Legitech ensures the protection of the rights of data subjects when processing their personal data, in accordance with applicable legislation, in particular the Law of 1 August 2018 on the organization of the National Commission for Data Protection and the general regime on data protection, as well as the General Data Protection Regulation ("GDPR").

This policy explains how personal data is collected, processed, and used by Legitech in the context of accessing, consulting, and using the website accessible at www.legitech.lu (le « Site »).

Users may also consult the general terms and conditions relating to the access, consultation, and use of the Site (the "General Terms of Use" or "GTU"), as well as Legitech's general terms and conditions of sale (the "General Terms of Sale" or "GTS").

Définitions

In this personal data management policy, words or expressions beginning with a capital letter have the following meaning:

• Site: this website, accessible notably at www.legitech.lu ;
• User Content: data transmitted by the User in the various sections of the Site;
• User: any person who visits one or more pages of the Site or uses one of the services offered on the Site, including services requiring identification of the User, specifically by means of an email address and a password.

Data Controller

The controller for the processing of personal data of Site Users is:

Legitech S.à r.l.

• 1, rue Pletzer – 2ème étage
• L-8080 Bertrange
• Luxembourg
• Registered with the Luxembourg Trade and Companies Register under number B.113932.

For any questions regarding the processing of your personal data, you may contact us:

• By e-mail : [email protected] ;
• By phone : +352 26 31 64 -1, du lundi au vendredi, de 8h30 à 17h30.

Methods and Timing of Data Collection and Processing

Personal data is any information relating to an identified or identifiable natural person, directly or indirectly.

Legitech collects and processes personal data when a User:

• contacts Legitech;
• logs in as a User using their username and password;
• registers for a workshop, training, or any other event organized by Legitech, notably through a third-party management or form-editing platform;
• is photographed during such events;
• subscribes to journals published by Legitech;
• purchases a product or service marketed on the Site online;
• posts a comment on the Site or submits an advertisement in the "careers" section, when these features are available.

To contact Legitech through the Site, the User may be invited to complete a form. Certain fields are mandatory and are identified as such by an asterisk. The information provided is necessary to allow Legitech to respond to the User's request, provide the requested service and, where applicable, offer the most relevant content or response according to their centers of interest.

Types of Data Collected and Processed

The simple consultation of the Site does not result in the recording of personal data, with the exception, where applicable, of data collected through cookies or similar technologies.

When the User identifies themselves on the Site, contacts Legitech, registers for a workshop, training, or event, subscribes to a publication, or makes a purchase through the Site, Legitech may collect personal data regarding the User or, where applicable, members of their organization.

This data is specifically collected to allow Legitech to communicate with the User, develop statistics, manage access rights, requests, opinions, or complaints, manage payments and unpaid debts, and more generally, perform its contractual obligations.

Depending on how the User enters into contact with Legitech and the purpose pursued, the data collected may include, to the extent necessary and without this list being exhaustive:

• identification data, such as surname, first name, postal address, email address, telephone number, and gender;
• where applicable, bank identification data necessary for payment management;
• personal data potentially contained in the text of a request or message addressed to Legitech;
• information appearing on the student card of a workshop participant, or on any other document justifying a status granting the right to a preferential rate;
• photographs taken during workshops, training, or events organized by Legitech, which may be published on social networks, notably LinkedIn and Twitter, as part of the promotion of these activities.

In the absence of an objection from the data subject during the collection of their personal data, this data may be used by Legitech for electronic prospecting purposes to promote services similar to those offered on the Site or related to the online legal databases offered by Legitech, notably LexNow.

Data subjects may object, without having to justify their request, to any further processing of their data for electronic prospecting purposes, by using the method indicated in the electronic communications received for this purpose.

All such data is collected when the User completes an electronic form or addresses a request to Legitech.

Purposes of Processing

Legitech processes the collected data for the following purposes:

• allowing access to the Site and certain of its features for duly authorized Users;
• administering the services offered on the Site, including managing orders, subscriptions, payments, unpaid debts, and customer relationship monitoring;
• promoting, where applicable, other similar Legitech products and services, notably through promotional offers;
• managing contact requests made through the Site;
• sending, particularly in the context of workshops, training, and journal subscriptions, information relating to Legitech products and services to persons who have completed a contact form and agreed to the storage and use of their data for this purpose by checking the box provided;
• enabling Legitech to comply with its contractual and legal obligations;
• carrying out, where applicable, anonymous statistics relating to the use of the Site and/or analyzing technical incidents or problems to improve the Site and its IT performance;
• enriching and improving Legitech's offer of products and services to better meet the expectations of Users and customers;
• managing requests relating to the right of access, rectification, objection and, more generally, the exercise of rights relating to personal data;
• managing opinions, incidents, complaints, and disputes.

Recipients of Personal Data

Personal data collected by Legitech is processed internally by duly authorized persons, within the limit of their respective duties.

It may also be communicated, to the extent strictly necessary, to:

• competent administrative or judicial authorities;
• Legitech's subcontractors and external service providers, notably IT providers and consultants, accountants, commercial partners, communication companies, and legal service providers;
• third-party buyers in the event of a change of control, restructuring, or transfer of Legitech's assets.

In all cases, these communications occur subject to appropriate contractual and organizational guarantees designed to ensure the security and confidentiality of the data concerned.

Legal Basis for Processing and Retention Period

The personal data collected and processed by Legitech is necessary for the execution of the services requested by the User and for the execution of Legitech's contractual obligations toward its customers.

Certain processing operations are also based on Legitech's legitimate interest, notably to enrich and improve its offer of products and services and to better meet the expectations of Users and customers.

General commercial prospecting toward contacts is based on the prior agreement of the data subject.

These purposes constitute the legal bases for the processing carried out by Legitech.

Legitech ensures respect for User rights as set out below. Legitech also undertakes to implement appropriate technical and organizational security measures to protect personal data against risks related to the use of information systems.

Data is kept for the following durations:

• Purchases made on the Site: personal data collected in this context is kept for a period of ten (10) years, corresponding to the applicable statute of limitations. When Legitech collects additional personal data as part of the verifications referred to in Article 5.4 of the GTS, this data is kept for a maximum period of three (3) months from the shipment of the order concerned, unless there is a compelling reason duly justified by Legitech.
• Event registration: personal data collected in the context of registration for a workshop, training, or journal-related event is kept for a period of ten (10) years, corresponding to the applicable statute of limitations.
• Online User Account: personal data transmitted by the User having created an account using a username and password is kept for as long as the account remains open. It is erased as soon as the account is closed, at the initiative of the User or Legitech.
• Contact, information, or assistance requests: data transmitted in this context is kept for a maximum period of three (3) years from its collection or the last contact from the User.
• Comments and advertisements in the "careers" section: personal data transmitted in the context of a comment published on the Site or an advertisement published in the "careers" section is kept for a maximum period of three (3) months from the account closure, the deletion of the comment, or the publication, at the initiative of the User or Legitech, or upon request of any person justifying a legitimate interest, unless there is a compelling reason duly justified by Legitech.
• IT data and connection data: data generated as a result of accessing the Site and/or using the LexNow website, including in particular programs, connection data, files, logs, operations, and other elements on IT or electronic media, may be kept and archived within the limits provided by law, within Legitech's IT system, under conditions allowing its integrity to be guaranteed.

User Rights Regarding Their Personal Data

In accordance with applicable legislation, the User or, where applicable, their successors justifying a legitimate interest, may obtain free of charge:

• access to data concerning them;
• confirmation as to whether or not data concerning them is being processed;
• information relating, in particular, to the purposes of the processing, the categories of data concerned, and the recipients or categories of recipients to whom this data is communicated;
• communication, in an intelligible form, of the data being processed, as well as any available information as to its origin.

The User, or where applicable their successors, also has a right to rectify data concerning them as well as a right to object to the collection and processing of such data, subject to justifying overriding and legitimate reasons where applicable legislation so requires.

Since 25 May 2018, the User also has the following rights, within the limits provided by the applicable rules:

• a right to erasure of all or part of their data;
• a right to restriction of processing;
• a right to object to processing;
• a right to data portability.

These rights may be exercised by postal mail addressed to Legitech or by email to the address [email protected]. Legitech may request any information or document necessary to verify the identity of the applicant.

The data subject also has the right to lodge a complaint with a competent supervisory authority, such as the National Commission for Data Protection ("CNPD"), in the event of a breach of the rules applicable to the protection of personal data.

The data subject may object at any time to the use of their data by Legitech for direct marketing purposes, notably during the collection of such data, either by contacting Legitech by email or by following the procedure indicated in the electronic communications received for this purpose.

The User undertakes to inform Legitech, within fifteen (15) working days, of any change to the information provided when contacting the company, notably any change of address.

Modification of the Personal Data Management Policy

Legitech reserves the right to modify the content of this personal data management policy at any time.

Any modification will be indicated on the Site, where appropriate by means of a hypertext link. The updated version of the policy will then be consultable on the page of the Site dedicated to it.

Find Out More

For any additional information relating to the protection of personal data, Users may consult:

• The Commission nationale pour la protection des données (CNPD) ;
• the Association for Data Protection in Luxembourg (APDL);
• the texte officiel du Règlement général sur la protection des données.