Privacy policy
Who processes your data
Your data is processed by the Nlegal legal practice, founded by Nazar Shestopalov (Lviv, Ukraine). For any questions about your data, write to [email protected].
What data we collect
Only what you enter in the consultation request form: name, email, phone or messenger (optional), topic and a short description of your situation. Together with the request we store the page language, the page address it was sent from and an irreversible hash of your IP address. The hash is used only to protect the form from spam and cannot be turned back into the address.
Please do not send sensitive data through the form, such as health information, document numbers or bank details. We will ask for them separately if they are really needed.
Why and on what legal basis
We use the data to respond to your request and arrange a consultation. The legal basis is taking steps at your request prior to entering into a contract, under Article 11(1)(3) of the Law of Ukraine on Personal Data Protection. For clients in the EU this corresponds to Article 6(1)(b) GDPR.
We do not use your data for advertising and do not send newsletters without separate consent.
Booking a consultation via Google Calendar
Online booking on the "Book a consultation" page runs on Google Calendar (Google LLC). The calendar loads only when you click "Show the calendar", or opens on Google's website via the link. The data you enter when booking (name, email, answers to the form questions, the chosen time) is processed by Google as the service provider and passed to our work calendar. Google may process it outside Ukraine and use cookies in line with its own privacy policy. We use this data to hold the consultation and contact you about it, on the same legal basis as requests sent through the form.
Reviews
If you leave a review through the form on the website, we store your name, position or company, the review text, your photo (if you added one), your email, the page language and an irreversible hash of your IP address for spam protection. Your name, position, text and photo are published on the website only after our moderation and only on the basis of your consent, given by ticking the box in the form, under Article 11(1)(1) of the Law of Ukraine on Personal Data Protection (for users in the EU, Article 6(1)(a) GDPR). Your email is never shown on the website and is used only to contact you about the review. We may correct obvious typos without changing the meaning. You can withdraw consent and ask us to remove the review at any time by writing to [email protected]. We keep the data while the review is published, and unpublished reviews for no longer than 1 year.
Templates from the legal library
To download a template, you enter your email. Together with it we store the template name, the date, the page language and an irreversible hash of your IP address that protects the library from abuse. The legal basis is your consent, given by ticking the box in the form, under Article 11(1)(1) of the Law of Ukraine on Personal Data Protection. For users in the EU this corresponds to Article 6(1)(a) GDPR.
We send useful materials and Nlegal news to this email only if you separately ticked the corresponding box. You can opt out at any time via the link in the email or by writing to [email protected]. This data is kept until you withdraw consent, but no longer than 2 years after your last download.
Where data is stored and who else sees it
The website and the request database run on Cloudflare infrastructure (Cloudflare, Inc.). Notifications about new requests are sent to the Nlegal work mailbox via the Resend email service (Resend, Inc.). Data is not shared with anyone else except where the law expressly requires it.
How long we keep it
Requests that do not lead to a contract are kept for no longer than 2 years from the last contact and then deleted. If we start working together, data is kept for as long as the contract and the law require.
Cookies and visit statistics
The website sets no cookies and stores nothing in your browser. We use no third-party analytics, advertising pixels or embedded services from other companies. The only exception is the Google booking calendar, which loads only after you click (see above). After that, your browser remembers the choice (a flag in local browser storage, not a cookie) so that the calendar opens straight away next time. You can undo this by clearing the site data in your browser settings. Fonts are served from our own server. That is why there is no consent banner.
To understand which pages are useful, the website keeps its own de-identified statistics. When a page is viewed, we store the page address, the domain of the site you came from, the campaign tag (utm_source), the country derived from the IP address, the device type and an irreversible hash computed from the IP address, the browser and the current date. The IP address itself is not stored. The hash changes every day, so it cannot be used to follow or identify a person across days. This data is processed on the basis of our legitimate interest in improving the website and is kept for no longer than 2 years.
If we add tools that require consent, we will update this policy and ask for consent before they load.
Your rights
You can find out what data we hold about you, correct it, withdraw consent, request erasure or restriction of processing and object to processing. To do so, write to [email protected]. We will reply within 30 calendar days.
If you believe your rights have been violated, you can contact the Ukrainian Parliament Commissioner for Human Rights or, if you are in the EU, your local data protection authority.
Changes to this policy
The current version is always available on this page. The version date is shown at the top.