Privacy notice

In short

• The data you enter in the tools stays in your browser. It is never sent to a server.
• We process data about you only if you unlock the firm features or report a problem, and to the extent technically needed to run the site.
• Each type of communication requires a separate consent, which you can withdraw at any time. Unlocking does not depend on it.
• We do not sell any data.

Controller

Avlex Belgium SRL (Avlex), Boulevard de l'Empereur 10, 1000 Bruxelles, enterprise number 1036.582.778.

For any question about your data: legal@avlex.be.

Your case data stays in your browser

What you enter in the tools (dates, amounts, options and any case data), the documents you open in them (conclusions to check), your firm profile (letterhead, logo) and the presets you save stay in your browser: in the tab's memory, or in the browser's storage (localStorage, IndexedDB) for what you choose to save. This data is never sent to a server, neither to Avlex nor to any third party.

Avlex therefore has no access to it. For that data, Avlex is neither a controller nor a processor. The only exception: if you report a problem, the form attaches the non-personal data of the calculation (see below).

Data processed, purposes and legal bases

Unlocking the firm features

When you ask to unlock, our server passes your request to Avlex's contact registry, which Avlex's sites share. The registry processes:

• your e-mail address and the interface language;
• the tool from which you make the request;
• the date on which you confirmed your address;
• the issue of your licence (see below).

Avlex sends you the confirmation e-mail, through Resend. The link it contains is valid for 7 days.

Purpose: verifying your address, issuing the licence and checking that it is valid.

Legal basis: performance of the free service you request (GDPR, Article 6(1)(b)).

Your e-mail address is needed to unlock. Without it, the tools, their results and every export remain fully usable.

Licence

After confirmation, your browser keeps a signed licence in its local storage (localStorage). It contains a SHA-256 hash of your e-mail address (not the address itself), a licence identifier and its issue and expiry dates. It is valid for 12 months. Avlex's registry records that the licence was issued.

When you download the annual judicial calendar as a PDF, your browser sends your licence. Our server checks its signature and asks Avlex's registry whether it is active. Downloads are counted per day to apply a daily limit. The other firm features check the licence in your browser, without sending anything.

Legal basis: performance of the free service you request (Article 6(1)(b)).

Communications you choose

When you unlock, or later, you can agree to each of the following communications separately. No box is pre-ticked, and unlocking does not depend on them.

Legal basis: your consent (Article 6(1)(a)). For advertising by e-mail, Article XII.13 of the Belgian Code of Economic Law also requires your prior consent.

Your phone number and preferred time for the call are only passed on if you accept the call. If you withdraw that consent, the number is erased.

Proof of your consent

For each consent, Avlex's registry records the date and time, the purpose, the exact version of the text you saw and the site of origin. It also records a salted hash (HMAC-SHA-256) of your IP address and of your browser's identifier (User-Agent). The IP address itself is not stored.

Legal bases:

• date, purpose and text version: the obligation to be able to demonstrate your consent (Article 7(1), with Article 6(1)(c));
• IP and browser hashes: our legitimate interest in proving that the confirmation is genuine and in detecting fraudulent requests (Article 6(1)(f)). The impact on your privacy is limited, since only hashes are kept.

Security and abuse prevention

Our server limits the rate of requests using a keyed hash (HMAC) of your IP address. This hash stays in working memory for the length of the rate-limit window, then disappears. Avlex's registry also sends at most three confirmation e-mails per address per 24 hours.

Instead of a CAPTCHA, the unlock form and the problem report form have your browser solve a small calculation (proof of work) set by our own server. The site loads no third-party script, no analytics and no tracking cookie.

Legal basis: our legitimate interest in protecting the service, and the people whose address might be entered without their knowledge (Article 6(1)(f)).

Optional profile fields

You can give your full name, profession, bar and firm size. These fields are optional. They help us understand who uses the tools and, if you have agreed to communications, tailor them to your profession.

Legal basis: our legitimate interest (Article 6(1)(f)). You can object at any time.

E-mail preferences page

After unlocking, your browser keeps a preference token. The E-mail preferences page sends it in the body of the request, never in the address, to show and change your choices.

Legal basis: the obligation to make withdrawing consent as easy as giving it (Article 7(3), with Article 6(1)(c)).

Problem reports

Every tool has a "Report a problem" form. When you send it, we receive:

• the description you write;
• your e-mail address, if you choose to give it, used only to reply to you;
• the tool and page concerned, and the interface language;
• the date on which the rules applied were verified;
• the non-personal data of the calculation (dates, amounts, options) and the result shown, never names.

The form asks you not to write names or case references. The report is sent as a single e-mail, through Resend, to Avlex's support team (support@avlex.be). The site keeps none of it. Your address is never added to Avlex's contact registry and never used for marketing.

Purpose: correcting the tools and, if you gave your address, replying to you.

Legal basis: our legitimate interest in correcting the tools (Article 6(1)(f)). The reply address is processed only if you give it, on your own initiative.

Usage counters

The site sends Avlex's registry aggregate counters per tool, for example the number of calculations done. They are plain integers: they contain no content, no identifier and no cookie, and are linked to no person. They are not personal data.

The host's technical logs

As with any website, the host records technical logs when your browser requests a page: IP address, date and time, address requested, browser, response code. They are used for security and troubleshooting.

Legal basis: our legitimate interest in keeping the site running and secure (Article 6(1)(f)).

Recipients and processors

Your data is not sold or rented. It is processed by Avlex and by the following processors, bound by contract (Article 28):

The e-mails you agreed to are sent by Avlex. If Avlex uses a sending service for them, that service acts as a processor on the same terms.

Transfers outside the European Economic Area

The registry's database is hosted in the European Union. Supabase and Resend are companies established in the United States: access from outside the European Economic Area may occur, for example for technical support or to deliver the e-mails.

These transfers rely on the safeguards provided by the GDPR: the adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it (Article 45), and/or the European Commission's standard contractual clauses (Article 46(2)(c)). You can obtain a copy by writing to legal@avlex.be.

Retention periods

• Confirmation link: valid for 7 days. A request that is never confirmed is deleted after 30 days.
• Consent: lapses after 36 months without interaction. Interactions are: a confirmation, a change to your preferences and an unlock. Merely submitting the unlock form is not one.
• No active consent left (withdrawn or lapsed): your data is deleted 5 years after the last consent event or interaction. Until then, it is kept as proof in case of a complaint or a claim (Article 6(1)(f)).
• Verified address with no consent at all (unlock only): deleted 12 months after the last interaction, and not before 12 months after your last licence ended.
• Erasure: a permanent deletion. A hash of your address stays on a suppression list, so that your opt-out continues to be honoured.
• Problem reports: in Avlex's support mailbox, only as long as needed to handle the report. The site keeps none of it.
• Rate limiting: in working memory, for the length of the window.
• Host's logs: a short period set by the host for security and troubleshooting, then deleted.

Your rights

At any time, you can:

• access your data (Article 15) and have it corrected (Article 16);
• have it erased (Article 17) or have its processing restricted (Article 18);
• receive the data you provided in a structured format (portability, Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw your consent, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).

To withdraw a consent: use the E-mail preferences page, from the browser in which you unlocked the firm features; the unsubscribe link in every e-mail; or a message to legal@avlex.be.

For your other rights: write to legal@avlex.be. We reply within one month (Article 12(3)). We may ask you to confirm that the address concerned is yours.

Complaints: you can contact the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be.

Automated decisions

No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely on the basis of automated processing (Article 22).

Changes

We may update this notice. The date of the last update is shown on this page. We announce significant changes on the site. Any new use based on consent will require a new consent.