1. Data Controller
Legionyx, hereinafter referred to as the “Data Controller” or “we”, is responsible for the processing of your personal data in accordance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.
2. Data We Collect
We collect and process the following categories of personal data:
• Identification data: first name, last name, job title, organisation name.
• Contact data: email address, phone number, mobile number, WhatsApp/Viber contact details, postal address.
• Organisation data: industry, company size, revenue range, number of employees, number of facilities.
• Technical data: IP address, browser type, device information, usage data collected via cookies and similar technologies.
• Water safety data: information you voluntarily provide through the customer discovery questionnaire regarding your Legionella management practices and facility infrastructure.
3. Legal Basis for Processing
We process your personal data on the following legal grounds:
• Consent (Art. 6(1)(a) GDPR): when you voluntarily submit information via our registration forms, questionnaires, or newsletter sign-ups.
• Contractual necessity (Art. 6(1)(b) GDPR): when processing is necessary to provide our services under a subscription agreement.
• Legal obligation (Art. 6(1)(c) GDPR): when we are required to retain records for compliance with water safety and tax regulations.
• Legitimate interests (Art. 6(1)(f) GDPR): for network security, fraud prevention, and improving our services.
4. Purposes of Processing
Your personal data is processed for the following purposes:
• Provision and management of the Legionyx platform and subscription services.
• Customer onboarding, account setup, and technical support.
• Communication regarding service updates, regulatory changes, and product information.
• Compliance with legal obligations, including record-keeping for water safety audits.
• Analytics and service improvement, conducted on an anonymised or pseudonymised basis wherever possible.
5. Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected:
• Active customer account data: for the duration of the subscription plus 5 years for compliance record retention.
• Marketing data: until withdrawal of consent.
• Discovery questionnaire data: 24 months from submission, unless a subscription agreement is entered into.
After the retention period, data is securely deleted or irreversibly anonymised.
6. Data Sharing & Recipients
We do not sell your personal data. Data may be shared with:
• Cloud hosting providers operating within the EU/EEA under GDPR-compliant data processing agreements.
• Payment service providers (card processors, PayPal, Apple Pay, Google Pay) for the sole purpose of processing transactions.
• Professional advisors (legal, accounting) where legally required.
• Public authorities, where mandated by law or court order.
All third-party processors are bound by written agreements ensuring GDPR compliance and appropriate technical and organisational measures.
7. International Data Transfers
Your personal data is primarily stored and processed within the European Union. Where any transfer to a third country is necessary, we ensure it is protected by:
• An adequacy decision by the European Commission, or
• Standard Contractual Clauses (SCCs) approved by the European Commission, or
• Binding Corporate Rules (BCRs) where applicable.
8. Your Rights Under GDPR
As a data subject, you have the following rights:
• Right of access (Art. 15): obtain a copy of your personal data.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data (“right to be forgotten”).
• Right to restriction (Art. 18): limit the processing of your data.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@legionyx.com. You also have the right to lodge a complaint with your national data protection authority.
9. Data Security
We implement industry-standard technical and organisational measures to protect your personal data, including:
• TLS/SSL encryption for data in transit.
• AES-256 encryption for data at rest.
• Role-based access control and multi-factor authentication.
• Regular security audits and penetration testing.
• ISO 27001-aligned information security management practices.
Despite these measures, no system can be guaranteed 100% secure. In the event of a personal data breach, we will notify the supervisory authority and affected data subjects within 72 hours, as required by Art. 33–34 GDPR.
Contact Our Data Protection Officer
For any privacy-related questions, requests, or complaints, please contact us at:
📧 office@legionyx.com
📍 Ljubljana, Slovenia