we write to about the service, goes through Gmail, the email service of Google Ireland Limited.

Paddle (Paddle.com Market Limited, United Kingdom, and its affiliates) processes subscription payments as Merchant of Record and is an independent controller for payment and billing data, under its own privacy policy.

When you order, we send Paddle the account's email address and the company's details: its name, CUI, VAT number (if any) and registered office, as taken from ANAF, so that the invoice is issued in the company's name.

We may disclose data to authorities where the law requires it. We do not sell your data and do not use it for advertising.

The database is hosted in the European Union. The United States providers (authentication, email) and Google, for correspondence through Gmail, may process the data listed above outside the EEA; those transfers rely on the standard contractual clauses adopted by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework. Transfers to the United Kingdom rely on the European Commission's adequacy decision.

• Account and business data: for as long as the account exists. When the account is deleted they are removed immediately and permanently.
• The CUI of a business that used the free month, and the dates of that month: also after the account is deleted, with no link to the account or to the person who opened it, so that the free month can be given only once per business (legitimate interest, Art. 6(1)(f) GDPR).
• The content of emails sent: 90 days.
• Database backups: at most 30 days, after which they are overwritten.
• The audit log: keeps the fact that an action took place; after the account is deleted it no longer contains data identifying you.
• Access requests that were not completed: at most 12 months.
• Businesses we presented the service to or wrote to: 12 months after the last presentation or the last message.
• Turnover and number of employees taken from ANAF: for as long as the account exists; for businesses we presented the service to, 12 months after the last presentation.
• The email address of a business that asked us not to write again: for as long as needed so that we do not write again.
• Billing documents: for the period required by tax and accounting law, by the Merchant of Record.

The legislation monitored and its summaries are not personal data and remain in the system.

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time where processing is based on it.

Two of them you can exercise directly: Settings → Download my data (access and portability) and Settings → Delete account (erasure, immediate and irreversible). For the others write to us at the contact address; we reply within one month.

If you consider that your data is processed unlawfully you may lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.

Data is transmitted encrypted, access to it is restricted and logged, and each account sees only its own organisation's data. No system is completely secure; if we learn of a security breach affecting your data we will notify you as the law requires.

The service is for professionals and is not intended for anyone under 18.

We may update this policy. The version in force is the one published here, with its date of last update; material changes are communicated to you by email.