Who is responsible and how to contact us
Impactify LTD (Cyprus company HE474043) operates Legally.cy and is responsible for the purposes and handling of personal information in its platform services. Correspondence: Neofytou Nikolaidi & Theod. Kolokotroni, Onisiforou Center, 2nd Floor, 8011 Agios Theodoros, Paphos, Cyprus. Use Contact us on About us and choose Privacy request as the subject for questions or rights requests. Give a reference or account ID if you have one; do not include identity documents in the public form.
Contact enquiries and follow-up
The Contact us form sends your name, email, international phone number, selected service and message to our internal team through Resend. We use these details to respond to your request and take steps towards the service you ask about. Providing the required details allows us to respond; without them the form cannot be submitted. A registration or confirmed payment also generates an internal team notification. After confirmed payment, we use your email and phone to contact you within 2–3 days and arrange an introductory meeting about your needs and next steps. We do not send automatic customer emails or SMS or add these details to a marketing list.
Accounts, enquiries and session records
Creating an account stores your name, email, phone, password hash, account and session records in the connected Turso database. Passwords are not stored as plain text. Contact details are self-declared and are not independently verified. Draft and submitted enquiries are associated with your account; authorised staff can access submitted requests to arrange administrative next steps. The workspace has no general document-upload facility. Use an agreed professional channel for sensitive legal records, private evidence or identity documents.
Orders and Stripe checkout
Your platform order records the chosen service, accepted scope and terms, amount, VAT treatment, customer account and contact details, payment references and status. Stripe hosts checkout and processes payment and billing information, including any address or tax details you enter there. The platform receives the relevant transaction status and references rather than your complete card details. Confirmed payments create a follow-up record with the service, contact name, email, phone, amount and contact-by date. A platform payment does not itself appoint an advocate. Stripe also handles information for its own payment, fraud-prevention and regulatory purposes under its privacy notice.
Why we process information
We use account, enquiry and order information to take requested pre-contract steps and provide the platform services you buy. We use necessary technical, session and abuse-prevention records for our legitimate interests in keeping the platform secure, preventing misuse and investigating faults, with regard to your rights. We retain information where necessary for applicable accounting, tax, dispute or other legal duties. Where a separate optional use relies on consent, you may withdraw it without affecting earlier lawful handling. We do not make legal eligibility or other similarly significant decisions about you solely by automated means.
Service providers and access
Authorised Impactify staff handle customer requests. Vercel provides hosting and technical delivery, Turso provides the connected database, Resend delivers internal notifications, and Stripe handles checkout and payment processing. Our internal notification inbox is managed for Impactify by Marketin; only authorised personnel may use it for the stated service and follow-up. Relevant information is shared with an independently appointed professional only for the agreed assignment and through the appropriate channel. It is not posted publicly or sold as a contact list.
Locations and international processing
The application is configured for Vercel Functions in Ireland. Hosting, database, payment, email and support providers may also process information in other countries under their service arrangements. Where personal information is transferred outside the EEA, applicable transfer safeguards, such as an adequacy decision or approved standard contractual clauses, must apply as required. Ask through Contact us for information about the safeguards relevant to your records; a server region alone is not a promise that every provider processes solely in the EEA.
How long information is kept
Account and enquiry records remain while needed to provide the account, respond to the request or complete the agreed service. On closure or a deletion request, staff review what is still necessary for an outstanding matter, applicable record-keeping duties or a legal claim; records no longer needed should be deleted or anonymised. Payment and accepted-scope records may need to be retained for applicable tax, accounting and claims periods rather than erased immediately on account closure. Accepted notification payloads are cleared from the application outbox after delivery, and accepted outbox metadata older than 90 days is removed when the retry task runs. Pending messages remain until resolved. Mailbox copies, provider logs and backups have their own service retention and are included in a justified deletion review. Ask for the retention basis and period applicable to your particular records.
Your rights and request route
Subject to the conditions and exceptions in applicable data-protection law, you can request access, correction, erasure, restriction, objection and portability, and withdraw any consent-based permission. Signed-in account controls allow record export, profile correction and a recorded deletion-review request. You can also use About us → Contact us with Privacy request as the subject; sign-in is not required for that form. We may need proportionate information to confirm identity and explain any information that must be retained. A recorded deletion request is not confirmation of completed erasure. We respond without undue delay, normally within one month; if a lawful extension is necessary we explain it. You may complain to the Cyprus Commissioner for Personal Data Protection or another competent data-protection authority and seek available judicial remedies.
Cookies, logs and local preparation tools
The website uses necessary session and security cookies for sign-in and request protection. Hosting may process IP addresses, browser details and access logs. Rate-limit keys use a server-secret HMAC of the forwarding address and time bucket. We do not install advertising trackers or non-essential marketing analytics. The fee calculator and consultation brief run in your browser and are not sent automatically to the Contact us form, platform team or lawyer. Calculator values remain in page memory until cleared or the page reloads. Downloaded files remain on your device under your control. Illustrative footage is served as local assets; viewing it does not call the Pexels API.
Professional confidentiality and separate responsibilities
An independent advocate is responsible for the personal information and professional confidentiality of its own accepted engagement. Data roles follow the actual services and purposes, not a label or a signature alone. Shared technology does not make all platform records legally privileged. Agree the private channel for confidential evidence before sending it. The platform retains responsibility for its own handling and applicable rights and remedies.