Home / Privacy
Privacy notice
This notice tells you who is responsible for personal data on Datalegale, what we collect, why, how long we keep it, who we share it with, and how to exercise your rights under the GDPR. Knowledge pages and the preview score do not require your name or email.
Last updated 1 September 2026. This is not legal advice.
1. Who is responsible
Datalegale is the controller of personal data processed through this website. Contact: hello@datalegale.com.
This service is offered to organisations in the EU and EEA. We are not Microsoft, and we are not a processor of your Microsoft 365 tenant. Microsoft remains a separate controller or processor of tenant data under your contract with Microsoft.
2. What this notice covers
It covers the public website, the self-assessments, generated reports and PDFs, unlock requests, and optional updates. It does not cover Microsoft products, your own staff files, or third-party sites we link to (Microsoft Learn, Message Center, and similar).
The English text is the binding version. Changing the interface language does not change this notice, the terms of use, or the GDPR guidelines.
3. What we collect
We collect as little as the service needs.
| When | Data | Where it sits |
|---|---|---|
| You use an assessment | Answers you select, and the derived score, flags and findings | Your browser only (local storage), until you unlock a report |
| You unlock a report | Name, work email, company; optionally job title, country, company size, Copilot status; the assessment identifier; score; open flags; whether you asked for updates; time of request | Emailed to Datalegale via Web3Forms. Name, work email and company stay in this browser so the report can be generated. We do not keep a lead list on a server. |
| You visit any page | Technical logs the host may keep (IP address, user agent, path, time) for security and operation | Hosting provider, short period |
| You write to us | Whatever you send in the email | Our mailbox |
We do not ask for passwords, tenant IDs, customer lists, special-category data, or copies of your DPIA. Do not paste those into the form. Quiz answers describe configuration choices, not named staff.
4. Why we process it (purposes and lawful bases)
| Purpose | Lawful basis (Art. 6 GDPR) | Notes |
|---|---|---|
| Run the self-assessment and show a preview score | Art. 6(1)(b) — requested service | No email is required. Answers stay on the device. |
| Deliver the full report and PDF after unlock | Art. 6(1)(b) — requested service, and Art. 6(1)(a) consent (the report checkbox) | You can use the knowledge pages without this. |
| Email Datalegale a copy of the unlock request so we can follow up as a professional service | Art. 6(1)(f) legitimate interest (B2B follow-up on a request you made), together with the consent you give by submitting the form | Work email and company context. You can object at any time. |
| Occasional Copilot and EU-compliance updates | Art. 6(1)(a) consent (separate checkbox) | Off unless you tick it. Withdraw by emailing us. |
| Security, abuse prevention, debugging | Art. 6(1)(f) legitimate interest | Host logs only. No advertising profiles. |
| Respond to rights requests and legal duties | Art. 6(1)(c) legal obligation | Including Art. 15–22 and 33 GDPR where they apply. |
Legitimate interest balancing: you initiated a professional unlock with a work email; we send a single operational copy to ourselves; we do not sell the list; you can object by emailing us and we will stop follow-up.
5. Browser storage and cookies
We do not set advertising, analytics or tracking cookies of our own. We do not run a cookie banner because we do not use non-essential cookies.
Assessment progress, locale and (if you unlock) the contact details you typed sit in your browser’s local storage so you can resume and generate a PDF. That storage is necessary for the service you asked for. Clearing site data in the browser deletes it on that device. It does not delete the email we already received.
A “Created with Grok” badge may load a script from grok.com. We do not use it to advertise to you. The host (Vercel) and that badge may set their own strictly technical cookies; those providers publish their own notices.
6. Who we share it with
We do not sell personal data. We do not publish your answers. Recipients:
| Recipient | Role | What they see |
|---|---|---|
| Datalegale (mailbox) | Controller | Unlock fields, score, flags, updates choice |
| Web3Forms (web3forms.com) | Processor — delivers the notification email | The same unlock payload, so it can send the mail |
| Vercel | Processor — hosts the site | Ordinary server logs. Unlock mail is sent from your browser to Web3Forms, not through a Datalegale database. |
| You (this browser) | — | Answers, report, and the contact details you typed so the PDF can be generated |
Unlock mail is sent from your browser to Web3Forms. It does not pass through a Datalegale database. Web3Forms does not keep a lead list for us.
7. International transfers
Web3Forms and Vercel are organisations that may process data in the United States. Sending an unlock request therefore involves a transfer outside the EEA (GDPR Chapter V).
We use those providers only to run the site and to deliver the email you asked us to receive. If you do not want that transfer, do not unlock a report. The articles, questionnaires and preview score still work in the browser.
We do not send quiz answers, PDFs or tenant identifiers to those providers except the score and flags that travel with an unlock email.
8. How long we keep it
| Data | Period |
|---|---|
| Answers in the browser | Until you clear site data or start over |
| Unlock email in our mailbox | 24 months from the request, or from last meaningful contact, then deleted or anonymised — sooner if you ask and no legal hold applies |
| Updates list | Until you withdraw consent or we stop the list |
| Host logs | Short operational period, typically under 90 days |
| Rights-request correspondence | As long as needed to handle the request and show we complied |
9. Security
Transport is HTTPS. Unlock payloads are checked in the browser (required fields, length limits, email format). A honeypot field is used to drop obvious bots. We do not store work emails in a shared public database — there is no staff sign-in on this version of the product.
No method is perfect. Do not put secrets in the form. If we become aware of a personal-data breach likely to result in a risk to you, we will handle it under Articles 33 and 34 GDPR.
10. Your rights
Where the GDPR applies, you may:
- Access the personal data we hold about you (Art. 15)
- Have inaccurate data rectified (Art. 16)
- Ask for erasure (Art. 17), including the unlock email, subject to legal holds
- Restrict processing (Art. 18)
- Object to processing based on legitimate interests, including B2B follow-up (Art. 21)
- Receive data you provided in a reasonable machine-readable form (Art. 20) — a copy we send you from the mailbox
- Withdraw consent at any time, without affecting processing already carried out (Art. 7(3))
- Lodge a complaint with a supervisory authority (Art. 77) — see GDPR guidelines
Write to hello@datalegale.com with the work email you used. We may need to confirm identity. We respond within one month, or we tell you if we need more time (up to two further months for complex requests).
11. Automated scoring
The readiness score is produced automatically from the answers you selected, using the published method. It is a self-assessment of a tenant configuration. It is not a decision that produces legal effects about you as a person, and it is not profiling for advertising. Article 22 GDPR does not apply. Details: How we score.
12. Children
The service is for people acting for an organisation. It is not directed at children. Do not submit data relating to anyone under 16.
13. Changes
We will change this notice when the processing changes. The date at the top will move. Continued use after a material change is subject to the new notice. Last updated 1 September 2026.