public.legal.privacy.title

A. Current sub-processors and recipients

NexLaw relies on the following sub-processors to deliver the service. Each acts on our behalf and may only use your data for the listed purposes:

• Vercel Inc. (USA) — front-end hosting. Standard Contractual Clauses in place.

• Railway Corp. (USA) — back-end and database hosting. SCCs in place.

• Google LLC (Ireland / USA) — Calendar, Maps, OAuth.

• Microsoft Corporation (Ireland / USA) — Outlook Calendar (optional, with explicit consent).

• Cloudinary Ltd (Ireland / USA) — profile picture storage and transformation.

• Anthropic, OpenAI, Google AI (USA) — SEO editorial content generation. No personal client data (consultation reason, appointment notes, client identity) is transmitted to these providers.

• Cloudflare Inc. (USA) — Turnstile (anti-bot).

• ActiveCampaign LLC / Postmark (USA) — transactional email delivery. Data processed: email address, name, message content. Standard Contractual Clauses in place.

B. Detailed retention periods

Pursuant to GDPR Art. 5.1.e, the following retention periods are enforced by an automated nightly cleanup job:

• Internal audit logs: 365 days.

• Email notification logs: 365 days.

• Profile-view analytics: 90 days.

• Email-verification and password-reset tokens: deleted on expiry, complete purge after 30 days.

• Unconfirmed booking drafts: 90 days.

• Confirmed/cancelled bookings: kept in line with Belgian accounting obligations (7 years), then anonymized.

• User account: as long as the account is active. Upon deletion, personal data is anonymized (see section C).

C. Your rights — self-service

Most rights under GDPR Articles 15–22 can be exercised directly from your dashboard:

• Right of access and portability (Art. 15 & 20) — download a full JSON export of the data we hold about you.

• Right to erasure (Art. 17) — request account deletion. Identification data is erased immediately; booking history is kept in pseudonymized form because the counterparty has a legitimate interest and accounting law requires it.

• Right to rectification (Art. 16) — via Profile and Preferences pages.

• Right to object / withdraw consent (Art. 21) — Email preferences and cookie banner (footer link).

• For requests that cannot be served from your account: privacy@nexlaw.be. We respond within 30 days (Art. 12).

D. Cookies and trackers

No analytics or advertising cookies are set before your explicit consent. Only strictly necessary cookies (auth session, security, preferences) are set without consent.

Google Analytics, Google Ads and Vercel Web Analytics load only after you opt in via the consent banner.

You can change your choices at any time via the "Manage cookies" footer link.

E. Automated decision-making and profiling

NexLaw does not make decisions producing legal effects on you based solely on automated processing within the meaning of GDPR Art. 22.

The client/lawyer matching system is purely advisory.

F. Breach notification

In the event of a data breach likely to pose a risk to your rights and freedoms, NexLaw notifies the Belgian DPA within 72 hours and, where appropriate, affected users, in line with GDPR Articles 33 and 34.