Privacy notice (draft)

Who is responsible

LEIPHY ([Legal name TBD], org.nr [orgnr], [address]) is the controller for personal data we process. Contact: [email protected]. For order support you can also write to [email protected].

What we collect when you order

Your email address, the role you order as (or the signatory email you give us), your answers about the company and its parent, the company details you confirm, and a record of your consent. Card details go to our payment provider and never reach us.

Notify-me emails while ordering is paused

If you leave your email address to hear when ordering opens, we use it for two things only: an email asking you to confirm the address, and one email when ordering opens. We store the email address, the company you started an order for, and when you confirmed.

• Unconfirmed addresses are deleted after 30 days.
• Confirmed addresses are deleted once the "ordering is open" email has been sent, or after 12 months if ordering hasn't opened by then.

You can ask us to delete your address at any time, and each email has a link to do so.

Renewal reminders (opt-in)

If you ask for a renewal reminder for a LEI, we store your email, the LEI and organisation number, the consent wording you saw, the time and IP of signup and confirmation, and the next renewal date we read from GLEIF. We only send reminders after you confirm the email (double opt-in). You can unsubscribe in one click; we keep a suppression record so we do not email you again. We delete the reminder record on request. Purpose: send 42/30/7-day renewal reminders you asked for. Retention: while the reminder is active, then as needed to honour an unsubscribe.

Bulk LEI status check

If you paste organisation numbers into the public bulk checker, we process them server-side against Brønnøysundregistrene and GLEIF and show status in the browser. Input lists are deleted within 24 hours. We do not create an account or save a portfolio from this tool.

Where company data comes from

Company and role data is read from Brønnøysundregistrene (Brreg). Existing LEI data is read from GLEIF (the Global LEI Index). We use the same public sources when we prepare B2B outreach.

B2B outreach (legitimate interest)

We may contact companies that appear in GLEIF or Brønnøysundregistrene about LEI registration, renewal or transfer. The lawful basis is legitimate interest (GDPR art. 6(1)(f)): helping companies keep LEI records accurate and usable with banks and counterparties. We only use business contact details tied to the company (for example a published business email or role contact), not private consumer marketing lists.

Information we owe you (GDPR art. 14)

If we obtain your business contact details from GLEIF or Brønnøysundregistrene rather than from you, this notice is how we tell you: who we are, what we use the data for (LEI-related B2B outreach and order fulfilment), the sources (GLEIF / Brreg), the legitimate-interest basis, how long we keep outreach records, and how to object. We provide this information in the first message we send you, or within a reasonable period afterwards.

What is published

An LEI and its company reference data are published openly by GLEIF and cannot be deleted.

Who we share it with

Our payment provider, our email provider, and the LEI issuer we apply with (an accredited issuer partner, planned: RapidLEI), only as needed to process your order. We do not sell personal data.

How long we keep it

Order and LEI maintenance data: for as long as the LEI is maintained, and as long as accounting and anti-money-laundering rules require afterwards. B2B outreach contact records: up to 24 months from the last outreach contact, or until you object — whichever comes first. Suppressed contacts (people who objected) are kept only as needed to honour the objection. Notify-me retention is described in “Notify-me emails while ordering is paused”.

Cookies

We use only essential cookies needed to run the service (for example a signed session so you can resume an order). We do not currently use non-essential analytics or marketing cookies, so there is no cookie consent banner. If we add analytics later, we will update this notice and show a choice before setting non-essential cookies.

Your rights

You can ask for access, correction or deletion where the law allows it, and complain to Datatilsynet. You can object at any time to B2B outreach based on legitimate interest — reply to our email or write to [email protected] with “object to outreach” and we will stop. Order-related rights: [email protected] or [email protected].