1. Who we are
Represent Legal ("Represent", "we", "us") is the data controller responsible for the processing described in this policy, except where section 2 states that we act as a data processor.
Represent Legal, CVR 46844742, Rantzausgade 60C, 2200 Copenhagen N, Denmark. Email: hello@representlegal.com.
Represent Legal is a legal and legal technology consultancy, not a law firm (advokatvirksomhed). Contacting or meeting us does not create a client relationship. Any engagement is governed by a written engagement agreement.
2. Scope of this policy
This policy applies where we decide why and how personal data is processed. That covers:
- visitors to our website
- people who contact us or meet with us
- subscribers to our email updates
- contacts at clients, prospective clients, suppliers and partners
- people who interact with our LinkedIn page
- job applicants
Client data. When we process personal data on a client's behalf, including through our contract service, we act as the client's data processor. That processing is governed by our data processing agreement with the client and by the client's own privacy policy, not by this policy. Section 5 describes how our contract service handles that data. If you want to exercise your rights over data we process for a client, contact the client; if you contact us, we will forward your request to them.
3. Personal data we collect
3.1 Data you provide.
- Contact details: name, company, role, email address and phone number.
- Communications: the content of emails, messages and other correspondence with us.
- Meeting details: information you add when booking a call, and notes we take during meetings.
- Subscription details: your email address and your consent to receive updates.
- Engagement and billing details: information needed to agree, deliver and invoice our services.
- Application details: your CV, cover letter and any other information you send when applying to work with us.
3.2 Data collected automatically.
- Technical data: when you visit our website, your IP address, the pages you open, the referring site, your browser and device type, and the time of your visit.
- Email engagement: if you subscribe to our updates, whether an email is opened and which links are clicked.
3.3 Data from other sources.
- Introductions: contact details shared by people who introduce you to us.
- Clients: contact details of people at a client who are involved in an engagement.
- Public professional sources: professional contact details from company websites and LinkedIn profiles.
- LinkedIn: aggregated statistics about our company page.
You are not required to provide personal data to us. Without contact details, we cannot respond to you, and without the information needed for an engagement or an application, we cannot proceed with it. If you share personal data about others, please do so only where you are entitled to.
4. How we use personal data
The table sets out each purpose, the personal data involved, the legal basis under the GDPR and how long we keep the data.
| Purpose | Personal data | Legal basis | Retention |
|---|---|---|---|
| Operating and securing our website | Technical data | Legitimate interest in operating a secure website, Article 6(1)(f) | Deleted by Ghost within 30 days |
| Website analytics | Technical data, used only to produce aggregate statistics | Legitimate interest in understanding how our content is used, Article 6(1)(f) | Only aggregate statistics are kept |
| Responding to enquiries | Contact details and communications | Legitimate interest in responding to enquiries, Article 6(1)(f); steps taken at your request before entering into a contract, Article 6(1)(b) | 12 months after our last contact, unless an engagement follows |
| Arranging and holding meetings | Contact details and meeting details | Legitimate interest in arranging meetings and keeping an accurate record of them, Article 6(1)(f) | Kept with the related contact record |
| Managing business relationships | Contact details, communications, meeting notes and public professional information | Legitimate interest in developing and maintaining business relationships, Article 6(1)(f) | 12 months after our last contact, or for the duration of a client, supplier or partner relationship |
| Email updates | Subscription details and email engagement | Consent, Article 6(1)(a), and section 10 of the Danish Marketing Practices Act | While you are subscribed; consent records for 2 years after you unsubscribe |
| Information to existing clients about similar services | Contact details | Legitimate interest in keeping clients informed, Article 6(1)(f), and section 10 of the Danish Marketing Practices Act | For the duration of the client relationship, or until you object |
| Delivering client engagements | Contact details, communications, meeting details and engagement details | Legitimate interest in delivering our services to the client, Article 6(1)(f); performance of a contract, Article 6(1)(b), where you are the client | 5 years from the end of the financial year in which the engagement ended |
| Invoicing and accounting | Billing details | Legal obligation under the Danish Bookkeeping Act, Article 6(1)(c) | 5 years from the end of the financial year to which the records relate |
| Working with suppliers and partners | Contact details, communications and contract details | Legitimate interest in managing supplier and partner relationships, Article 6(1)(f) | For the duration of the relationship |
| Communicating on LinkedIn | Messages, comments and aggregated page statistics | Legitimate interest in communicating with people who engage with us, Article 6(1)(f) | As long as needed for the conversation |
| Recruitment | Application details | Steps taken before entering into an employment contract, Article 6(1)(b); legitimate interest in assessing candidates, Article 6(1)(f) | 6 months after the recruitment decision for unsuccessful applicants, unless you agree to a longer period |
| Suppression list | Email address | Legitimate interest in respecting your request not to be contacted, Article 6(1)(f) | As long as needed to ensure we do not contact you again |
| Legal claims and compliance | Any of the data above, where relevant | Legal obligation, Article 6(1)(c); legitimate interest in establishing, exercising or defending legal claims, Article 6(1)(f) | Until the matter is resolved or the limitation period expires |
AI assistance. For the purposes above, we use Claude, an AI assistant provided by Anthropic, to help us read, summarise and draft correspondence and documents. Anthropic does not use this data to train its models.
Aggregated statistics. We may create aggregated or de-identified statistics from the data above, for example the number of website visitors. These statistics do not identify you, and we do not attempt to re-identify individuals from them.
No automated decisions. We do not make decisions about you based solely on automated processing, and we do not profile you.
5. Our contract service and AI
Our contract service reviews clients' contracts against their own negotiation positions. In providing it, we act as the client's data processor under a written data processing agreement, and we do not process client data without one. The personal data involved is typically the names, roles and contact details of signatories, approvers and other people named in contracts and related documents.
- Storage in the EU. Data in the service is stored in EU data centres with Supabase and Vercel.
- Zero data retention. The AI providers used by the service do not retain client data after each request.
- No training. Client data is not used to train AI models, by us or by our providers.
- Sub-processors. Each data processing agreement lists the sub-processors used for that client, and we notify clients before we add or replace one.
- Other channels. Client documents may also be exchanged by email through Google Workspace and reviewed with Claude, provided by Anthropic. These providers may process data outside the EU under the safeguards in section 7.
- Service statistics. We use de-identified statistics on how the service performs across clients, for example how often a contract term was read correctly. These statistics contain no personal data, client names, contract text or deal information.
6. Who we share personal data with
We share personal data only with the recipients below, and we do not sell personal data. Each provider processes data on our instructions under a data processing agreement.
| Provider | Used for | Where data is processed |
|---|---|---|
| Ghost (Ghost Foundation Ltd) | Website hosting, analytics and email updates | Inside and outside the EU |
| Google Workspace (Google Ireland Limited) | Email, calendar, video calls and document storage | Inside and outside the EU |
| folk (Folk Inc.) | Customer relationship management | Inside and outside the EU |
| Anthropic (Anthropic Ireland, Limited) | Claude, our AI assistant | United States |
| Vercel (Vercel Inc.) | Hosting and AI gateway for our contract service | EU data centres |
| Supabase (Supabase Pte. Ltd.) | Database for our contract service | EU data centres |
| AI model providers reached through Vercel's AI Gateway, including Anthropic and TypeSafe AI | AI processing for our contract service, with zero data retention | Provider-dependent; specified in the client data processing agreement |
LinkedIn. For statistics about our company page, LinkedIn Ireland Unlimited Company and Represent Legal are joint controllers under an arrangement published by LinkedIn. LinkedIn's own processing is governed by its privacy policy.
Other recipients. We may also share personal data with:
- professional advisers, such as accountants, auditors and lawyers, who are bound by confidentiality
- public authorities, where the law requires it
- others, where necessary to establish, exercise or defend legal claims
- a buyer or successor, if Represent Legal's business is sold, merged or reorganised, under equivalent protection
7. International transfers
We prefer providers that store and process data in the EU/EEA. Where a provider in section 6 processes personal data outside the EU/EEA, the transfer rests on one of these safeguards:
- Adequacy decisions of the European Commission, including the EU-US Data Privacy Framework for certified US providers such as Vercel and Google.
- Standard contractual clauses adopted by the European Commission, with supplementary measures where needed. These apply to Ghost, Anthropic, the support and operations teams of Supabase outside the EU, and folk's providers in the United States that are not certified under the Data Privacy Framework.
Our providers' support teams may access data from outside the EU when we request help or a security incident requires it, under the same safeguards. On request, we will tell you which safeguard applies to each provider and provide a copy of the relevant clauses.
8. Retention
We keep personal data only for the periods set out in section 4. When a period ends, we delete or anonymise the data.
- Longer retention. We keep data longer only where a legal obligation, a dispute or a legal claim requires it, and we then use it only for that reason.
- Backups. Deleted data may remain in backups for a limited period until they are overwritten. It is not used during that time.
- Client data. Data processed for clients through our contract service is kept as the data processing agreement specifies, and is deleted or returned when the engagement ends. Our AI providers do not retain it after each request.
9. Security
We use technical and organisational measures appropriate to the risk to protect personal data against loss, misuse and unauthorised access.
- Encryption. Personal data is encrypted in transit and at rest. In our contract service, data is encrypted at rest with AES-256 and in transit with TLS.
- Access. Access to personal data is restricted to those who need it for their work. Every account used to access personal data is protected with two-factor authentication.
- Backups. The database for our contract service is backed up daily.
- Providers. Each provider is bound by a data processing agreement requiring appropriate security measures. Our hosting and database providers, Vercel and Supabase, hold SOC 2 Type 2 attestations and ISO 27001 certification.
- Breaches. If a personal data breach occurs, we notify the Danish Data Protection Agency within 72 hours where the law requires it, and inform the people affected without undue delay where the breach is likely to result in a high risk to them. Where we act as processor, we notify the client without undue delay.
10. Cookies and similar technologies
Our website sets no cookies and uses no cross-site tracking. Ghost's built-in analytics use no cookies or persistent browser storage, and count unique visitors within 24-hour windows only. Analytics data for Ghost-hosted sites is stored in the EU, and your IP address is used only briefly to derive an approximate country.
Where a function you use needs to store a setting on your device, such as a display preference, that storage is strictly necessary for the function you requested and does not require consent under the Danish rules on cookies. Measurement of email opens and clicks is covered by your consent when you subscribe to our updates. If we introduce optional cookies or tracking, we will ask for your consent first and update this policy.
11. Your rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy
- rectification of inaccurate or incomplete data
- erasure of your data
- restriction of processing
- data portability, for data you provided to us where processing is based on consent or contract
- withdraw consent at any time, without affecting processing carried out before the withdrawal
- lodge a complaint with a supervisory authority
Right to object. Where we rely on legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests. Where we use your data for direct marketing, you may object at any time, and we will stop.
Exercising your rights. Write to hello@representlegal.com. We may ask for information to confirm your identity. We respond within one month, or tell you within that month if we need more time and why.
Complaints. You can lodge a complaint with the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk.
12. Children
Our website and services are intended for businesses and professionals, not for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will delete it.
13. Changes to this policy
We update this policy when our services, our providers or the law change. The date at the top shows when this policy was last updated, and earlier versions are available on request. Where a change materially affects how we use your personal data, we will inform you, or ask for your consent where required.
14. Contact
Questions about this policy or about your personal data can be sent to:
Represent Legal, Rantzausgade 60C, 2200 Copenhagen N, Denmark. Email: hello@representlegal.com.
We aim to respond within two working days.