Privacy Notice — Merger Control Compliance
1. Who we are
Merger Control Compliance is provided by CILC L.L.C., a limited liability company incorporated in New York, United States. CILC L.L.C. is the controller of the personal data described in this notice.
CILC L.L.C. provides legal education tools and marketing tools for the attorneys affiliated with it. The practice of law is carried on by those attorneys.
For any privacy question, or to exercise the rights described in section 9, contact us:
- Email: info@c-ilc.com
- Postal address: CILC L.L.C., 515 West 23rd Street, New York, NY 10011, United States
This notice covers Merger Control Compliance only. Other parts of the CILC website, and CILC's other tools, are covered by their own notices.
2. What Merger Control Compliance is, and what that means for your data
Merger Control Compliance puts together training programs about merger control rules from standard modules. It gives general information. It does not apply the law to any transaction or to your organization's circumstances.
Its design limits the personal data it can hold:
- The questionnaire asks nothing about any transaction. Every answer is a choice from a fixed list: which law to cover, who will attend, how long the training should be, and which topics to add.
- No documents can be uploaded. There is no upload control anywhere in the service.
- There are three places where you can type. A name for the cover of your program, which is optional. Your contact details, if you ask for attorney review. And the names of the companies concerned, also only if you ask for attorney review.
- No generative AI is used. A program is put together by fixed rules from modules written and approved in advance. Your answers are not sent to any AI model and are not used to train one.
We ask you not to use any field to convey confidential information, the facts of a transaction, or personal data about other people. Discuss those with an attorney once an engagement and a secure channel are confirmed.
3. What we collect
Account data. Your email address, and an encrypted verifier of your password. We never store your password itself. If an account uses two-step sign-in, we store the data needed to operate it.
Your programs. The options you selected in the questionnaire, the name you chose for the cover, if any, and which modules your answers selected. For a program you have purchased, we also record which version of each module it contains, so that later downloads give you the same program.
Records of acceptance. Which version of the Terms of Use and of this notice you accepted, and when.
Payments. When you purchase a program, the payment is taken by Stripe on Stripe's own page. Stripe collects your card details, your billing address and your email address. We do not receive your card number. We keep a record that the payment was made: the program it was for, the amount, any tax, the date, and Stripe's reference numbers for the payment.
Attorney review requests. If you ask for attorney review, we record the program concerned, your name, your organization, a phone number if you gave one, the names of the companies concerned, and your agreement to share the request. We also record the status of the request and the name of the attorney it is passed to.
Technical and security data. Server logs necessary to operate the service securely, and a record of significant events on your account, such as a purchase or a request.
We do not use analytics, advertising or tracking tools on this service. We do not collect special category data, and the service is not designed to elicit it.
Is providing this data required? Providing an email address is necessary to create an account. Answering the questionnaire is voluntary. Payment details are necessary only if you choose to purchase a program, and the details of a review request only if you choose to make one.
4. Why we process it
| What | Why |
|---|---|
| Account data | To create your account, sign you in, and let you see your own programs |
| Your programs | To put your programs together, show them to you, and let you download the ones you have purchased |
| Records of acceptance | To be able to show that the Terms of Use and this notice were presented and accepted |
| Payments | To make a purchased program available to you, and to keep the accounting and tax records the law requires of us |
| Attorney review requests | To pass your request to an attorney affiliated with CILC, who checks for conflicts of interest |
| Technical and security data | To keep the service available, secure and free from abuse |
| Service emails | To send sign-in, verification and password messages |
This list is exhaustive. We do not use your data for advertising, and we do not sell or share it. We do not use it to develop or improve the service, and we do not build datasets from it.
Where the General Data Protection Regulation applies, the legal bases are: performance of a contract with you (account data, programs, payments, service emails); your consent (sharing a review request with an attorney, which you may withdraw by withdrawing the request); legal obligation (accounting and tax records); and our legitimate interests in keeping a reliable record and a secure service (records of acceptance, technical and security data).
Automated decision-making. The modules in a program are selected by fixed rules from your own choices. This decides nothing about you and has no legal or similarly significant effect on you.
5. Marketing
Merger Control Compliance sends service emails only: verification, sign-in and password messages. We do not send marketing from this service.
6. Who else processes it
We use a small number of service providers:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database and sign-in | United States |
| Vercel | Hosting of the service | United States, with a global delivery network |
| Google (Google Workspace) | Sending of service emails, from a CILC mailbox | United States |
| Stripe | Taking payments. Stripe receives your card and billing details directly and handles them under its own privacy policy | United States |
If we add a provider, we will update this table before that provider begins processing, and note the change in section 13.
If you ask for attorney review, CILC intake staff and the attorney the request is passed to will see the request and the program it concerns. An attorney acts as an independent controller in respect of any engagement they accept, under their own terms and professional obligations.
We do not otherwise disclose your data, except where we are required to by law.
7. Where your data is held
Your data is stored in the United States. The service is offered to businesses located in the United States.
8. How long we keep it
| What | Retention |
|---|---|
| Account data | While your account is open. Erased when you close it |
| Programs you have not purchased | 12 months from the day you made them, then deleted |
| Programs you have purchased | While your account is open, so that you can download them again. Erased when you close it |
| Records of acceptance | While your account is open, then erased with it |
| Payment records held by us | While your account is open, then erased with it. Stripe keeps its own record of each payment for the period the law requires of it, which we do not set |
| Attorney review requests | 12 months, or erased with your account if sooner |
| Server and security logs | Held by our hosting and database providers under their standard log retention, which we do not set |
Where a request for attorney review leads to an engagement, the attorney keeps their own file under their own professional obligations. That file is theirs, not ours, and this notice does not govern it.
To close your account and have your data erased, use "Delete my account" on your account page. It removes your account, your programs, the payment records we hold and any requests for attorney review, at once. Programs you have purchased can then no longer be downloaded. You may also write to info@c-ilc.com and we will do it for you and confirm when it is done.
9. Your rights
Depending on where you are, you may have the right to be informed about our processing, to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive a copy of your data, and to withdraw consent where we rely on it.
Your account shows you the programs you have made. To exercise any other right, contact info@c-ilc.com. We will respond within the period required by applicable law. There is no charge.
Nothing in this notice may be interpreted to establish rights or obligations beyond what applicable law requires.
10. Cookies
Merger Control Compliance uses only the cookies that are strictly necessary to sign you in and keep your session secure. It sets no advertising or tracking cookies and loads no analytics script. Because we use only strictly necessary cookies, no consent banner is presented; disabling them will prevent you from signing in. When you pay, you are on Stripe's own page, which uses its own cookies under Stripe's policy.
11. Security
Data is encrypted in transit and at rest by our infrastructure providers. Access to your programs and requests is enforced by the database itself rather than by application code, so that each customer's records are reachable only by that customer, and by CILC staff only for a program on which you have requested attorney review. Staff access requires a second sign-in step in the current session; the database refuses staff access without one. The text of the training modules is held on our servers, and only the part you are entitled to see is sent to your browser. We keep a record of significant events which cannot be altered or deleted, save by the single documented process that erases an account.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that the law requires us to report, we will notify the relevant authority and, where required, you.
12. Children
Merger Control Compliance is intended for business customers and is not directed to children. We do not knowingly collect personal data from anyone under 18.
13. Changes
If we change this notice we will publish a new version with a new effective date. Where the change is significant, we will ask you to acknowledge the new version before you continue using the service. Previous versions are retained so that we can show which version you accepted and when.