Privacy Policy
Last updated: 2026-10-13
Wizorg LTD is a company located at Little Winters Farm Roundbush Road, Layer Marney, Colchester, CO5 9UR, England, registered under number 12553665 (the "Company"), the drafter of this document, acts as the data controller for the personal data processing described in this policy.
This personal data usage policy is made in accordance with the provisions of Law No. 78-17 of January 6, 1978 (known as the "Data Protection Act" or "DPA") and General Data Protection Regulation ("GDPR") No. 2016/679.
This document outlines how data is collected and the details of its use.
Personal data collected or held is either directly communicated by the person themselves, comes from third parties, or is collected from activity on the website and the use of services.
The individuals affected by the processing are users ("Users") of the lettrex.co website (the "Site"), customers ("Customers"), prospects, subscribers (more generally, the "Data Subjects").
The processed data falls under the following categories:
- Data relating to the identification of Data Subjects (name, first name, postal address, email address, phone number)
- Limited payment-related metadata needed to manage transactions
- All personal data necessary for the subscription of a Customer
The Company does not store complete card numbers or card security codes. Full payment details are processed by the relevant payment service provider.
1. Contact Form
The following information is collected and processed: IP address, postal code, phone number, and, if applicable, the information provided in the online form. These pieces of information are used solely to establish contact with the person who filled out the contact form. This contact will be made by phone and/or email. The data collected when sending the completed online contact form is retained for a maximum period of three (3) years.
The legal basis for this processing is the Company's legitimate interest in answering and securing support requests and, where the request comes from a person interested in our services, steps taken at their request before entering into a contract. Consent is not the legal basis of this processing. The basis applicable to each purpose is summarised in the table in section 3.
2. Use of the Website
The Company uses cookie technology to improve navigation and the user experience on the lettrex.co website (hereinafter the "Site"). When consulting the Site, these cookies may be saved on the browsers of the device used, regardless of the device (computer, tablet, smartphone). They are used, in particular, for user identification for analysis of site traffic and use of site elements. Visitors can decide at any time to accept or refuse the use of cookies and change their preferences. The cookie has a validity period that varies depending on the type of cookie and allows the visitor to be recognized during a subsequent use of the website. In any case, this duration does not exceed thirteen (13) months. Visitors can choose to accept or decline cookies while browsing the Site. To this end, the Company displays a preliminary information banner on its Site inviting the visitor to accept cookies. As long as the visitor has not given consent for cookies to be collected, no cookies will be deposited on their device, except for cookies exempt from consent collection, as they are strictly necessary for the provision of a service expressly requested by the user.
Cookiebot groups cookies into Necessary, Preferences, Statistics and Marketing categories. Necessary cookies provide essential functions; preference cookies remember choices such as language; statistics cookies help understand how the Site is used; and marketing cookies may track visits to provide relevant advertising. Cookies awaiting classification are identified as Unclassified.
The current cookie-by-cookie list, including the exact cookie name, provider, purpose and expiry, is available under "Details" in the Cookiebot declaration displayed in production. Visitors can reopen it at any time using the permanent "Manage cookies" link in the footer to accept, refuse or withdraw consent by category.
3. Within the Scope of Provided Services
The following data is gathered and processed:
- First Name
- Last Name
- Address
- Email Address
- Limited payment-related metadata needed to manage transactions
Additionally, for the purpose of performing pre-contractual measures or fulfilling contracts with the Company, when implementing processes with the objectives of:
- Providing the service, managing customer accounts, and tracking customer requests
- Drafting documents on behalf of clients
As well as for compliance with legal and regulatory obligations when implementing processes with the objectives of:
- Money laundering and terrorism financing prevention and anti-corruption efforts
- Invoicing
- Accounting
All necessary data elements for these purposes are collected and processed. This data is used to fulfill the purposes related to the requested services. These processes comply with applicable regulations regarding personal data protection and are based on the legal basis of the contract between the individuals involved and the Company or on legitimate interests. Unless stated otherwise, the mentioned data is essential for fulfilling our contractual obligations.
The legal basis applicable to each purpose is summarised below.
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Answering contact requests and support requests (form, email, chat) | Email, message, phone number, IP address | Legitimate interest in answering and securing requests and, where the request comes from a person interested in our services, steps taken at their request before entering into a contract (Article 6(1)(f) and (b) GDPR) |
| Creating and managing the account, the order, the trial and the subscription, and sending letters | Identity, address, email, letters and recipient details | Performance of the contract (Article 6(1)(b) GDPR) |
| Payment and recurring billing | Payment identifier (token), transaction metadata | Performance of the contract (Article 6(1)(b) GDPR) |
| Optional AI writing assistant | Text entered by the user | Performance of the contract: feature requested by the user (Article 6(1)(b) GDPR) |
| Invoicing, accounting, anti-money-laundering and anti-corruption | Invoices, identification data | Legal obligation (Article 6(1)(c) GDPR) |
| Security, fraud prevention and proof of acceptance of the T&C and of consents | Connection logs, IP address, T&C version, timestamps | Legitimate interest in securing the Service and establishing or defending legal claims (Article 6(1)(f) GDPR) |
| Checking the professional status of a customer (SIREN/SIRET) | Company identifiers (company registration number, VAT number where provided) | Legitimate interest in verifying professional status (Article 6(1)(f) GDPR) |
| Commercial prospecting by email (offers, newsletters) | Name, email address | Consent (Article 6(1)(a) GDPR), given through a separate optional box that is never pre-ticked and can be withdrawn at any time; every message contains an unsubscribe link |
| Cookies and trackers that are not strictly necessary (statistics, marketing) | Cookie identifiers | Consent (Article 6(1)(a) GDPR), collected through the cookie banner; strictly necessary cookies are exempt from consent |
4. Data Retention
Personal data is kept only for as long as necessary for each purpose. The table below states the retention period applicable to each purpose. After the period indicated, data is deleted or anonymised, unless a longer retention is required by law or to establish, exercise or defend legal claims.
| Purpose | Retention period |
|---|---|
| Contact and support requests | 3 years after the last contact |
| Account, subscription and history of letters | Duration of the subscription; history and invoices remain accessible for 1 year after the end of the subscription, then the data is deleted except as listed below |
| Invoices and accounting records | 10 years (accounting obligations) |
| Anti-money-laundering and terrorism-financing prevention | 5 years after the end of the relationship |
| Payment identifier and transaction metadata | Duration of the subscription, then archived for the period required by accounting obligations. Full card numbers and security codes are never stored by the Company |
| Proof of acceptance of the T&C and of consents | 5 years after the end of the contract (limitation period) |
| Commercial prospecting | Until consent is withdrawn and in any case no longer than 3 years after the last contact with the person |
| Cookies and trackers | 13 months maximum; consent choices are requested again at the end of this period |
| Connection logs and security data | 12 months |
| Deactivated or deleted accounts | Deletion at the end of the week of the request (see section 6); only the data listed above is retained for the periods indicated |
5. Rights Related to Personal Data
Individuals possess the following rights concerning their personal data:
- The right to access their personal data
- The right to rectify any errors in the records
- The right to request erasure of their personal data, restrict its processing, or object to it
- The right to withdraw their consent
- The right to object to receiving future commercial prospecting materials
- In specific circumstances, the right to ensure that this information is transferred to the individual or to a third party
- The right to define general and specific instructions for the retention, deletion and communication of data after their death, and to amend or revoke them at any time. Specific instructions concerning our processing may be sent to contact@lettrex.co or by post to Wizorg LTD; they require specific consent separate from acceptance of the Terms.
- The right to lodge a complaint with the CNIL.
We answer requests to exercise these rights within one (1) month of receipt. This period may be extended by two (2) months where the request is complex or where we receive a large number of requests; in that case you are informed of the extension and of its reasons within the first month.
No decision producing legal effects concerning you is taken solely on the basis of automated processing. The optional AI writing assistant only generates draft texts at the user's request; the user remains free to edit, use or discard them.
6. Account Deactivation and Deletion Process
When a user requests an account deletion, we will initiate the initial deactivation of their account within a reasonable timeframe. This means that the account will no longer be accessible and cannot be used to log in or access our services.
To ensure the security of our users' information, we have implemented a weekly deletion policy for deactivated accounts. This means that all accounts deactivated during a given week will be deleted at the end of that week. Account deletion is done securely and irreversibly.
Please note that the initial deactivation and final deletion of accounts may take up to one week from the deletion request. During this period, if you change your mind and wish to reactivate your account, please contact us immediately so that we can take the necessary steps.
We want to emphasize that even after an account is deleted, some information may be retained in accordance with our legal obligations or for legitimate business purposes, such as fraud prevention or dispute resolution.
7. Contact and Complaints
Questions and rights requests should be sent to contact@lettrex.co. Identity may be established by appropriate means, including an authenticated account or account information. Additional information or, if necessary, an identity document copy is requested only in case of reasonable doubt and proportionately.
If you believe that your data protection rights have not been respected, you may lodge a complaint with the CNIL through its website at www.cnil.fr.
8. Service providers and international transfers
To provide the service, the Company may share only the necessary data with its authorised hosting, postal, payment, support and technical providers. These include Amazon Web Services for hosting, authorised, PCI-DSS compliant payment service providers for payments, Tawk.to for chat support and OpenAI for the optional AI writing assistant. Text submitted to the AI assistant is sent to OpenAI only to generate the requested draft and should not contain unnecessary sensitive information. See the official OpenAI Privacy Policy.
Merci-Facteur (a service operated by SARL BOURDET) acts as the postal fulfilment provider for printing, enveloping, dispatch and postal status updates. It receives the sender and recipient details, the letter file and the order options needed to perform the mailing. SociétéInfo (a service operated by SAS SMART DATA) may be used to verify or enrich professional information from company identifiers or search criteria. These providers act only for their stated role and receive no more data than necessary.
Some providers process data outside the European Economic Area. Each transfer outside the EEA is based on an adequacy decision of the European Commission or on appropriate safeguards, in particular the standard contractual clauses of the European Commission, as detailed in the table below. A copy of the safeguards can be requested at contact@lettrex.co. The Company's operational GDPR contact is contact@lettrex.co. No DPO has been appointed at this time.
| Recipient | Role | Location of processing | Safeguards for transfers outside the EEA |
|---|---|---|---|
| Wizorg LTD | Data controller | United Kingdom | Adequacy decision of the European Commission in favour of the United Kingdom |
| Amazon Web Services | Hosting, email sending and secrets management | Ireland (European Union, eu-west-1 region) | Data is processed in the EU. Any access from outside the EEA by Amazon Web Services group entities is covered by the standard contractual clauses of the European Commission and/or EU-U.S. Data Privacy Framework certification, as provided in AWS data processing terms |
| Payment service providers | Payment processing | European Union; certain processing may take place in the United States | Standard contractual clauses and/or EU-U.S. Data Privacy Framework certification, as provided in the providers' data processing terms |
| OpenAI | Optional AI writing assistant | United States | Standard contractual clauses and/or EU-U.S. Data Privacy Framework certification, as provided in OpenAI data processing terms |
| Tawk.to | Chat support | United States | Standard contractual clauses as provided in the Tawk.to data processing addendum |
| Merci-Facteur (SARL BOURDET) | Postal fulfilment (printing, enveloping, dispatch) | France (European Union) | Not applicable |
| SociétéInfo (SAS SMART DATA) | Verification of professional information | France (European Union) | Not applicable |
As part of the monthly subscription, the data necessary to execute payments is processed by our payment service provider. Wizorg LTD does not keep the full card number or the security code. It may, however, keep a technical payment identifier (token) and the transaction metadata necessary to manage the subscription and the recurring debits. This information is kept for the duration of the subscription, subject to applicable legal archiving obligations. The legal basis is the performance of the contract, and you are informed at checkout that your payment method will be used for the renewal of the subscription. You may ask at any time to modify or remove the payment method held by contacting contact@lettrex.co, and you can stop any further debit by cancelling the subscription from your customer area or on the Unsubscribe page. The absence of a valid payment method may lead to the suspension or termination of the subscription.
9. Status of this Privacy Policy
This Privacy Policy was last updated on 2026-10-13. We reserve the right to modify it at any time to provide up-to-date information on how we collect and process data.