GDPR Compliance

Our commitment to protecting your personal data in accordance with the General Data Protection Regulation.

Last updated: December 28, 2025

GDPR Compliance Overview

The General Data Protection Regulation (GDPR) is a comprehensive privacy law that came into effect on May 25, 2018. It applies to organizations that process personal data of individuals in the European Union (EU).

Lex Quotes is committed to full GDPR compliance and has implemented comprehensive measures to protect your personal data and ensure your privacy rights are respected and upheld.

Your Rights Under GDPR

Under GDPR, you have the following rights regarding your personal data:

Article 15Right of Access

You have the right to obtain confirmation that your data is being processed and access to your personal data.

Article 16Right to Rectification

You have the right to correct inaccurate personal data and complete incomplete data.

Article 17Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data.

Article 18Right to Restriction

You have the right to restrict the processing of your personal data in certain circumstances.

Article 20Right to Portability

You have the right to receive your data in a structured, machine-readable format.

Article 21Right to Object

You have the right to object to processing of your personal data for specific purposes.

How to Exercise Your Rights: To exercise any of these rights, please contact our Data Protection Officer using the contact information provided at the bottom of this page.

Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

Contract Performance (Art. 6(1)(b))

Processing necessary to provide our trademark quotation services and fulfill our contractual obligations.

Legitimate Interests (Art. 6(1)(f))

Processing for business operations, security, fraud prevention, and service improvements, balanced against your privacy rights.

Consent (Art. 6(1)(a))

When you explicitly consent to specific processing activities, such as marketing communications.

Legal Obligation (Art. 6(1)(c))

Processing required to comply with legal obligations, such as tax and accounting requirements.

Data Categories and Retention

Account and Profile Data

Data: Name, email, professional credentials, firm information, preferences

Purpose: Account management, service provision, personalization

Retention: Duration of account plus 7 years for legal compliance

Transaction and Billing Data

Data: Payment information, invoices, transaction records

Purpose: Payment processing, financial reporting, tax compliance

Retention: 7 years after final transaction for tax and legal compliance

Usage and Analytics Data

Data: Platform usage, interaction patterns, performance metrics

Purpose: Service improvement, analytics, security monitoring

Retention: 2 years for analytics, indefinitely for aggregated/anonymized data

Communication Data

Data: Support tickets, email communications, feedback

Purpose: Customer support, service improvement, relationship management

Retention: 3 years after resolution for support quality and training

International Data Transfers

Some of our service providers and partners are located outside the European Economic Area (EEA). When we transfer your data internationally, we ensure appropriate safeguards are in place:

Adequacy Decisions

Transfers to countries with EU adequacy decisions that provide equivalent data protection.

Standard Contractual Clauses

EU-approved contractual terms that provide appropriate safeguards for data transfers.

Certification Programs

Partners certified under approved certification mechanisms that ensure data protection.

Binding Corporate Rules

Internal policies approved by supervisory authorities for multinational organizations.

Note: We continuously monitor international data transfer regulations and update our practices to ensure ongoing compliance with evolving requirements.

Data Security Measures

We implement technical and organizational measures to ensure appropriate security of personal data:

Technical Measures

• End-to-end encryption for data in transit
• AES-256 encryption for data at rest
• Multi-factor authentication
• Regular security assessments and penetration testing
• Automated threat detection and monitoring
• Secure development practices

Organizational Measures

• Data protection impact assessments
• Employee privacy training and awareness
• Access controls and principle of least privilege
• Incident response procedures
• Vendor security assessments
• Regular policy reviews and updates

Data Breach Notification

In the unlikely event of a personal data breach, we are committed to:

• Notify the relevant supervisory authority within 72 hours when required by law
• Inform affected individuals without undue delay if there is a high risk to their rights and freedoms
• Provide clear information about the nature of the breach and steps being taken
• Implement immediate containment and remediation measures
• Conduct a thorough investigation and implement preventive measures

Children's Personal Data

Our services are designed for legal professionals and are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete such information. If you believe we have collected data from a child under 16, please contact our Data Protection Officer immediately.

Contact and Complaints

Data Protection Officer

Email: [email protected]

Address: [Data Protection Officer Address]

Phone: [DPO Phone Number]

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data in violation of GDPR. You can contact:

• Your local data protection authority in the EU
• The data protection authority in the country where you reside
• The data protection authority where the alleged infringement occurred

Response Time: We will respond to your requests within 30 days (or sooner when possible). In complex cases, we may extend this period by up to 60 days and will inform you of any delay.

Regular Reviews and Updates

We regularly review our GDPR compliance measures and update our practices as needed to ensure ongoing compliance with data protection requirements. This page will be updated to reflect any changes in our GDPR compliance approach. We encourage you to review this page periodically for the most current information about our data protection practices.