Privacy policy

How Limetree Legal processes personal data when you use the public website, contact us, or access the SaaS dashboard.

Controller

The controller responsible for processing personal data is Limetree Legal UG (haftungsbeschränkt), Mühlenkamp 31, 22301 Hamburg, Germany.

You can contact us about privacy matters at support@limetreelegal.de.

Website and communication data

When you visit this website, we may process technical access data such as IP address, browser and device information, requested pages, timestamps, referrer URLs, and security logs. This is necessary to deliver the website, keep it secure, and diagnose technical issues.

If you contact us, we process the information you provide, such as your name, email address, organization, and message. We use this data to answer your request and to document business communication where necessary.

SaaS account and workspace data

When you use the Limetree Legal dashboard, we may process account details, organization memberships, authentication events, product settings, user actions, uploaded files, trademark matters, research inputs, filing preparation data, portfolio records, monitoring settings, and related workflow data.

We process this information to provide the SaaS, manage organizations and permissions, operate trademark workflows, secure accounts, improve reliability, and meet contractual or statutory obligations.

Legal bases

Where the GDPR applies, processing is based on performance of a contract or pre-contractual steps, compliance with legal obligations, legitimate interests such as security, service operation and business communication, or consent where we ask for it.

Our legitimate interests include providing and improving the service, protecting accounts and infrastructure, preventing misuse, communicating with customers and prospects, and documenting business operations.

Cookies and local preferences

We use technically necessary cookies and similar storage to provide core functions such as authentication, security, session handling, and language selection. The language selector stores the selected locale in the NEXT_LOCALE cookie.

With your consent, our first-party CRM attribution records landing-page visits, campaign sources, and access-request form details for business follow-up. Raw website events and form submissions are deleted after 90 days; resulting CRM relationship records follow the applicable business and legal retention requirements. You can withdraw consent at any time through Analytics preferences in the footer.

PostHog page usage analytics

With your consent, we use PostHog EU Cloud on the public website and web app to measure page usage. Events include the page path, timestamp, a random identifier held in browser memory, and basic browser and device information. In the web app, variable URL segments are replaced with placeholders. URL query strings, fragments, page titles, form contents and client matter content are excluded. We do not enable session recordings, automatic click capture or personal user profiles. Requests are forwarded through our own domain to PostHog EU Cloud. The random identifier is not stored across page reloads; your consent choice is saved in local browser storage. You can withdraw consent through Analytics preferences in the website footer or the web app. We respect browser Do Not Track and Global Privacy Control signals.

Service providers and recipients

We may use carefully selected service providers for hosting, infrastructure, authentication, email delivery, databases, storage, logging, security, support, and product operations. These providers process data only as instructed by us where they act as processors.

Personal data may also be disclosed where required by law, to enforce contractual rights, to protect the security of the service, or as part of business administration with professional advisers.

International transfers

Where service providers process personal data outside the European Economic Area, we use appropriate safeguards required by data protection law, such as EU standard contractual clauses or adequacy decisions.

Details may depend on the providers used for the relevant customer workspace and service configuration.

Retention

We keep personal data only for as long as necessary for the purposes described in this policy, including providing the service, handling requests, preserving security logs, and complying with legal retention obligations.

Workspace and matter data are generally retained while the relevant account or organization is active and then deleted or anonymized according to contractual, statutory, and operational requirements.

Your rights

Under the GDPR, you may have rights to information, access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.

To exercise your rights, contact us at support@limetreelegal.de. We may need information to verify your identity and understand the scope of your request.

Supervisory authority and updates

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

We may update this privacy policy when our services, processing activities, or legal requirements change. The version published on this website applies.

Processing on behalf of customers

For client matter and workspace content processed on a customer organization’s instructions, that organization generally acts as Controller and Limetree Legal as Processor. The DPA and its annexes govern that processing. We act as Controller to the extent necessary for our own account, contract, billing and business communication purposes. To evidence contract formation, we store each organization’s accepted DPA version, complete agreement record, accepting person’s name and email address, and time of acceptance. Retention follows the contract duration and applicable evidence and retention requirements.