PRIVACY POLICY

1. Introduction

Welcome to Factum. Your privacy and the security of the information you entrust to us are central to how we build and operate our Services. This Privacy Policy explains what data we process, the purposes and legal grounds for processing, with whom we share it, how long we keep it, how we protect it, and the rights you have in relation to your personal data.

Factum is an artificial-intelligence legal platform owned and operated by FAKTUM DOO Skopje, a company established in the Republic of North Macedonia (referred to as "Factum", "we", "us" or "our").

By creating an account or otherwise using the Services, you confirm that you have read and understood this Policy. This Policy forms an integral part of our General Terms of Use.

We understand that our users are predominantly legal professionals who handle sensitive and confidential information. For that reason, a single principle governs everything that follows: your User Content is never used to train our AI models or those of any third party, and all processing of your content takes place exclusively within the European Union, except where you choose to turn on the optional web search feature described in Section 6.3.

Because we offer the Services to users located in the European Union / European Economic Area, this Policy is governed primarily by the General Data Protection Regulation (Regulation (EU) 2016/679 – "GDPR"), which applies to us under Article 3(2) GDPR. As a company established in North Macedonia, we are additionally bound by the Law on Personal Data Protection of the Republic of North Macedonia ("LPDP"), which is harmonized with the GDPR. Where this Policy refers to the GDPR, the equivalent LPDP provisions apply correspondingly.

2. Key definitions

The terms used in this Policy have the following meaning:

3. Our roles: Controller and Processor

Our responsibilities under data-protection law depend on the category of data:

For business and enterprise customers, the terms of our processing of User Content are governed by these provisions and, where applicable, by a separate Data Processing Agreement (DPA).

4. What data we process and why

4.1 Account Data (Factum as Controller)

Data we collect:

Purposes: creating and administering your account; providing access to the Services according to your subscription; processing payments and managing subscriptions; verifying that the account belongs to a real person and conducting a short onboarding call after registration (Section 4.3); communicating with you about your account, service changes and important notices; providing technical support; preventing fraud and abuse; and maintaining the security and integrity of the platform.

Legal bases:

4.2 User Content (you as Controller, Factum as Processor)

Data we process: your Input Content and the resulting Output Content, which may include personal data of third parties that you choose to submit.

Purpose: the sole purpose is to process your Input Content and generate Output Content for you through our AI assistant, strictly in accordance with your instructions.

Legal basis: performance of the contract between you and us; we process this data exclusively on your behalf in order to deliver the requested Service.

A note on minimization. Because you control what you submit, we recommend that you avoid entering personal data, banking-secrecy information, payment instruments, or special categories of data beyond what is necessary for your query, and that you follow your organization's own data-classification and data-loss-prevention policies.

4.3 Mobile number and onboarding call

Our users entrust us with confidential and often privileged information. To protect them, every new account must give a mobile phone number, and a Factum employee then calls for a short onboarding call. You get access to the Services, including the free trial, as soon as you give the number; you do not have to wait for the call. The call lets us confirm that the account is held by a real, identifiable person, explain how the Services handle your data and how to use them safely, and set the account up for the jurisdiction you work in.

5. The fundamental commitment: no training, full EU processing

Two principles distinguish Factum and apply to all User Content:

6. With whom we share your data (Sub-processors)

To deliver the Services we rely on a small number of carefully selected technology partners. We share data with them only to the extent necessary, under written contracts (including, where required, Standard Contractual Clauses and data-processing terms) that bind them to protect your data and prohibit any other use. All sub-processors that process User Content do so within the EU/EEA, with the exception of the optional web search providers described in Section 6.3.

6.1 Sub-processors that process User Content

6.2 Sub-processors that process Account/Operational Data only (not User Content)

6.3 Web search and web browsing providers (optional feature)

Web search is an optional feature. It is off by default and is used only if you turn it on. When it is on, our AI assistant can search the internet and read public web pages to help answer your question. To do this, we send the providers listed below search queries (which are derived from your question and may include its wording) and the addresses (URLs) of the public web pages to be read. When the automated browser is used, we also send a short instruction describing what to look up on that page (for example, "find parcel 1234").

Your uploaded documents and your chat history are not sent to these providers. If your question contains confidential information or personal data, that information may appear in search queries; for such matters we recommend keeping web search turned off.

The automated browser (Browser Use) operates public websites — for example, a public registry's search form — to carry out a single read-only lookup. It does not log in to any website and does not submit personal data. It runs in the United States and may connect to the target website through a proxy located in your country. The backup search providers (SerpApi and Google Custom Search) are used only when the main provider returns no results, and ScrapingBee is used only to load public pages that cannot be read otherwise.

We will keep an up-to-date list of sub-processors and will notify customers of material changes in accordance with our agreements. We may also disclose data where required by law, court order, or a lawful request from a competent authority, and to establish, exercise or defend legal claims.

7. International data transfers

Our servers, databases and all AI processing are located within the European Union / European Economic Area, and your User Content is not transferred outside the EU/EEA for storage or AI processing. Where any transfer of personal data to a third country occurs, it is carried out only under a valid transfer mechanism recognized by Chapter V of the GDPR — an adequacy decision, Standard Contractual Clauses (SCCs), or another lawful safeguard — ensuring an essentially equivalent level of protection. The relevant transfers are:

You may request further information about these safeguards using the contact details in Section 13.

8. Data security

We apply layered technical and organizational measures, governed by our certified Information Security Management System:

No method of transmission or storage is completely secure, but we continuously review and strengthen our controls to protect your data.

9. Data retention

We retain data only for as long as necessary for the purposes described in this Policy:

On termination, you may request a full export of your data before deletion. Production data is deleted across all systems within 30 days of account/tenant deactivation, with up to a further 7 days for backup rotation. Upon completion, and on request, we issue a signed Certificate of Data Destruction.

10. Your rights

In accordance with the GDPR, you have the following rights in respect of personal data for which we are the Controller:

Where Factum acts as a Processor (for your User Content), requests from data subjects should be directed to the relevant Controller (you or your organization); we will assist the Controller in responding to such requests as required by law.

To exercise your rights, contact us using the details in Section 13. You also have the right to lodge a complaint with the data-protection supervisory authority of your EU/EEA Member State (for example, the authority where you live, work, or where the alleged infringement occurred). A list of EU/EEA supervisory authorities is maintained by the European Data Protection Board (edpb.europa.eu).

11. Security incidents and notification

We maintain documented incident-management procedures. In the event of a personal-data breach affecting the confidentiality, integrity or availability of your data, we will notify affected customers without undue delay and no later than 24 hours after becoming aware of it, and will cooperate as required under applicable law. Security and incident matters can be reported to our Data Protection Officer at dpo@factum.law.

12. Cookies

Our websites use cookies and similar technologies to operate the platform, keep you signed in, remember your preferences and improve your experience. You can control non-essential cookies through your browser settings and, where applicable, our cookie banner. We do not use third-party advertising or cross-site tracking cookies. Further detail is provided in our Cookie Policy, where published.

13. Contact

If you have questions about this Privacy Policy or how we process your data, please contact us.

Personal data controller: FAKTUM DOO Skopje, st. "Kliment Ohridski" no. 48, 1000 Skopje, Republic of North Macedonia, Tax ID: 4032022554313. General contact: info@factum.law Data Protection Officer (DPO): Metodij Ristomanov — dpo@factum.law

You may direct any data-protection request or complaint to the contacts above; we will respond in accordance with the GDPR and applicable law.

14. Children

The Services are intended for professional use by persons aged 18 and over. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, please contact us so we can take appropriate action.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the platform in advance of their taking effect. The current version, with its effective date, will always be available on our website.