Privacy Policy

Hartwell Legal Systems is a registered trade name of the sole proprietorship registered with the Dutch Chamber of Commerce under number 97254649, with an address at Nevelgaarde 8, 3436 ZZ Nieuwegein, Utrecht, the Netherlands.

For the personal data described in this Privacy Policy, Hartwell Legal Systems is the controller.

This policy covers personal data that Hartwell processes for its own purposes, including account administration, security, billing, support, product improvement, optional product analytics and session replay, and advertising measurement.

When CourtSync processes judicial-portal credentials, case-related information, files, or other personal data solely on a customer's instructions, the customer is the controller and Hartwell acts as processor. That processing is governed by the Data Processing Agreement, not by the independent purposes described in this policy.

CourtSync is intended for legal professionals and business use. It is not directed at minors.

Depending on how you interact with CourtSync, we may process:

• name, email address, organisation or workspace name, professional role, and account status;
• account and authentication information, including password hashes and email-verification information;
• subscription, billing, invoicing, and payment-status information where paid plans are used;
• IP address, browser and device information, approximate location derived from IP address, timestamps, and technical or security logs;
• pseudonymous user, workspace, device, session, and campaign identifiers;
• product-usage and interaction data, such as pages or screens viewed, navigation paths, clicks, scrolls, pointer movement, feature use, errors, performance information, and diagnostic events;
• session-replay data that reconstructs interaction with the interface, subject to the masking and exclusion measures described below;
• communications, feedback, and support requests; and
• cookie, consent, and privacy-preference information.

Payment-card details may be processed directly by a payment provider rather than stored by CourtSync.

The judicial-portal credentials and case-related personal data that CourtSync processes on a customer's behalf are described in the Data Processing Agreement. We do not use those data for the independent analytics or advertising purposes described in this policy.

We receive personal data when you:

• visit our public pages;
• create, verify, activate, or use an account;
• join or create a workspace;
• use features within CourtSync;
• contact support or otherwise communicate with us;
• select a plan or make a payment; or
• make or change a cookie-consent choice.

We also receive technical and interaction data automatically from your browser, device, the Service, and optional analytics or advertising technologies after you have consented where consent is required.

Providing and administering CourtSync

We process account, workspace, subscription, authentication, and service-communication data to create and manage accounts, provide the Service, verify users, administer plans, and respond to requests. The legal basis is taking steps at your request and performing our contract with you or the customer organisation.

Security, reliability, and misuse prevention

We process technical logs, device and network information, account activity, and support information to protect accounts and infrastructure, prevent fraud and misuse, investigate incidents, troubleshoot problems, and maintain the reliability of CourtSync. The legal basis is our legitimate interest in operating and securing the Service and protecting users and third parties.

Support and communications

We process communications and relevant account information to provide support, respond to enquiries, send service and security notices, and manage our relationship with users and customers. The legal basis is performance of the contract and our legitimate interests in providing support and maintaining customer relationships.

Product analytics, heatmaps, and session replay

With your consent, we process interaction and session-replay data to understand how visitors and users interact with our public pages, signup process, and authenticated application; identify bugs or confusing workflows; measure feature use; and improve usability and product design.

Advertising measurement

With your consent, we process campaign and conversion information to understand whether an advertising campaign resulted in a registration or account activation and to evaluate campaign performance. We do not use case content or judicial-portal credentials for advertising or remarketing.

Billing and legal compliance

Where applicable, we process billing, invoicing, and transaction records to collect payment, maintain business records, comply with tax and accounting requirements, establish or defend legal claims, and respond to lawful requests. The legal basis is performance of the contract, compliance with legal obligations, and our legitimate interests in managing the business and legal claims.

Optional product analytics may include aggregated metrics, events, funnels, heatmaps, and session replay. A session replay is a technical reconstruction of how a user interacted with the interface; it is not a camera or screen-video recording.

On authenticated CourtSync pages, we configure session-replay and analytics tools using strict or equivalent masking and exclusion controls. We unmask only low-risk, static interface elements where useful for understanding navigation. We mask or exclude before transmission:

• judicial-portal usernames, passwords, tokens, and authentication fields;
• case numbers, case identifiers, client or party names, and other identifying case information;
• judicial text, procedural information, decisions, hearings, and case history;
• documents, uploaded files, images, and document contents;
• free-text fields, support messages, and user-entered content;
• notification content containing case-related information;
• URLs, query parameters, custom events, tags, or properties that could reveal case or client information; and
• other sensitive Customer Data processed on a customer's behalf.

We may use pseudonymous internal user, workspace, or session identifiers to connect relevant product events. We do not intentionally send names, email addresses, portal credentials, or case content as analytics identifiers or custom values.

Access to analytics and replay dashboards is restricted to authorised persons who need the information for product, support, security, or usability work. We do not use portal credentials or case content for advertising, independent profiling, or training general-purpose artificial intelligence models.

We use necessary cookies or local storage to provide functions requested by you, including account sessions, security, load balancing where applicable, and remembering your cookie preferences. These technologies do not require consent where they are strictly necessary to provide the requested service.

We use the following optional categories only after you consent:

• Product analytics and session replay: to understand use of public pages, signup, and the authenticated Service, diagnose problems, and improve CourtSync; and
• Advertising measurement: to measure whether campaigns result in registrations or account activations and evaluate campaign performance.

You may reject optional technologies and still use the core Service. You may withdraw or change your choice at any time through the Cookie Settings link. Withdrawal does not affect processing that took place before consent was withdrawn.

Current optional providers

• Microsoft Clarity is currently used for product analytics, heatmaps, and session replay. Microsoft may process the information it receives under its own privacy statement.
• Google Ads is currently used for advertising and conversion measurement. Google may process the information it receives under its own privacy policy.

We may replace a provider where the purposes, data categories, and safeguards remain materially the same. We will update this policy and the cookie settings to identify the current provider. Where a change materially affects the purpose or scope of consent, we will request renewed consent where required.

We may share personal data with categories of recipients that help us operate CourtSync, including:

• hosting, database, storage, network, security, and infrastructure providers;
• authentication, email, communications, and customer-support providers;
• payment, invoicing, and accounting providers where paid plans are used;
• product-analytics, session-replay, and advertising-measurement providers where you consent;
• professional advisers, such as legal or accounting advisers; and
• public authorities or other recipients where disclosure is required by law or necessary to protect legal rights.

We share data only where necessary for the relevant purpose. We do not sell personal data.

Some analytics or advertising providers may act as independent controllers for data they receive and may process it under their own privacy terms.

We primarily host and process CourtSync service data within the European Economic Area. Some providers may process or permit access to personal data outside the EEA.

Where a restricted transfer occurs, we rely on an applicable legal transfer mechanism, such as an adequacy decision, approved standard contractual clauses, or another valid safeguard. You may contact us for more information about the safeguards that apply.

We retain personal data only for as long as necessary for the purposes described in this policy.

Account, billing, support, and business records may be kept for the duration of the relationship and thereafter as necessary, and in any event generally no longer than seven years, unless a longer period is required by law or necessary in connection with legal claims.

Optional analytics and session-replay data are retained for shorter periods according to our configured settings and the current provider's retention rules. Cookie-consent preferences may be stored for up to six months before we ask again.

Personal data processed on a customer's behalf is retained and deleted as described in the Data Processing Agreement.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, or disclosure. Access is limited to people and service providers who need it for the relevant purposes.

For Customer Data, this includes measures such as access controls, encrypted transport, encryption of stored judicial-portal credentials, separate management of keys and secrets, logical separation, restricted production access, security logging, and masking or exclusion of sensitive content from optional analytics.

A public technical summary of selected current controls is available on the Security Architecture and Judicial-Portal Integration page. The page is informational; the Terms and Data Processing Agreement govern contractual obligations.

No method of storage, transmission, or security is completely risk-free. Please contact us promptly if you believe an account or personal data may have been compromised.

Subject to applicable law, you may ask us to:

• provide access to personal data we hold about you;
• correct inaccurate or incomplete data;
• delete personal data;
• restrict processing;
• provide certain data in a portable format; or
• stop processing based on legitimate interests or for direct marketing.

Where processing is based on consent, you may withdraw that consent at any time through Cookie Settings or by contacting us.

Send requests to support@courtsync.gr. We respond without undue delay and normally within one month. Where permitted because of the complexity or number of requests, we may extend this period by up to two additional months and will inform you within the first month.

We may request information necessary to verify your identity before acting on a request.

Where Hartwell processes data solely on behalf of a customer, you should normally direct your request to that customer. We will assist the customer as required under the Data Processing Agreement.

Please contact us first so that we can try to resolve your concern. You may also lodge a complaint with the Dutch Data Protection Authority or with the competent supervisory authority in the country where you live, work, or believe an infringement occurred.

We do not use the personal data described in this policy to make decisions based solely on automated processing that produce legal or similarly significant effects for you.

We may update this policy when our practices, providers, services, or legal obligations change. The date at the top shows when it was last updated. Where appropriate, we will provide additional notice of material changes or request renewed consent.

Questions about this policy or our use of personal data may be sent to support@courtsync.gr.