GDPR notice for EEA users

Last updated: 1 October 2026

This notice meets Articles 13 and 14 of Regulation (EU) 2016/679 for people in the European Economic Area. It supplements the privacy policy and cookies page.

1. Controller

Controller: Legal Nomos, Kyiv, Ukraine. Email: legalnomosceo@gmail.com. Phone: +38 093 393 30 30. No data protection officer is appointed. Send data requests to this email.

If Legal Nomos regularly offers services to people in the EEA, an EU representative under Article 27 may be required. Until one is appointed, contact the controller directly. Appointing a representative does not reduce these rights.

2. Data we process

• identity and contact: name, email, phone, language, contact channel;
• request text, chat, status notes, offer, invoice;
• files you upload to a case;
• login technical data: Firebase account id, session time;
• cookie choice.

Do not send special-category data (health, biometrics, political views, criminal data) unless the case needs it and this is agreed. The service is not directed at children.

3. Purposes and legal bases

• reply and preparing an offer — Art. 6(1)(b), steps before a contract;
• performing the agreed service, chat, files, invoice — Art. 6(1)(b);
• payment records and legal duties — Art. 6(1)(c);
• cabinet security, abuse prevention, defence of rights — Art. 6(1)(f);
• Google analytics and ads — only Art. 6(1)(a), after Accept all.

There is no automated decision-making or profiling that produces legal effects for you.

4. Recipients

Data is seen by the Legal Nomos admin and the assigned lawyer. Processors: Google Firebase / Google Cloud (authentication, database, files, hosting) and the email service used for notices. Telegram and WhatsApp only if you write there yourself. A bank or payment provider sees a payment if you pay an invoice.

5. Transfers outside the EEA

Google may process data outside the EEA, including in the United States. Transfers rely on EU standard contractual clauses and the additional measures Google applies. See Google Cloud and Firebase terms.

6. Retention

A request with no contract: up to 24 months, then deletion or anonymisation. A case, offer, invoice and files: for the work and then up to 5 years, unless a dispute, accounting or the law needs longer. Cookie choice: until you change it. Notice emails: for the email provider’s period.

7. Your rights

You may request access, correction, erasure, restriction, portability, object to processing based on legitimate interest, and withdraw cookie consent. Withdrawal does not undo processing already done. We reply within one month, extendable by two months for a complex request.

You may complain to the supervisory authority of the EEA country where you live, work, or where the issue happened. The list is at edpb.europa.eu.

8. Whether data is required

Without an email and a request, the cabinet and an offer are not possible. Refusing marketing cookies does not block the service.

9. How to write

Email legalnomosceo@gmail.com with the subject “GDPR” and the case number LN if you have one. We may ask you to confirm that the request comes from the account holder.