Privacy and Cookies Policy

Last updated: 10 August 2026

1. Data Controller
The website www.lexmagis.com (the “Site”) is operated by:Maria Flaux EI
Trade name: LexMagis Compliance & Risk
Status: Sole trader (EI)
SIREN: 101107415
Address: 1235 Avenue du Jura, 01630 Sergy, France
Email: info@lexmagis.com Maria Flaux, trading as LexMagis Compliance & Risk (“LexMagis”), acts as the data controller within the meaning of the General Data Protection Regulation (“GDPR”).

2. Personal Data Collected
Personal data may be collected when users browse the Site, voluntarily submit information through the contact form, contact LexMagis by email, or engage LexMagis to provide services.The categories of personal data processed may include:contact details, such as name, email address and telephone number;information contained in communications and enquiries;technical data, such as IP address and information necessary for the security and operation of the Site;billing and payment information necessary for invoicing and payment of services.Certain information, in particular contact details and the content of an enquiry, may be necessary to respond to requests or provide requested services. Where information is required, failure to provide it may prevent LexMagis from responding to the request or providing the relevant service.In the course of providing regulatory website review services, LexMagis may also process limited professional personal data obtained from publicly accessible sources, such as professional websites, public registers or other publicly available professional information. Such data may include names, professional roles, business affiliations and publicly available professional contact details where relevant to the review being carried out.

3. Purposes and Legal Bases of Processing
Personal data may be processed for the following purposes and on the following legal bases:

Responding to enquiries and requests: taking steps at the request of the individual prior to entering into a contract or, where appropriate, LexMagis’s legitimate interest in responding to professional enquiries.
Providing and managing services: performance of a contract or steps taken prior to entering into a contract.
Administrative, accounting, invoicing and payment management: performance of a contract and compliance with applicable legal obligations.
Maintaining the security and proper technical operation of the Site and preventing misuse:LexMagis’s legitimate interest in protecting and securely operating its Site and services.
Compliance with legal obligations and requests from competent authorities: compliance with applicable legal obligations.
Handling requests concerning personal-data rights: compliance with applicable legal obligations.
Processing limited professional information obtained from publicly accessible sources where necessary for regulatory website reviews: LexMagis’s legitimate interest in carrying out its professional activities and providing the requested services, subject to the rights and interests of the individuals concerned.
Processing based on consent: where consent is specifically requested and constitutes the appropriate legal basis, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Data Retention
Contact and enquiry data is retained for the time necessary to process the relevant request and, in principle, for a maximum of 12 months following the last contact, unless a longer retention period is necessary for contractual, legal or dispute-related purposes.Personal data processed in connection with the provision of services is retained for the duration necessary to provide and manage those services and thereafter for any applicable legal limitation or retention period.Technical data relating to the operation and security of the Site is retained only for as long as necessary for those purposes.Billing, payment and accounting records are retained for the period required by applicable law, in principle 10 years.

5. Data Recipients and Service Providers
LexMagis does not sell personal data.Personal data may be accessible, where necessary, to service providers acting on behalf of LexMagis, including website hosting and other technical service providers.Where necessary for invoicing and payment of services, relevant information may also be processed by banking or payment institutions.Personal data may also be disclosed where required by law or pursuant to a lawful request from a competent authority.Access to personal data is limited to what is necessary for the relevant purpose.

6. International Data Transfers
Where personal data is processed outside the European Economic Area, LexMagis will ensure that an appropriate transfer mechanism or safeguard required by applicable data-protection law is in place, where required.Where applicable, further information concerning the safeguards used for an international transfer may be requested by contacting info@lexmagis.com.

7. Data Security
LexMagis implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.Where a personal data breach is subject to a notification obligation under the GDPR, LexMagis will notify the competent supervisory authority and, where required, the affected individuals in accordance with applicable law.

8. Rights of Individuals
Subject to the conditions provided by applicable data-protection law, individuals may have the right to:access their personal data;rectify inaccurate or incomplete personal data;request erasure of their personal data;request restriction of processing;object to processing based on legitimate interests;withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;receive their personal data in a structured, commonly used and machine-readable format and exercise the right to data portability where applicable;lodge a complaint with a competent supervisory authority.Requests concerning personal data and the exercise of these rights may be sent to:info@lexmagis.com. LexMagis may request reasonable information necessary to verify the identity of a person making a request where appropriate.In France, the competent supervisory authority is the Commission nationale de l’informatique et des libertés (CNIL).

9. Personal Data Obtained from Public Sources
As part of its regulatory website review activities, LexMagis may process limited professional personal data that has not been obtained directly from the individual concerned.Such information may originate from publicly accessible professional websites, legal notices, public registers or similar publicly available sources.The categories of information concerned may include names, professional functions, business affiliations and professional contact information.Such processing is limited to information relevant to the regulatory review and is based on LexMagis’s legitimate interest in carrying out its professional activities and providing the requested services, subject to the rights and interests of the individuals concerned.Where required by applicable data-protection law, individuals will be provided with the information required under Article 14 GDPR within the applicable period, unless an exemption provided by applicable law applies.

10. Automated Decision-Making and Profiling
LexMagis does not carry out automated decision-making, including profiling, producing legal effects or similarly significantly affecting individuals within the meaning of Article 22 GDPR.

11. Cookies and Similar Technologies
The Site uses only technical cookies and similar technologies that are strictly necessary for its operation.These technologies may be used, for example, to ensure the proper technical functioning, security and operation of the Site.Strictly necessary cookies and similar technologies do not require the user’s prior consent where they meet the conditions for exemption under applicable law.LexMagis does not use non-essential cookies for advertising or behavioural profiling purposes.Users may configure their browser settings to limit or block cookies. However, blocking strictly necessary cookies may affect the proper functioning of the Site.If analytics, advertising or other non-essential cookies or trackers requiring consent are introduced in the future, they will not be placed or accessed before the user’s consent where such consent is legally required. Users will also be provided with appropriate information and mechanisms allowing them to accept, refuse and subsequently modify or withdraw their choices as required by applicable law.

12. Changes to This Policy
This Policy may be updated from time to time to reflect legal, technical or operational changes.