Privacy Statement

Version 1.3 · 6 October 2026 · Axi Legal B.V. · Baarn, the Netherlands

1. Controller

For Contract Review, Axi Legal in principle processes personal data as an independent controller for the performance, security and administration of its own services.

For other engagements, the privacy-law role is determined by the actual processing. Where Axi Legal processes personal data solely on behalf of and in accordance with the instructions of a client as processor, appropriate data processing arrangements are put in place before that processing.

2. When do we process personal data?

We process personal data when you visit our website, contact us, request a quotation or engagement, order a Contract Review, communicate with us on behalf of a business relationship, or when personal data appears in documents and information provided to us in connection with an engagement.

3. What data?

• name, position, company name and business contact details;
• address, invoicing and payment details;
• order, checkout and acceptance data, including the agreed scope, price, applicable terms, versions and evidence data;
• correspondence and instructions;
• contracts, annexes and other documents provided for an engagement;
• personal data contained in such documents or correspondence;
• reports, analyses and other Deliverables prepared by Axi Legal to the extent they contain personal data;
• technical, security and usage data necessary for the operation, security, quality monitoring and analysis of our website, ordering flow and systems.

We do not request special categories of personal data unless they are necessary for the engagement or are provided by the client. Clients are asked not to provide more personal data than is necessary for the engagement.

4. Sources

We receive data directly from data subjects, from the organisation for which they work, from clients providing information or documents, from suppliers and professional advisers, and from public business sources. Where data is not obtained directly from the data subject, it will generally consist of business contact details and personal data appearing in contracts, correspondence or other engagement documentation.

5. Purposes and legal bases

We process personal data to respond to enquiries, prepare and perform agreements, carry out and administer Contract Reviews and other legal services, invoice and process payments, maintain security, manage business relationships, measure and improve the operation of our website and ordering flow, comply with legal obligations, and establish, exercise or defend legal claims.

Depending on the processing, we rely on performance of a contract or pre-contractual measures, a legal obligation, a legitimate interest or consent. Legitimate interests may include business communications, security, quality monitoring, usage analysis, and the establishment, exercise or defence of legal claims.

6. Recipients and suppliers

Where necessary, personal data may be shared with categories of recipients such as IT, hosting, software and cloud suppliers, email and communications suppliers, AI and automation services, scheduling, accounting and payment services, professional advisers, insurers, external experts involved in an engagement, and competent authorities.

Where a supplier processes personal data solely on behalf of Axi Legal, appropriate data processing arrangements are put in place where required. For other external service providers, the privacy-law role is determined by the actual processing.

7. AI and automation

Axi Legal may use AI and automation services to support, among other things, analysis, structuring, drafting and quality control. Where reasonably possible, Axi Legal does not enter confidential client information into an AI environment in which, under the contractual terms or account settings applicable to the account, that information is used to train generally available AI models. Axi Legal may rely on applicable contractual terms, account settings and reasonably available supplier information unless there is a concrete reason to doubt their accuracy.

Final legal analyses, advice and Deliverables are substantively reviewed by Axi Legal before they are provided to the client.

8. International transfers

Where personal data is processed outside the European Economic Area, Axi Legal applies a valid transfer mechanism and appropriate safeguards where required, in accordance with applicable privacy law.

9. Retention periods

We retain personal data no longer than necessary for the purposes for which it is processed. In principle, the following periods apply to the main categories:

• incomplete online uploads: up to 24 hours where the upload has not resulted in a completed order, unless deletion takes place sooner for technical reasons or longer retention is necessary for security or incident investigation;
• documents provided for a manual scope review where no engagement results: up to thirty (30) days after completion of the scope review;
• original input documents for Contract Review and supplementary input: up to twelve (12) months after delivery of the relevant Contract Review;
• final review report: up to five (5) years after delivery;
• order, checkout, contract and acceptance evidence: in principle seven (7) years after completion of the relevant engagement, for contract administration, evidence and legal claims;
• financial administration: for the applicable statutory retention period, in principle seven (7) years;
• quotations and prospect data where no engagement results: up to two years after the last substantive contact, unless it becomes clear earlier that no business relationship will be established;
• business contact details: for the duration of the business relationship and in principle up to two years after the last relevant contact;
• recruitment data: up to four weeks after the recruitment process, or up to one year with consent;
• website, analytics and security data: according to the technically configured period and in principle no longer than twelve months, unless longer retention is necessary for security or incident investigation;
• privacy requests and incident records: to the extent necessary to demonstrate handling and compliance, in principle up to five years.

Where data is needed for a pending or reasonably anticipated dispute, investigation, statutory retention obligation or legal claim, normal deletion of the relevant data may be suspended for as long as necessary. A refund may result in certain data being deleted earlier, but does not extend an already applicable maximum retention period.

10. Security

Axi Legal takes appropriate technical and organisational measures to protect personal data against loss, unauthorised access and unlawful processing. Further information is set out in the Security & AI Statement; that document is informational and does not constitute a separate guarantee.

11. Data subject rights

To the extent provided for by the GDPR, you may request access, rectification, erasure, restriction, data portability or object to processing, and you may withdraw consent that you have given. A request may be sent to contact@axilegal.com. We may request information to verify your identity and the scope of the request.

12. Cookies and cookieless analytics

Axi Legal uses necessary cookies and similar technologies for the technical operation and security of the website.

Axi Legal also uses cookieless event tracking to measure the operation and use of the website and ordering flow. No tracking cookies are placed and no IP addresses are stored. Tracking is limited to predefined events and product or funnel characteristics and does not include document content, file names, file types, file sizes, free text or personal data entered by the user.

If other cookies or similar technologies are used for which consent is required, consent will be requested in advance and this statement will be updated where necessary.

13. Complaints

Questions or complaints may be sent to contact@axilegal.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

14. Changes

This Privacy Statement may be amended when our services, systems or legal obligations change. The current version is published on the website.