Tell us how you work today.
In 30 minutes we show you Legis on your real documents — your frameworks, your method.
Privacy Policy
Notice pursuant to Regulation (EU) 2016/679 (GDPR) and to Legislative Decree 196/2003 as amended, concerning the processing of the personal data of users of the website legis.eu.
This notice describes how the personal data of users who visit the website legis.eu (the "Website") are processed. It does not apply to other websites the user may reach through links on the Website, including the website of the Lio product, which has its own separate notice. If you use the Legis platform, see the Platform Privacy Notice.
Data Controller
The controller of personal data is:
Categories of data processed
a) Browsing data
The computer systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. By way of example:
- IP address
- System logs and user-agent
- URIs of the requested resources
- Date and time of the request
- Server response status
- Parameters relating to the user's operating system and computing environment
b) Data voluntarily provided by the user
The optional, specific and voluntary sending of communications to the email addresses shown on the Website results in the acquisition of the sender's address and of any other personal data contained in the message, including first name, last name, company, role, telephone number and the content of the request.
The Website also hosts contact forms. The «Let's talk» form, available from every page, collects full name, work email, number of clients managed, frameworks of reference and a free-text description of how they are managed today. The form on the «About us» page collects name, company, work email and a free-text description. Providing this data is optional, but without an email address it is not possible to respond to the request. The data submitted is delivered to the Controller by email and does not feed any profiling activity.
Purposes of processing and legal bases
3.1 Handling requests for information
Purpose: to handle and respond to requests sent by the user through the Website's contact forms or by email (information, demos, quotes) and to manage the related contacts and follow-ups.
Legal basis: performance of pre-contractual measures taken at the request of the data subject (art. 6(1)(b) GDPR).
Provision: necessary in order to receive a response; without it, the request cannot be handled.
3.2 Website security and operation
Purpose: to ensure security, prevent abuse and malfunctions, manage any incidents and protect the Controller's rights.
Legal basis: legitimate interest (art. 6(1)(f) GDPR).
3.3 Legal obligations and protection of rights in court
Purpose: to comply with legal obligations or to exercise/defend a right.
Legal basis: legal obligation (art. 6(1)(c) GDPR) and/or legitimate interest (art. 6(1)(f) GDPR), depending on the circumstances.
Processing methods and security measures
Personal data are processed using appropriate IT tools and organisational procedures, for the time strictly necessary to achieve the stated purposes, adopting technical and organisational measures to prevent unauthorised access, loss, alteration or improper disclosure.
No processing involving automated decisions pursuant to art. 22 GDPR with legal effects or similarly significant effects on the data subject is carried out.
Retention periods
Recipients of data
Data may be processed by parties operating on behalf of Legis, such as:
- Amazon Web Services — hosting of the Website and content delivery network
- Cloudflare — network services and protection of the forms against automated submission (Turnstile)
- Supabase — processing of the data submitted through the contact forms
- Resend — delivery to the Controller of the emails generated by the forms
- Google — visit statistics (Google Analytics 4), only with prior consent
- External consultants and professionals, maintenance and support services
Such parties are appointed, where necessary, as data processors pursuant to art. 28 GDPR, or act as independent controllers in the cases provided for. An up-to-date list of data processors may be requested by writing to [email protected].
Transfer of data outside the EEA
As a rule, data are processed within the European Economic Area. Some of the providers listed in the previous section — in particular Google for visit statistics, and Cloudflare and Resend for network and email delivery services — are based in the United States or may involve access to data from countries outside the EEA. Legis ensures that such transfers take place in compliance with Chapter V GDPR, by means of:
- Adequacy decision
- Standard Contractual Clauses (SCCs)
- Supplementary measures where necessary
Data subject rights
The user may exercise the rights provided for in arts. 15–22 GDPR, including:
- Access to their personal data
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Restriction of processing
- Data portability
- Objection to processing
- Withdrawal of consent at any time
To exercise these rights you may write to [email protected] or, by certified email (PEC), to [email protected].
The user also has the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Changes to this notice
Legis may update this notice at any time. In the event of changes, the "Last updated" date will be revised and, where appropriate, adequate notice will be given on the Website.