Privacy Policy
1. Controller and contact
LEX CONFORM is a product-regulatory information and coordination project presented by Lex Agency LLC. Where Lex Agency LLC determines how and why personal data are processed, it acts as controller. Privacy requests: request@lex-conform.com; website: https://lex-conform.com. Contact details of the contracting entity must also be provided in the individual engagement documentation.
2. Scope and data collected
We may receive names, roles, employer and corporate contact details, email, telephone, communications, product categories, intended use, target markets, technical-document references and other material you voluntarily submit. Website security logs may contain IP address, device/browser data, timestamps and page requests. We do not request identity documents or sensitive data in the initial contact form.
3. Purposes and GDPR legal bases
We use enquiry details to reply, assess scope and prepare a proposal (Article 6(1)(b) GDPR where the data subject requests contractual steps, or Article 6(1)(f) for corporate contacts); engagement records to deliver agreed services (6(1)(b) or legitimate interests where appropriate); invoices for legal obligations (6(1)(c)); security logs and abuse prevention for legitimate interests (6(1)(f)); optional marketing only where a lawful basis and any separate electronic-marketing consent requirements are met. Each purpose is assessed separately; consent is not presumed merely because someone contacts us.
4. Data concerning colleagues and third parties
Product documentation can identify engineers, authorised representatives, manufacturers, signatories or other people. Please share only what is necessary and inform affected persons when required. Do not submit health information, government IDs or commercially sensitive dossiers through the initial web form unless a secure channel and lawful reason have been agreed.
5. Sources and recipients
Data arise from enquiries, emails, Telegram/WhatsApp exchanges, contractual documents and publicly available business records relevant to a requested assessment. Access may be given to authorised team members, hosting and email providers, website security suppliers, accounting advisers and specifically engaged laboratories, regulatory consultants or counsel when needed. Independent providers may process certain information as their own controllers; their status must be determined case by case.
6. Website protection and cookies
The site uses a privacy-preference cookie and security measures, including Cloudflare Turnstile on the request form. Optional analytics and advertising trackers are not enabled in the supplied site build. The separate Cookie Policy explains purposes, consent settings and the 180-day preference-cookie lifetime. Any future tracking deployment requires a prior policy and consent-implementation review.
7. International transfers
Communications and specialised services may involve recipients outside the European Economic Area. Where GDPR Chapter V applies, a transfer requires an applicable adequacy decision, appropriate safeguards such as standard contractual clauses with supplementary assessment where necessary, or a narrowly construed statutory derogation. Use of a global messenger is not an unrestricted permission to transfer personal data.
8. Storage and deletion
We retain enquiry correspondence while dealing with the request and any reasonably necessary follow-up or dispute; engagement files for the contractual purpose and applicable limitation periods; accounting records for applicable statutory periods; and security logs for a limited period justified by security needs. No invented uniform retention deadline is promised. Precise schedules depend on the processing operation and must be fixed in the operator's internal retention register.
9. Data security and confidentiality
We apply access restrictions, separation of public and private server files, protected transport where available, abuse-rate controls and server-side bot verification. No internet service can promise absolute security. Security incidents are assessed under GDPR Articles 33–34; notification obligations depend on the circumstances and risk, not on a universal automatic reporting rule.
10. Your rights
Subject to statutory conditions, individuals may request access, rectification, erasure, restriction, portability, object to processing and withdraw consent without affecting earlier lawful processing (GDPR Articles 15–21). Objection to direct marketing is respected. Article 22 safeguards apply to qualifying solely automated decisions with legal or similarly significant effects; the current website does not make such decisions.
11. Exercising rights and complaints
Send a sufficiently specific request to request@lex-conform.com. We may verify identity proportionately before disclosing information. GDPR responses generally fall due within one month, subject to lawful extensions and exceptions (Article 12). You may complain to a competent EEA supervisory authority, especially where you habitually reside, work or the alleged infringement occurred (Article 77).
12. Children, changes and applicable notices
This business-oriented website is not directed at children. Any additional purposes, processors, transfers or retention practices require updated disclosures; material changes will be published here. This notice is not a substitute for a data-processing agreement where controller/processor roles require one. The date of this revision is 16 October 2026.