Privacy Policy

1. Information we may process

For company formation and legal operations, Trustlex may process names, contact details, nationality, identification numbers, passport or ID copies, legal-address details, shareholder/director information, beneficial-ownership information, payment records, uploaded documents, messages, and case history.

The current local prototype uses synthetic or browser-local demo data. A production launch requires secure server-side storage, access controls, and retention rules before real personal data is accepted.

2. Purpose of processing

Information is used to assess service eligibility, prepare company-registration documents, conduct legal review, manage Power of Attorney and courier workflows, communicate with clients, maintain audit logs, process payments, and comply with legal or professional obligations.

3. Sharing and processors

Client information may need to be shared with lawyers, notaries, translators, couriers, payment providers, verification providers, banks, government authorities, public registries, and hosting/storage providers when necessary for the service.

Before launch, Trustlex should document all processors and confirm appropriate contracts, security measures, and cross-border transfer safeguards.

4. Security

Production document storage should use encryption, private download links, malware scanning, immutable versions, access logging, and role-based permissions.

Staff access should be limited to need-to-know roles, with audit logs for sensitive actions such as viewing, downloading, approving, rejecting, or replacing documents.

5. Retention and deletion

Trustlex should retain documents and case records only for as long as needed for service delivery, legal obligations, dispute handling, accounting, and audit requirements.

A final retention schedule must be approved before accepting real client documents.

6. Pre-launch notice

This policy is a launch-preparation draft and must be reviewed for Georgian law, target-client jurisdictions, payment-provider requirements, and any applicable data-protection obligations before public use.