Privacy policy

How we process personal data at LexClaim, explained according to what the website actually does.

Draft pending review by the law firm.

Items in brackets are still to be completed or confirmed. This is a translation: the Spanish version prevails.

Data controller

Skynet Legal, S.L. (Tax ID B-67539551, Av. Diagonal 437, 5º 2ª, 08036 Barcelona, Spain) [confirm the controller and the role of Claim Law Abogados]. Privacy contact: [privacy or data protection officer email].

Two different roles

Data of the business that signs up and its users: we are the controller. We process it to provide the service the business contracts.

Data of the business's customers being claimed (debtors): the controller is the business making the claim; we process it on its behalf, under the data processing agreement the business accepts when signing up.

What data we keep

  • About the business: company name, tax ID, address, activity, approximate turnover, IBAN and bank account ownership certificate, name, ID number and position of its representative, and the power of attorney (apud acta) if granted.
  • About its users: name, email, phone and password (encrypted; nobody can read it).
  • About debtors: what appears on the invoices and spreadsheet uploaded by the business: name or company name, ID or tax ID, address, email, phone numbers, invoice numbers, dates and amounts, and the invoice PDFs.
  • When a debtor uses their payment page: their response (payment, proposed plan, commitment, disagreement and reason, any attached documents), with the date and the IP address used, as evidence.
  • About the process: reminders and notices sent (with a copy of the email), their delivery, payments and the charges for each step.
  • Change log: who changes business data, cases, prices and rules, and when (audit trail).
  • If you use the website assistant: we do not keep the conversation. If you ask us to contact you and agree, we keep your name, email or phone, your company if given and a short summary of what you need, only to contact you.

Purposes and legal basis

  • Reading and checking invoices, notifying debtors, sending the pre-claim notice and, if the business decides so, preparing the claim.
  • Charging the business for each step and the commission on what is recovered.
  • Complying with legal obligations (tax, anti-money laundering where applicable, and procedural).

Legal basis: the contract with the business; for debtors, the business's instructions and its legitimate interest in recovering a debt; and compliance with legal obligations. [confirm legal bases]

Where the data is and who helps us

We only share data with providers that carry out part of the work for us:

  • IONOS: the server running the website and the database, in Spain, and the daily backups, in Germany.
  • Anthropic (and OpenAI as a fallback): the artificial intelligence that reads each invoice and the bank certificate, and that answers in the website assistant (Anthropic). They receive the document or message only to process it. [confirm terms: not used to train models; transfer to the US]
  • SendGrid (Twilio): sending account emails (confirmation, password, invitations) and reminders to debtors.
  • Lleida.net and burofax [provider]: the pre-claim notice with proof of delivery.
  • Stripe: card payments, once enabled. The website does not store card numbers.
  • Microsoft: access for the firm's team with their Microsoft 365 accounts, once enabled.
  • Courts, court representatives (procuradores) and mediators, when the business decides to sue.

Transfers outside the European Economic Area (Anthropic, OpenAI, SendGrid, Stripe): [detail each provider's safeguards (EU-US Data Privacy Framework or standard contractual clauses)].

How long

[retention periods: for the duration of the relationship and, afterwards, the limitation period for claims and legal obligations]

Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data by writing to [privacy email]. The business can download all its data as a spreadsheet at any time from My account. If a debtor wants to exercise their rights, we pass the request on to the business making the claim. You can also complain to the Spanish Data Protection Agency (aepd.es).

Security

  • Each business's data is separated in the database: no business can see another's.
  • Connections are encrypted (HTTPS) and passwords are stored encrypted.
  • There is a daily backup, and restoring it is tested every week.
  • Changes made by the firm's team are logged.

Cookies

We only use cookies the website needs to work. Details are in the cookie policy.

Last reviewed: [date]