Privacy Statement

Last updated: 19 July 2026

Axi Legal B.V. ("Axi Legal", "we", "us") processes personal data in the course of its services. We handle that data with care and in accordance with applicable privacy legislation.

Language. This Privacy Statement is a translation of the Dutch original. In the event of any discrepancy between the English and Dutch versions, the Dutch text prevails.

In this Privacy Statement we explain which personal data we process, why we do so, on what basis, with whom we share it and what rights you have.

1. Who is responsible?

Axi Legal B.V.

Amalialaan 126a, 3743 KJ Baarn

contact@axilegal.com

For questions about this Privacy Statement you can contact us at the email address above.

2. When do we process personal data?

We process personal data when you:

• visit our website;
• contact us;
• request a quotation;
• give us an assignment;
• have a contract review carried out;
• sign up for a newsletter or event;
• are a contact person at a client, supplier, collaboration partner or other business relation;
• communicate with us in another way.

3. Which personal data do we process?

Depending on the situation, we process, among other things:

• name;
• company name;
• job title;
• email address;
• telephone number;
• address details;
• payment and invoicing details;
• correspondence;
• information you provide yourself;
• documents you submit for review;
• personal data contained in documents, correspondence or other information that a client provides to us in connection with an assignment.

We do not ask for special categories of personal data unless they are necessary for the performance of an assignment and processing is permitted by law.

4. How do we obtain personal data?

We usually receive personal data directly from the data subject, for example when you contact us or give us an assignment.

In addition, we may receive personal data:

• from the organisation for or on behalf of which the data subject works;
• from a client who provides documents, correspondence or other information to us in connection with an assignment;
• from suppliers, collaboration partners or professional advisers;
• from public business sources, such as websites, public registers and professional networks; and
• from other third parties where necessary for the performance of our services or to comply with a legal obligation.

Where we do not receive personal data directly from the data subject, that data may have been provided to us by the client or another party on whose behalf we act.

5. What do we use this data for?

We process personal data only to the extent necessary for:

• answering questions;
• preparing and performing agreements;
• carrying out contract reviews;
• legal services;
• invoicing;
• entering into, maintaining and managing business relations;
• improving our services;
• complying with legal obligations;
• securing our systems.

6. On what basis do we process personal data?

Depending on the situation, we process personal data because:

• it is necessary for the performance of an agreement to which the data subject is party, or to take steps at the data subject's request before entering into an agreement;
• we must comply with a legal obligation;
• we have a legitimate interest, including entering into and performing business relations, communicating with contact persons, and improving and securing our services;
• the data subject has given consent.

Where processing is based on consent, that consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

7. With whom do we share personal data?

We provide personal data to third parties only where necessary for our services, to comply with a legal obligation or on the basis of another legitimate ground.

Depending on the situation, we may share personal data with:

• IT, software and cloud suppliers;
• hosting and infrastructure suppliers;
• email and communication suppliers;
• suppliers of AI and automation services;
• providers of scheduling, accounting and payment services;
• professional advisers, such as accountants, lawyers and insurers;
• other external experts involved in an assignment with the client's consent;
• regulators, investigative authorities, courts or other government bodies, where we are legally required to provide data or where necessary to protect our rights.

Where a supplier processes personal data solely on behalf of and on the instructions of Axi Legal, that supplier acts as a processor, and we make the contractual arrangements required under applicable privacy legislation.

Use of AI service providers

Axi Legal may use AI and automation services in performing its work. We use such services only to the extent that this contributes to the quality, efficiency or consistency of our services.

We use only AI services that we consider appropriate given the nature of the services, the confidentiality of the information and the applicable privacy and security requirements.

We do not share more personal data with an AI service provider than is necessary for the relevant purpose.

AI is used only in a supporting role. Final legal analyses, advice and other Deliverables are assessed by Axi Legal before they are shared.

Further information about our use of technology and AI is set out in the Security & AI Statement.

Tools on our website

To operate our website we use the following processors, which process personal data on our behalf:

• Formspree — processes the data you enter in our contact form (such as name, email address and the content of your message) so that we can receive and respond to your message. Formspree is based in the United States.
• Calendly — processes the data you provide when scheduling an appointment (such as name, email address and the chosen time) so that we can arrange an appointment with you. Calendly is based in the United States.

We have made the contractual arrangements with both processors that applicable privacy legislation requires. Appropriate safeguards apply to the transfer to the United States; see "International transfers" below.

8. International transfers

Some of our processors, including Formspree and Calendly, are based in the United States. If personal data is processed outside the European Economic Area, we ensure that appropriate safeguards are in place in accordance with applicable privacy legislation, for example through an adequacy decision or the standard contractual clauses adopted by the European Commission.

9. Retention periods

We do not retain personal data longer than necessary for the purposes for which it was collected.

In principle, we apply the following retention periods:

• quotations and data of prospective clients: no more than two years after the last substantive contact, unless it is clear earlier that no business relationship will arise;
• client and assignment files: in principle seven years after termination or completion of the assignment;
• agreements, confirmations of assignment and other contractual documentation: in principle seven years after termination of the agreement;
• financial records, including invoices and payment data: for the applicable statutory retention period, in principle seven years after the end of the financial year;
• business contact details: for the duration of the business relationship and no more than two years after the last relevant contact;
• contact requests and other correspondence not leading to an assignment: no more than two years after handling;
• newsletter data: until the data subject unsubscribes or withdraws consent;
• recruitment data: no more than four weeks after the end of the application procedure, or no more than one year if the applicant has given consent;
• website and security logs: for the technically set retention period and in principle no longer than twelve months, unless longer retention is necessary;
• requests from data subjects and their handling: in principle five years after completion of the request;
• data on security incidents and data breaches: in principle five years after closure of the incident.

Where personal data is necessary in connection with an ongoing or reasonably foreseeable dispute, we may retain it for as long as necessary for that purpose.

After the applicable retention period, we delete or anonymise the personal data.

10. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

Further information about our security measures is set out in our Security & AI Statement.

11. Your rights

To the extent provided by law, you have the right to:

• request access to your personal data;
• have personal data corrected;
• have personal data erased;
• restrict processing;
• object to processing;
• have your data transferred;
• withdraw consent previously given.

You can send a request to the email address stated above.

In principle, we respond within one month.

12. Cookies and similar techniques

Our website uses only cookies and similar techniques that are necessary for the proper functioning and security of the website.

These techniques may, for example, be used to:

• make the website function correctly;
• apply security settings;
• process forms technically; and
• prevent misuse or unauthorised access.

No prior consent is required for the use of strictly necessary cookies. We do not use tracking or advertising cookies.

In addition, we measure at an aggregate level how often certain buttons are clicked (for example the order button), in order to assess whether our services match demand. Only the event, the page, the language version and the button label are recorded. We do not place cookies for this purpose. Delivering a web page technically always requires an IP address; however, we do not record that IP address, device characteristics or any other identifying data in this measurement and do not retain them there. We do not use these measurements to identify individual visitors or to build profiles. The measurements are retained for a maximum of twelve months, after which they are deleted automatically.

If in future we use other cookies or similar techniques, we will adjust this statement and, where required, request consent.

13. Complaints

If you believe that we do not process your personal data carefully, we would like to hear from you so that we can look into it together.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

14. Changes

We may amend this Privacy Statement from time to time.

The most recent version is always available via our website.