Privacy Policy

1. Data Controller

This Privacy Policy explains how personal data is processed when visitors use lexonyx.com, submit enquiries, communicate by email or interact with the independent professional practice operating under the LEXONYX name.

Personal data is processed in accordance with applicable German and European Union law, including Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).

LEXONYX is the commercial designation of the independent professional practice operated by Liudmyla Miroshnychenko.

Data Controller:

Liudmyla Miroshnychenko (LEXONYX)
Haunstetter Straße 105
86161 Augsburg, Germany

Email: info@lexonyx.com

Liudmyla Miroshnychenko holds the professional title Advokat (Ukraine) and has been registered with the Rechtsanwaltskammer München since April 2026 pursuant to sections 206–207 of the German Federal Lawyers' Act (BRAO).

Legal services concerning Ukrainian law are provided within the applicable professional authorisation. Further information about professional status is available in the website's Impressum.

Enquiries relating to personal data may be submitted to the email address above.

2. Categories of Personal Data

Depending on the nature of the interaction, LEXONYX may process:

Information provided by users:

• Names, email addresses and other contact details provided voluntarily.
• Information about companies, professional roles, relevant jurisdictions and the nature of enquiries.
• Information submitted through website contact forms.
• Email correspondence, documents and information required to assess or carry out an engagement.
• Information required to assess whether an engagement can be accepted and to comply with professional or statutory obligations.

Technical information:

• IP addresses and connection information.
• Browser type, operating system and device characteristics.
• Dates and times of website access.
• Technical logs and information required for website security, form operation and spam prevention.

Analytics information:

• Pages visited, referral sources and website interactions.
• Events and identifiers processed by Google Analytics subject to the necessary consent.

The ordinary contact form is not intended to collect special categories of personal data under Article 9 GDPR.

Please do not submit health information, other particularly sensitive information, passports, bank statements, full confidential agreements or documents containing information protected by professional secrecy through the initial contact form. An appropriate secure communication channel can be arranged separately.

Where processing of special categories of personal data or information falling under Article 10 GDPR is necessary for a particular engagement, the applicable additional legal grounds and safeguards are observed.

3. Purposes and Legal Bases of Processing

Responding to enquiries and assessing potential engagements.

Article 6(1)(b) GDPR applies where processing is necessary to take pre-contractual steps requested by an individual who may become a party to a contract.

For enquiries submitted on behalf of companies and in other appropriate circumstances, processing may be based on Article 6(1)(f) GDPR and the legitimate interest in responding to business and professional enquiries and communicating with prospective clients.

Providing agreed professional services.

Processing is based on Article 6(1)(b) GDPR where necessary to perform a contract with the data subject, or another applicable legal basis depending on the engagement and the client relationship.

Compliance with professional, tax, accounting and other statutory obligations.

Article 6(1)(c) GDPR applies where processing is necessary to comply with a specific legal obligation, including applicable documentation and record-retention requirements.

Website operation and security.

Article 6(1)(f) GDPR applies to the legitimate interests of maintaining website functionality, protecting technical infrastructure, preventing misuse and handling technical enquiries.

Website analytics.

Google Analytics is used only after the required prior consent has been obtained under Article 6(1)(a) GDPR and in compliance with section 25 TDDDG where applicable.

Establishing, exercising or defending legal claims.

Personal data may be processed where necessary and supported by an appropriate legal basis, including Article 6(1)(f) GDPR where applicable.

Newsletter subscriptions.

LEXONYX is not currently sending newsletters. The website subscription form is unavailable until email address confirmation (Double Opt-in) is introduced; new subscriptions are not being accepted through the website. Once activated, subscription will require separate, freely given consent under Article 6(1)(a) GDPR and compliance with section 7 UWG. Submitting the form alone will not confirm a subscription. Informational emails will be sent only after address confirmation and valid consent, with an unsubscribe option at any time. Previous test submissions are not treated as confirmed subscriptions.

Providing necessary contact details and a description of the enquiry enables LEXONYX to respond. Additional information is voluntary unless required for a particular engagement or by law. Without necessary information, LEXONYX may be unable to assess an enquiry or provide certain services.

4. Recipients of Personal Data and Service Providers

LEXONYX does not sell personal data or provide it to advertising networks for their independent marketing purposes.

Depending on the purpose of processing, the following categories of recipients and service providers may have access to personal data.

Netlify. Netlify is used to host the website, operate contact forms and store enquiries submitted through Netlify Forms. Notifications of submissions are delivered by email. Netlify uses technical safeguards and specialised service providers for spam prevention, including Akismet (Automattic).

Email service providers. These providers enable the receipt, sending, storage and technical processing of email correspondence. They may process contact details, sender and recipient information, message contents, attachments and necessary technical information.

Google Analytics. Google Analytics processes website usage information only where the necessary consent has been obtained.

Locally hosted fonts. The website font files are hosted within the LEXONYX website infrastructure and loaded from its domain. Loading them does not require a connection to Google Fonts servers.

External professional advisers. If an agreed engagement requires assistance from a qualified professional in another jurisdiction, the arrangements for their involvement and any necessary data sharing are agreed separately, subject to professional secrecy and applicable legal requirements.

Competent public authorities. Personal data may be disclosed where required under applicable law.

Depending on their role, recipients may act as processors on behalf of LEXONYX or as independent controllers.

Engagements with processors must comply with Article 28 GDPR. Where access to information protected by professional secrecy is provided, applicable professional requirements, including section 43e BRAO, must also be observed.

5. International Transfers of Personal Data

The use of technical infrastructure and its subprocessors may involve transfers of personal data, or access to such data, outside the European Economic Area (EEA).

Depending on the relevant services, processing may in particular involve the United States and Ukraine.

For the United States, the applicability of an adequacy decision of the European Commission depends, among other factors, on whether the particular recipient participates in the relevant EU–US Data Privacy Framework.

There is no general European Commission adequacy decision for Ukraine under Article 45 GDPR.

Transfers falling within Chapter V GDPR must be supported by an applicable legal transfer mechanism. In the absence of an adequacy decision, safeguards under Article 46 GDPR may be used, including European Commission Standard Contractual Clauses and any necessary supplementary measures. Derogations under Article 49 GDPR apply only where their conditions are met.

Information about actual international transfers, applicable safeguards and how to obtain copies may be requested at info@lexonyx.com.

6. Cookies and Analytics

The website uses necessary technical storage and related technologies for its operation, security and retention of user preferences.

Google Analytics is used only after the visitor has provided the necessary prior consent.

Visitors may refuse optional analytics or withdraw consent through the website's cookie settings. Refusing analytics does not prevent access to the website's main content.

Additional information on cookies, similar technologies and available controls is provided in the separate Cookie Policy.

7. Retention of Personal Data

Personal data is retained only for as long as necessary for lawful processing purposes, or longer where required or permitted by applicable law.

Initial enquiries not resulting in an engagement. Initial enquiry data is subject to manual review and deletion, generally no later than six months after the last substantive exchange, or earlier once the processing purpose ends. Longer retention is permitted only where a separate documented legal obligation or a specific need to establish, exercise or defend legal claims applies; the need for each exception is reviewed. This covers Netlify Forms records, business email correspondence and accessible copies, subject to the actual retention cycle for backups. Enquiries that become accepted professional matters are classified separately.

Professional matter files. These are retained during the engagement and thereafter in accordance with applicable professional and statutory requirements. For lawyers' matter files subject to section 50 BRAO, the retention period is six years, calculated from the end of the calendar year in which the engagement ended.

Accounting and tax records. These are retained for applicable periods, which may be 6, 8 or 10 years depending on the category of the document.

Google Analytics. Retention of user-level and event-level data is determined by the settings actually configured in the service. These settings limit the retention of granular data; standard aggregated reports may be retained separately.

Records of consent. These are kept for the period reasonably necessary to demonstrate compliance with legal requirements and protect relevant legal claims.

Technical logs. These are retained for a justified period necessary for website operation and security, taking provider settings and applicable requirements into account.

After the applicable retention period, data is deleted or anonymised unless continued retention is permitted by law.

8. Data Subject Rights

Subject to the conditions provided by GDPR, individuals have the right to:

• Access their personal data (Article 15).
• Rectify inaccurate personal data (Article 16).
• Request erasure (Article 17).
• Restrict processing (Article 18).
• Data portability in the circumstances provided by law (Article 20).
• Object to processing (Article 21).
• Withdraw consent without affecting the lawfulness of processing before withdrawal (Article 7(3)).
• Lodge a complaint with a competent supervisory authority (Article 77).

Right to object. Where processing is based on legitimate interests under Article 6(1)(f) GDPR, an individual may object on grounds relating to their particular situation in accordance with Article 21.

Where personal data is processed for direct marketing, individuals may object to such processing at any time.

Requests may be sent to info@lexonyx.com.

The competent supervisory authority for the private sector in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach, Germany
https://www.lda.bayern.de/

The right to lodge a complaint with another competent supervisory authority remains unaffected.

LEXONYX does not use personal data for decisions based solely on automated processing that produce legal or similarly significant effects for an individual within the meaning of Article 22 GDPR.

9. Data Security and Professional Confidentiality

LEXONYX applies technical and organisational measures appropriate to the nature of the information, the risks involved and the requirements of Article 32 GDPR.

Such measures may include secure data transmission, access restrictions, access controls and contractual confidentiality safeguards when engaging service providers.

Transmitting information over the Internet may involve technical risks, but this does not relieve LEXONYX of its applicable obligations to protect personal data.

Submitting an enquiry through the website does not, by itself, establish a legal services agreement or constitute acceptance of a professional engagement.

However, information received in connection with legal professional activities is protected by applicable duties of confidentiality and professional secrecy, including where such duties arise before a formal engagement agreement is signed.

Disclosure of confidential information to technical service providers or independent professionals is subject to applicable data protection and professional confidentiality requirements.

Users are encouraged to agree on an appropriate secure channel before sending particularly sensitive documents.

10. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes in legislation, technical infrastructure or actual personal-data processing practices.

The current version is published on lexonyx.com with its update date.

Where required by applicable law, additional information will be provided in connection with material changes.