Skip to main content

Terms of Service

Last updated: 29 July 2026

1. Operator and scope

GDPR.Direct is operated by Genlabs Group SL, NIF B21641469, with registered address at Gran Via 1, 48001 Bilbao, Biscay, Spain ("we", "us", or "GDPR.Direct"). These terms govern access to gdpr.direct, app.gdpr.direct, and the related drafting and hosting features (the "Service").

By creating an account or buying a subscription, you agree to these terms. If you use the Service for an organisation, you confirm that you have authority to accept these terms for it. Statutory rights that cannot lawfully be limited remain unaffected.

2. Description of Service

The Service provides editable privacy-document drafts, a hosted Legal Hub, document visibility controls, and related implementation guidance. Paid features currently include PDF export, custom branding, removal of the GDPR.Direct footer, and AI-assisted drafting of DPIA narrative sections.

The Service does not inspect all of your processing operations, configure consent tools, manage data-subject requests, monitor changes in law, or certify compliance. Generated documents and public-page checks are drafting aids, not legal advice, an audit, a regulatory approval, or a guarantee of compliance. You must check each output against your actual processing, vendors, retention practices, transfers, technical implementation, and applicable national or sector rules before relying on or publishing it. Obtain qualified legal or specialist review where the risk warrants it.

3. Account Registration and Security

You need an account for application features. You must provide accurate information, keep access to your email and authentication account secure, and tell us promptly at legal@gdpr.direct if you suspect unauthorised access. You are responsible for activity carried out through your account unless applicable law provides otherwise.

4. Acceptable Use

You agree to use the Service only for lawful purposes and in accordance with these Terms. You must not:

  • violate applicable law or another person's rights;
  • submit information you are not authorised to use;
  • misrepresent a draft, check, or generated output as legal approval or certification;
  • gain or attempt to gain unauthorised access to accounts, systems, or data;
  • interfere with the security, availability, or ordinary operation of the Service;
  • use automated extraction or excessive requests that materially impair the Service; or
  • use the Service for fraud, deception, malware, or other harmful activity.

5. Payment and Billing

The Service includes a free plan and a Premium subscription currently advertised at EUR 9.90 per month. The price and any applicable taxes shown at checkout control the purchase. Stripe processes payments on our behalf. Premium renews monthly until cancelled.

You can cancel through the account billing controls. Cancellation stops renewal and Premium access ordinarily continues until the end of the paid billing period. If a payment fails, we may restrict paid features while giving you a reasonable opportunity to update the payment method. We will give reasonable advance notice of a price change that affects a future renewal. You may cancel before the new price takes effect.

6. Consumer withdrawal and digital-service rights

If you buy as a consumer, you retain the mandatory rights available under Spanish and EU consumer law. This normally includes a 14-day right to withdraw from a distance service contract, starting on the day the contract is concluded. To exercise it, email an unambiguous withdrawal request to legal@gdpr.direct before the period expires. You may use the statutory model form, but you do not have to.

If you expressly ask us to begin providing Premium during the withdrawal period and later withdraw, the consequences, including any proportionate charge lawfully due, will be determined under applicable consumer law. Nothing in the checkout or these terms asks you to give up a right that cannot validly be excluded for this digital service.

Consumers also retain mandatory conformity remedies for digital services. Where the Service is not supplied or is not in conformity, the remedies and time limits provided by applicable law apply. A change that has more than a minor negative effect on access or use may also give a consumer a statutory right to end the contract.

7. Your content and our intellectual property

You retain your rights in the business information and other content you submit. You give us a limited licence to host, process, reproduce, and display that content only as needed to operate, secure, support, and improve the Service in accordance with our Privacy Policy.

Subject to third-party rights and applicable law, you may use, edit, export, and publish the organisation-specific documents produced for you. The Service itself, including its software, interface, branding, reusable template structure, and documentation, remains owned by us or our licensors. These terms do not transfer those rights to you.

8. Third-party services

The Service relies on third parties for functions such as authentication, payment processing, infrastructure, and AI-assisted drafting. Their availability can affect the Service. Any separate service you choose to access through a third-party link is governed by that provider's terms. Our use of service providers and international transfers is described in the Privacy Policy.

9. Availability, changes, and review duties

We aim to provide a reliable Service, but uninterrupted or error-free operation is not promised. We may make proportionate changes for security, legal, technical, or product reasons. For paid consumers, changes to a continuously supplied digital service will follow the notice, conformity, and termination requirements of applicable law.

You must keep independent copies of important published documents and export content you need before deleting your account. You remain responsible for reviewing outputs after changes to your organisation, processing, vendors, audiences, jurisdictions, or legal obligations.

10. Liability

Nothing in these terms excludes or limits liability where doing so would be unlawful, including liability for fraud, wilful misconduct, death or personal injury caused by negligence where applicable, or mandatory consumer rights.

For business users, and to the maximum extent permitted by law, we are not liable for indirect or consequential loss, loss of profit, anticipated savings, goodwill, or business opportunity. Our aggregate liability arising from the Service in any 12-month period is limited to the greater of EUR 100 or the fees you paid for the Service in that period. This business-user limitation does not apply to liabilities that cannot lawfully be limited.

11. Suspension and termination

You may stop using the free Service or cancel Premium at any time. We may suspend access where reasonably necessary to address a security risk, unlawful or harmful use, a material breach, or an unpaid amount. Where practical and lawful, we will explain the reason and give you an opportunity to remedy it.

We may end the Service or your contract on reasonable notice. Immediate termination may be used for a serious breach, fraud, or a material security threat. Paid consumers retain any mandatory refund, conformity, and termination rights. Before deleting your account, export the content you need. Our Privacy Policy explains retention following account closure.

12. Changes to These Terms

We may update these terms for legal, security, technical, or product reasons. We will give registered users reasonable notice of material changes through the Service or by email. A change will not retroactively remove an accrued right. If a change materially affects a paid consumer's digital service, the mandatory notice and termination rules described above apply.

13. Governing Law and Dispute Resolution

Spanish law governs these terms. If you are a consumer, this choice does not deprive you of mandatory protections available under the law of your country of habitual residence, and disputes may be brought before the courts competent under applicable consumer law. For business users, the courts of Bilbao, Biscay, Spain have jurisdiction unless mandatory law requires otherwise.

14. General Provisions

If a provision is invalid or unenforceable, the remainder continues to apply and the affected provision will be interpreted as closely as lawfully possible to its purpose. A delay in enforcing a right is not a waiver. You may not transfer your contract without our written consent, except where applicable law permits. We may transfer it as part of a reorganisation or sale provided this does not reduce a consumer's mandatory rights.

15. Contact

For questions, complaints, cancellation assistance, or a withdrawal request, contact legal@gdpr.direct or write to Genlabs Group SL, Gran Via 1, 48001 Bilbao, Biscay, Spain.