Privacy Policy

1. Controller and contact

Lex365 is provided by Rafael Rocha & Santos Cordeiro, referred to as “RRSC”, with Portuguese legal entity and tax identification number 517207346 and registered office at Rua Ruben de Carvalho, n.º 1, Setúbal, Portugal.

For privacy enquiries or to exercise your rights, contact info@lex365.net or write to the address above, indicating that your request concerns data protection.

2. Scope and responsibilities

This policy describes personal data processing on lex365.net, in business enquiries, contracting and Lex365 support, as well as the main data flows associated with the application and its connectors.

RRSC acts as controller where it determines the purposes and means of processing, including responding to enquiries, managing business relationships, billing and protecting its website.

For client, matter, document and activity data managed by a firm in its Microsoft 365 environment, the customer organisation determines the purposes of processing and access rules. Where RRSC processes that data on its behalf, it acts as processor under documented instructions and the data processing agreement required by Article 28 of the GDPR. This policy does not replace that agreement or the information the customer organisation must provide to individuals.

3. Data processed and its sources

Enquiries and demonstrations: name, professional email address, firm if provided, enquiry type, language and message content. Individuals provide this information through the form, email, telephone or another direct contact. The form sends the message to the Lex365 team by email.

Business relationships and support: customer and representative identification and contact details, billing information, plan and licences, communications, support requests and information needed to investigate an issue. This information may be supplied by the individual, their organisation or, where that sales channel is used, the authorised marketplace.

Website use: technical information required for communication and security, such as IP address, server requests, date and time, browser and error information. Protection against abusive form submissions uses an identifier derived from the IP address and technical counters. When a page loads, Google Analytics processes cookie identifiers, device and browser information, pages visited and interactions.

Application: professional Microsoft identity and permissions, client contact and identification details, tax numbers where entered, matters, notes, documents, metadata, team members, time entries and deadlines. The actual content depends on what the organisation enters and the features and permissions it authorises. Case files may contain sensitive or offence-related data, which require the applicable legal grounds and safeguards.

Microsoft 365 activity: when authorised, integrations access email references, document changes, calendar and Teams activity to help users recall their work. The email activity integration described for Lex365 accesses message metadata without reading bodies or attachments; this limitation does not apply to documents users make available through other features.

4. Purposes and legal bases

Responding to enquiries and preparing proposals: taking pre-contractual steps requested by the individual where they are the prospective contracting party; for contacts representing organisations, the legitimate interest in responding and establishing professional relationships.

Managing contracts, licences and support: performance of a contract where the individual is a party; for an organisation’s representatives and users, the legitimate interest in administering and providing the contracted service.

Billing and tax and accounting obligations: compliance with legal obligations. Keeping evidence and managing complaints or disputes rely on applicable obligations and the legitimate interest in exercising or defending rights.

Security and abuse prevention: the legitimate interest in protecting the website, communications and services, limiting spam and investigating incidents, taking into account the necessity of processing and individuals’ rights.

Website usage statistics: the website collects statistics automatically from page load. Requesting a demonstration does not subscribe you to promotional communications; using contact details for such communications requires the applicable legal basis and conditions.

When acting as processor, RRSC processes operational data only within the customer’s instructions and agreement. The controller must identify the legal basis for its operations, including additional requirements for special categories of data or offence-related information.

5. Required and optional information

In the form, name, email address, enquiry type and message are needed to route and respond to your enquiry. The firm name is optional. Without the necessary information, we may be unable to handle the request. Information needed for contracting, billing or authentication is identified in the relevant process.

Send only the information needed. Avoid including case documents, sensitive data or information subject to professional secrecy in an initial enquiry or support request unless a suitable channel and scope have been agreed.

6. Microsoft 365, storage and permissions

Lex365’s architecture uses Microsoft Entra ID for authentication and Microsoft Graph to access authorised Microsoft 365 services. Operational data is stored in SharePoint lists and documents in libraries within the environment configured for the customer organisation.

Access depends on the account used, delegated permissions and tenant policies. The customer organisation administers users, access, retention and sharing in its environment, to the extent those services have not expressly been contracted to RRSC.

Storage in SharePoint does not mean that no data flows outside that environment: authentication, technical communications, authorised support and connectors may involve additional flows. Microsoft service locations and terms depend on the organisation’s contract and configuration. See also the Microsoft Privacy Statement.

7. AI assistants and MCP connectors

When a customer uses an AI assistant connected to Lex365 through MCP, data returned by tools and context supplied by the user may be transmitted to the assistant provider to execute the request and produce a response. The MCP protocol does not eliminate this transfer.

The information transmitted depends on the operation, for example searching clients or accessing matters, documents, time entries or deadlines, and on authorised permissions. The customer must select a service, plan and settings compatible with its obligations, including professional secrecy, minimisation and data protection.

RRSC does not use customers’ confidential content to train AI models. Conversation retention, access and any use of data by the external service depend on the provider, plan, settings and contract selected by the customer; this policy does not guarantee those providers’ practices.

Responses support users and must be verified. The assistance features described for Lex365 do not replace users’ professional decisions. The informational website does not make solely automated decisions producing legal or similarly significant effects on visitors.

8. Recipients of data

Access is limited to authorised RRSC personnel who need the data for the stated purposes. Depending on the service used, hosting, email, infrastructure, maintenance and support, accounting and advisory providers may be involved, subject to applicable contractual and legal obligations.

Microsoft is involved in Microsoft 365 services and, where applicable, the Microsoft Marketplace purchasing channel. Google is involved in website statistics from page load. AI assistant providers selected by customers receive data made available through the integrations used. Each provider may have different roles depending on the service and applicable contract.

Data may also be disclosed to authorities or other recipients where required by law or necessary to exercise or defend rights. You may request more information about the recipients relevant to your processing at info@lex365.net.

9. International transfers

Using Microsoft, Google or external assistants may involve processing or access outside the European Economic Area. The location of the customer’s SharePoint environment alone does not determine every destination of the integrations used.

For transfers under its responsibility, RRSC must ensure a valid mechanism under the GDPR, such as an applicable adequacy decision or standard contractual clauses with the necessary assessment and supplementary measures. You may request information about a transfer’s destination and safeguards, including how to obtain a copy, at info@lex365.net.

Where a customer directly contracts Microsoft services or an AI assistant, it must also assess those services’ terms and safeguards for the processing it determines.

10. Retention and deletion

Data is retained for as long as needed for its purpose, taking into account its nature, the relationship with the individual, legal obligations and the need for evidence or defence of rights. The criteria below apply where no specific statutory or contractual period is required.

Information and demonstration requests: while handling the request and, after closure, only as necessary to document the steps taken or manage outstanding issues. If a request results in a contract, the necessary information becomes part of the contractual relationship.

Contracts, billing and support: during the contractual relationship and, after it ends, for statutory periods applicable to tax and accounting documentation and as needed to manage warranties, complaints or defence of rights. Data no longer requiring retention must be deleted or anonymised.

Technical and security records: as needed to prevent abuse, diagnose faults and investigate incidents. Form counters use a control window; expiry of that window does not itself mean automatic deletion of technical files or hosting logs.

Firm data in Microsoft 365: according to the customer organisation’s instructions and policies and the contracted services’ terms. Cancelling Lex365 does not automatically delete SharePoint data. Data processed by RRSC as processor is returned or deleted under the applicable agreement, subject to legal obligations.

Statistics and preferences: the cookie notice acknowledgement and the configured analytics cookie expiry last 180 days, unless deleted earlier or restricted by the browser. Cookie expiry does not retrospectively erase events already sent: retention of those events depends on the Google Analytics property settings, aggregated data and applicable obligations. You may request information about the period applicable to your data.

11. Cookies and browser storage

The website uses browser local storage to remember the selected visual theme (theme) and cookie notice acknowledgement (lex365-cookie-notice). The theme remains until changed or deleted; the acknowledgement is remembered for 180 days. These items are not used to analyse browsing.

Google Analytics: the statistics code loads automatically when each page opens, independently of cookie notice acknowledgement. The “Accept” button dismisses the notice and remembers that acknowledgement for 180 days.

First-party cookies _ga and _ga_GNKWF1F5RY may be created to distinguish browsers and sessions and produce usage statistics. The website configures a 180-day expiry without automatic renewal on every visit and disables Google signals and advertising personalisation signals for this integration. Browser limits may shorten that period.

You may reopen the notice using the “Cookies” button in the footer. You may delete cookies and local storage or block cookies in your browser settings. Dismissing the notice does not change Google Analytics loading.

Cookie lifetime differs from the retention period of data on Google servers. See Google Analytics data protection information and the Google Privacy Policy. Cookies and technologies within Microsoft services or the AI assistant are described by their respective providers.

12. Security and confidentiality

Protection must be appropriate to the risks, including access controls, permissions limited to authorised functions and confidentiality obligations. The form includes field validation, abuse prevention and responses that do not expose message contents or sending credentials.

Security of the Microsoft 365 environment also depends on the customer organisation’s measures, including account management, authentication, sharing and tenant configuration. No system guarantees absolute security; suspected unauthorised access or incidents should be reported to info@lex365.net.

13. Your rights and how to exercise them

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction and portability of your data. You may object to processing based on legitimate interests on grounds relating to your particular situation and object to direct marketing. Where processing relies on consent, you may withdraw it at any time.

Send your request to info@lex365.net, identifying the right and context. If needed, we will request only proportionate information to confirm identity. A response is normally provided within one month; where complexity or the number of requests justifies it, an extension of up to two further months may apply, notified within the first month. Exercising rights is normally free, subject to exceptions provided by law.

If your request concerns case file, document or activity data managed by a customer firm, contact that organisation first as controller. Where RRSC receives the request as processor, it must forward it and provide the assistance set out in the agreement, without independently deciding to delete customer data.

You may lodge a complaint with the Portuguese Data Protection Authority (CNPD) without first contacting RRSC, and seek applicable judicial remedies. The CNPD provides information on exercising your rights.

14. Changes and related documents

This policy is dated 20 October 2026. It will be updated when processing, services or applicable requirements change. Material changes will be communicated through an appropriate channel and fresh consent requested where necessary.

See also the Lex365 Terms and Conditions. Accepting those Terms or using the website does not constitute blanket consent to personal data processing.