Last updated 04 June 2026
Legora may use your personal data for the following purposes:
to provide, administer, maintain, and/or improve our Services;
to provide you with support services, resolve issues or reply to your queries;
to manage and remember your preferences and customize the Services;
to communicate with you, including to send you information or marketing about our Services and events;
to analyze and study the effectiveness of our Services and to develop new features and services;
to verify your identity, prevent fraud, criminal activity and to ensure the security of our IT systems, architecture, and networks;
to prevent misuse of the Services and enforce our legal terms;
to comply with legal obligations and legal processes, and;
to protect Legora’s rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.
The following disclosures are intended to provide additional information about the categories of Personal Information we collect (as defined above), the type of data, how we use each category of Personal Information. These disclosures do not limit our ability to use or disclose information as described above.
Purpose – what we do and why
Types of personal data (see Section 2)
Legal basis
Data retention (see Section 8)
Customer Relationship Management – To manage our customer relationship with you and/or your employer in accordance with our agreements, for each service you use. This includes creating and sending information to you in electronic format.
From you or your employer:
User account information
Communication information
From other sources:
User account information
Log data,
Device information,
Usage data.
The processing is necessary for Legora to perform a contract with you and/or your employer (Article 6(1)(b) GDPR).
When the relevant contracts terminate.
Surveys & Research – To be able to perform end user satisfaction surveys, conduct market research as well as ask for reviews from you, through email, text messages, or via other communication channels.
From you:
Survey and contest information
Testimonial and review information
From other sources:
Technical Information.
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in being able to perform the personal data processing, that the processing is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose.
When the contract between us terminates.
Network & Information Security – To ensure network and information security in Legora’s Services.
From you:
User account information
From other sources:
Technical Information.
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in being able to ensure network and information security, that the processing is necessary to realize that purpose, and that our interest outweighs your right not to have your data processed for this purpose. It is also in your interest as a user and our Subscriber’s interests that we ensure good information security.
For as long as you are using the Services.
Product Development – To perform data analysis for development and improving our Services
From you:
User account information
From other sources:
Technical Information.
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in using your personal data for product development purposes and in analysing customer behaviour in order to improve the service and customer experience. We ensure that the particular processing this entails is necessary to achieve the purpose in question, and that our interest outweighs your right not to have your data processed for this purpose.
For as long as you are using the Services.
Billing & Usage Costs – To calculate usage costs in relation to suppliers and Subscribers (if possible, we first anonymize the data).
From other sources:
Usage data.
The processing is necessary for Legora to perform a contract with you and your employer (Article 6(1)(b) GDPR) and based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in calculating costs resulting from your usage of our Services.
This processing takes place for up to 6 months after using a Service or longer if required under applicable law or to safeguard Legora’s legal rights.
Identity Verification – To check and verify your identity.
From you:
User account information
From other sources:
Technical Information
The processing is necessary for Legora to perform a contract with you and your employer (Article 6(1)(b) GDPR).
As long as you use the Services.
Data Sharing – To share your personal data with the categories of recipients described in Section 4 (suppliers and subcontractors and companies within the Legora Group)
All types mentioned in section 2.
Varies depending on the recipient (see Section 4).
For the entire period during which Legora must retain the data in its systems, for example, to fulfil the agreement with your employer or to comply with applicable law.
Marketing Segmentation – To decide what kind of marketing or marketing surveys we will provide to you. If you do not want us to perform this processing of your personal data, please contact us. We will then cease to use your data for this purpose.. The processing may constitute profiling.
From you:
Communication information
Social media information
Marketing information
From other sources:
Technical Information
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in identifying which type of marketing we should provide to you. We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.
If you notify us that you are not interested in this processing.
Newsletters & Direct Marketing – To send you our consent-based newsletters and other direct marketing communications containing updates on Legora's products, services, events and other related content, as well as marketing surveys about offers from Legora and our affiliates. You may subscribe to our newsletter(s) by providing your explicit, informed consent (e.g. via a sign-up form on our Site or during account registration). Each newsletter will contain an unsubscribe link enabling you to opt out at any time.
From you:
Communication information
Social media information
Marketing information
From other sources:
Technical Information
The processing is based on your freely given, specific, informed and unambiguous consent (Article 6(1)(a) and Article 7 GDPR; Article 13 of the ePrivacy Directive as implemented in applicable national law). Consent is obtained prior to sending any marketing communications and may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Until you withdraw your consent or unsubscribe from our marketing communications. Upon withdrawal of consent or opt-out, we will cease sending marketing communications to you without undue delay. We may retain a record of your consent and its withdrawal for a reasonable period thereafter to demonstrate compliance with applicable laws.
Legal Protection – To protect Legora from legal claims and safeguard Legora’s legal rights.
All types mentioned in Section 2. In the event of a dispute, we may also collect other types of personal data concerning you if we need them to exercise our rights.
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Legora has determined that we have a legitimate interest in being able to protect ourselves from legal claims. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.
This processing takes place for the entire period during which Legora must retain the information in its systems, for example to perform the contract with you and your employer or to comply with applicable law.
Cookies & Tracking Technologies – Cookie-based data collection for analytics, marketing, preference tracking and other purposes on the Legora Site, as further described in our Cookie Policy.
Technical Information, including IP addresses, browser type and settings, device identifiers, cookie identifiers, browsing behaviour, referral URLs and interaction data.
The processing of data collected through strictly necessary cookies is based on legitimate interest (Article 6(1)(f) GDPR), as such cookies are essential for the operation of the Site. The processing of data collected through analytics, marketing and other non-essential cookies is based on your consent (Article 6(1)(a) GDPR), obtained in accordance with Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC) as implemented in applicable national law. See our Cookie Policy for further details.
As set out in the Cookie Policy. Retention periods vary depending on the category and purpose of each cookie or similar technology.
In certain circumstances, we may share your personal information with third parties without further notice to you, unless legally required, including without limitation in the situations below:
Affiliates: Legora may share your personal data with other entities within the Legora corporate group (our “affiliates”), of which includes our parent company. Legora’s affiliates will only use the personal data we share with them in a manner consistent with this Privacy Policy.
Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may share your personal data with vendors and service providers, including providers of hosting services, cloud service providers, and other information technology services providers, event management services, email communication software and email newsletter services, advertising and marketing services, and web analytics services. The specific third-party cookie vendors and similar technology providers we use on our Site are identified in our Cookie Policy. Pursuant to our instructions, these parties will access, process, or store personal data in the course of performing their duties to us.
Third-party Websites and Services. Our Services may contain links to other websites not operated or controlled by Legora, including social media services (“third-party sites”). The information that you share with third-party sites will be governed by the specific privacy policies and terms of service of the third-party sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the third-party sites directly for information on their privacy practices and policies.
Other users: When you are using the collaboration features within Legora, certain actions you take may be visible to other users of our services.
Plug-Ins. When you are using third party applications and choose to connect your Legora account with such external third-party applications (for example to use our Microsoft Word plug-in) the providers of those services or products may receive information about you from Legora or others. Please be aware that when you use third-party sites or services, their own terms and privacy policies will govern your use of those sites or services. Please contact the supplier of such applications directly for information on their privacy practices and policies.
Business changes: If we are involved in strategic transactions, (such as sale, merger, reorganizations, liquidation, or transition of service to another provider), your personal data and other information may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction along with other assets.
Legal Requirements: Legora may also share your personal data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
Legora always strives to process your personal data as close to you as possible. By using our Site and Services however, you understand and acknowledge that your personal information will be transferred from your location to our facilities and servers in the EU/EEA.
In certain situations, such as when we share your information within the Legora corporate group or with a supplier or subcontractor, your personal data may be transferred outside the EU/EEA. Legora always ensures that the same high level of protection applies to your personal data according to the relevant data protection laws, even when the data is internationally transferred. Your rights in respect to your personal data (described in detail in section 6), are not affected when data is internationally transferred. You will find more information about the recipients Legora shares your data with in section 4.
Safety measures Legora uses when conducting international transfers
Countries outside of the EU/EEA or your country of residence may have laws that allow public authorities to request access to personal data stored in the country for the purpose of combating crime or safeguarding national security. Regardless of whether we or any of our providers process your personal data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, in accordance with applicable data protection requirements (such as the GDPR).
Such appropriate safeguards include, but are not limited to:
Adequacy decisions. If the relevant authority (e.g. the EU Commission) has decided that the country to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the relevant data protection laws. This means for example that the personal data is still protected from unauthorized disclosure, and that you may still exercise your rights with regard to your personal data,
Standard Contractual Clauses. The relevant authority’s standard clauses have been entered into between Legora and the recipient of the personal data. This means that the recipient guarantees that the level of protection for your personal data afforded by the relevant data protection laws still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affects the protection of your personal data. Where necessary, we take technical and organizational measures so that your data remain protected during the transfer to the relevant country.
Derogation. In limited circumstances, we may rely on an exception, or ‘derogation’ under the applicable data protection laws, to transfer your personal data to such country despite the absence of an adequacy decision or standard contractual clauses, such as relying on your explicit consent to that transfer or because it is necessary for the establishment, exercise or defence of legal claims (including regulatory, administrative or any out-of-court procedure, and seeking advice).
Data Privacy Framework. If the transfer is covered by a relevant data privacy framework, such as the EU-US Data Privacy Framework, which is an opt-in certification scheme for US companies, administered by the US Department of Commerce. Data privacy framework include sets of enforceable principles and requirements that must be certified to company, ensuring that your data is still being sufficiently protected.
Legora retains your personal information for as long as necessary to fulfill the purposes for which we collected it or longer if that is required under applicable law:
If you are a Legora user covered by a Subscription Agreement between your employer and Legora, we will delete your data in accordance with that Subscription Agreement.
Personal data that Legora is under a legal obligation to retain, for example under anti-money laundering or bookkeeping laws, is retained for the required periods under applicable laws (generally for 5 or 7 years).
Personal data which is not used for the purposes of a contractual relationship or where Legora does not have a legal obligation to retain the data is only retained as long as necessary to fulfil the respective purpose for our data processing.
More information can be found in the table in Section 3. For more information about the retention periods applicable to cookies and similar technologies used on our Site, please see our Cookie Policy.
In some limited cases, the personal data may need to be stored for a longer period in order for Legora to protect its legal rights. If we don’t have a legal obligation to retain the personal data, we instead have to make an assessment if we may require the personal data in order to protect Legora from legal claims.
Please note that just because we have a legal obligation to store your personal data, this does not mean that we are also permitted to use this data for any other purpose.
When we no longer need your personal data, we will delete it or anonymize it in accordance with our data retention policies and applicable laws, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.
We may update this Privacy Policy from time to time. When the Privacy Policy is updated, we will post an updated version on this page, unless another type of notice is required by applicable law or contractual agreement. By continuing to use our Online Services or providing us with personal data after we have posted an updated Privacy Policy, or notified you by other means, you consent to the revised Privacy Policy.
If you have any questions about our Privacy Policy or any other privacy related issue, please contact us at privacy@legora.com or via mail.
Controller’s Contact Information:
Legora AB, 559338-6872
Box 7242
103 89 Stockholm
Sweden