Privacy Policy

Section 1Who We Are

1.1 This Privacy Policy is issued by LexGate B.V. ("LexGate", "we", "us"), a private limited liability company incorporated under the laws of the Netherlands, registered with the Dutch Commercial Register (KVK) under number 42147145, with its registered office at IJsbaanpad 2, 1076 CV Amsterdam, the Netherlands.

1.2 For the personal data described in Section 2(a) and 2(b) below, LexGate acts as the data controller. General queries: [email protected]. Privacy queries and requests to exercise a right under Section 9: [email protected], handled by LexGate's Compliance & Data Protection Lead. LexGate has assessed that, given the scale and nature of its processing, a statutory Data Protection Officer under Article 37 GDPR is not currently required, and will revisit that assessment as the business grows.

Section 2Scope of This Policy

This Policy explains how we process personal data in three distinct capacities. Which part applies to you depends on your relationship with us:

• (a) Website visitors and enquirers — if you browse our website or submit the contact form, Sections 3–5, 10 and 11 apply, and LexGate is the controller.
• (b) Client Users — if you are a director, employee or contractor of a Client authorised to use the Platform, Sections 3–5, 8, 9 and 11 apply to your own account and activity data, and LexGate is the controller of that account data.
• (c) Individuals named or referenced in an Order — if you are a subscriber, user or customer of one of our Clients, and your data is the subject of a European Production Order or European Preservation Order that our Client (as addressee's principal) is required to answer, LexGate processes your personal data strictly as a processor, acting on our Client's documented instructions and within the bounds of the Applicable e-Evidence Legislation. LexGate does not decide what data is disclosed, to whom, or on what legal basis — those are decisions for the issuing authority, our Client, and, where relevant, our Client's own privacy notice. Section 6 explains this in more detail, and Section 9 explains why some of the rights described in Section 8 may not be available, or may be delayed, in this scenario.

Section 3Personal Data We Process

• Contact-form and enquiry data: name, work email address, company name, country, service category, and any message you send us.
• Client User data: name, business contact details, role, authentication and access logs, and records of approvals or decisions taken through the Platform.
• Order-related data (processed as processor only): the identifiers, categories of data (subscriber, traffic or content data, as defined in Article 3 of the Regulation) and other information contained in or generated by an Order, limited to what that Order specifies.
• Technical and usage data: IP address, device and browser information, and cookies or similar identifiers (see Section 10).

Section 4Why We Process It, and Our Legal Basis

4.1 Responding to your enquiry and taking steps towards a possible Mandate: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, where no Mandate follows, Article 6(1)(f) GDPR (our legitimate interest in responding to enquiries addressed to us).

4.2 Operating the Platform and performing our role as legal representative: Article 6(1)(c) GDPR (compliance with our own legal obligations as addressee under the Directive and the Regulation), together with Article 6(1)(b) GDPR (performance of the Mandate) and, in respect of Order-related data, our Client's instructions under Article 28 GDPR and the applicable Data Processing Agreement.

4.3 Security, fraud prevention and maintaining the integrity of the audit trail: Article 6(1)(f) GDPR and, in respect of our own record-keeping obligations as legal representative, Article 6(1)(c) GDPR (see Article 3(5) of the Directive).

4.4 Where an Order concerns content data that may reveal special categories of personal data within the meaning of Article 9 GDPR, we process this strictly in our capacity as processor, on our Client's instructions, relying on the legal basis identified by our Client and the issuing authority (which will typically be Article 9(2)(f) or (g) GDPR and the corresponding provision of the Dutch GDPR Implementation Act (Uitvoeringswet AVG)), without independently determining the purpose of that processing.

4.5 Understanding how our public website is used: Article 6(1)(a) GDPR (your consent), given through our cookie banner, together with Article 11.7a of the Dutch Telecommunications Act. You may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Section 5Who We Share Data With

• The competent issuing or enforcing judicial authority, transmitted via the EU decentralised IT system, strictly to the extent required to acknowledge, respond to, or report on an Order.
• The central authority of the Member State of Appointment, for the purpose of the Article 4 notification (business contact details only — not Order content).
• Sub-processors that host or support the Platform, all located within the EU/EEA in the ordinary course, engaged under written agreements imposing obligations equivalent to those in this Policy. A current list of sub-processors is available on request.
• Our professional advisers, auditors and insurers, where reasonably necessary and under a duty of confidentiality.
• Google Ireland Limited, as our analytics processor for our public website only, and only once you have accepted analytics cookies (Section 10). No Order-related data, and no data from the Platform, is shared with Google.

We do not sell personal data, and we do not use it for advertising. We do not disclose Order-related data to any party other than as instructed by our Client, required by the Applicable e-Evidence Legislation, or otherwise required by law.

Section 6Our Role When We Handle an Order

6.1 In relation to personal data contained in or generated by an Order, our Client — the service provider to whom the Order is in substance addressed, and for whom we act as legal representative — is the controller. We act as processor (or, in respect of our own independent statutory obligations as addressee, as a party with our own limited compliance duties) and process that data only on our Client's documented instructions, save where the Applicable e-Evidence Legislation itself requires us to act, or refrain from acting, in a particular way.

6.2 Detailed terms governing our processing of Order-related data as processor, including security measures, sub-processing, audit rights and international transfer safeguards, are set out in the Data Processing Agreement entered into with each Client. In the event of any inconsistency between this Policy and a Data Processing Agreement, the Data Processing Agreement prevails as between LexGate and that Client.

Section 7International Transfers

7.1 The Platform runs on infrastructure resident in the EU/EEA, and personal data is not transferred outside the EU/EEA in the ordinary course of providing the Services.

7.2 Where a limited transfer outside the EU/EEA is unavoidable (for example, third-line technical support), we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism recognised under Chapter V GDPR, together with appropriate supplementary measures.

7.3 Separately, if you accept analytics cookies on our public website, website-usage data may be transferred to Google LLC in the United States. That transfer is made under the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, to which Google LLC is certified, supported by the Standard Contractual Clauses (see Section 10). This concerns website visitors only. It never concerns Order-related data.

Section 8How Long We Keep Data

• Website enquiries that do not lead to a Mandate: 24 months from the date of last contact.
• Client User account data: for the duration of the Mandate and for seven (7) years after termination, aligned to Dutch statutory and fiscal record-keeping practice and the periods within which a related claim could reasonably still be brought.
• Order records and the associated audit trail: retained unaltered for the longer of (i) any period specified by the issuing or enforcing authority, and (ii) ten (10) years, reflecting our own record-keeping obligations as legal representative under Article 3(5) of the Directive and the potentially long lifecycle of a cross-border criminal proceeding. Retention of the underlying Client Data within an Order otherwise follows our Client's instructions and the applicable Data Processing Agreement.

Section 9Your Rights

9.1 Subject to the conditions and exemptions in the GDPR and the Uitvoeringswet AVG, you may have the right to request access to, rectification of, or erasure of your personal data, to restrict or object to its processing, to request portability, to withdraw consent (where processing is based on consent), and to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority of your habitual residence or place of work.

9.2 If you are an individual referenced in an Order (Section 2(c)), please direct any such request in the first instance to our Client, as controller of that data — we will assist our Client in responding where required to do so under our Data Processing Agreement. We may not be able to confirm to you whether an Order exists or what it concerns: under Article 15 of the Regulation (Confidentiality and information of the user/data subject), it is the issuing authority that must inform the person whose data was requested, and it may defer or withhold that information where the conditions of that Article are met. Where we are instructed accordingly, we and our Client are or may be under a statutory duty of confidentiality, and your rights under Section 9.1 will be restricted or delayed, to the extent permitted by Article 23 GDPR and Article 41 of the Uitvoeringswet AVG, for so long as that duty applies.

Section 10Cookies and Similar Technologies

10.1 We only place cookies that are strictly necessary for the website or Platform to function without your consent, in accordance with Article 11.7a of the Dutch Telecommunications Act. Any analytics or marketing cookies are placed only with your prior consent, given through our cookie banner, and you may withdraw that consent at any time using the Cookie settings link in the footer of any page of this website. Refusing is exactly as easy as accepting, and refusing costs you no functionality.

10.2 Nothing is sent to our analytics provider before you accept. If you decline, or simply ignore the banner, no analytics script is loaded and no request is made to Google at all.

10.3 Analytics are used on our public website only. We do not operate analytics, advertising, or any other non-essential tracking inside the e-Evidence Platform, and we never link website-usage data to a Client account, a Mandate, or an Order.

10.4 The categories of cookie we use are:

10.5 Our analytics provider is Google Analytics 4, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which processes this data as our processor on our documented instructions. We have configured it to the minimum that still tells us how our public website is used: Google Signals and advertising features are disabled, no advertising or remarketing audiences are built from this traffic, no personal identifier you give us is ever uploaded to or joined with it, and measurement is limited to pages viewed and whether an enquiry form was completed. Analytics data is retained for no more than 14 months. Google’s own privacy notice is available at policies.google.com/privacy.

10.6 If we later introduce marketing cookies or a new analytics provider, we will update this table and, where required, ask for your consent before they are set.

Section 11Security

11.1 We use mutually-authenticated TLS for the transmission of Orders, tenant isolation, role-based access controls, encryption of data at rest, and logging and monitoring designed to detect unauthorised access. We maintain an incident-response process and will notify affected parties and, where required, the Autoriteit Persoonsgegevens, in accordance with Articles 33 and 34 GDPR.

Section 12Children

12.1 Our website and Platform are directed at businesses and professionals and are not intended for use by children. We do not knowingly collect personal data from children.

Section 13Changes to This Policy

13.1 We may update this Policy from time to time. We will post the updated version on our website with a revised "last updated" date and, where a change is material, notify Client Users through the Platform.

Section 14Contact Us

If you have a question about this Policy or wish to exercise a right described in Section 9, please contact us at [email protected] or by post at LexGate B.V., IJsbaanpad 2, 1076 CV Amsterdam, the Netherlands. You also have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).