Legal
Picture Muster GmbH, a 30-person German SME where nobody has “legal” in their job title and the managing director handles contracts, DSGVO questions and supplier paperwork between everything else. Business-Gym gives that person a place to put documents, a head that reads them, and a record of who decided what — it does not give them a contract system.
This page is deliberately modest. Legal and compliance work is exactly where an overstated capability does real damage, so what follows separates the parts you can rely on from the parts that are not built.
What can the legal head actually do today?
Section titled “What can the legal head actually do today?”The legal head ships as a standard head template called Legal, with a General Counsel charter you can read and edit. Its charter states the remit — contract review and clause flagging, DSGVO and compliance monitoring, vendor and partner screening — and its decision rights are written into the same document: flag and draft, never give binding advice, never sign; a human approves before anything is signed.
Be precise about what that charter is. It is an instruction document that shapes how the head behaves, not a description of shipped machinery. There is no automated clause-review pipeline that scans an uploaded contract and returns flagged clauses on its own.
What the head does is what every head does: read the documents you gave it, answer you in chat with those documents as grounding, draft text, and propose tasks and approvals. See working with a head for the mechanics — they are identical here.
Where do my contracts and policies live?
Section titled “Where do my contracts and policies live?”They live in the knowledge base, as documents you upload and scope to a head or to the whole company. This is the part of the legal story that genuinely works, and it is where most of the value is.
You can add material four ways: upload files (10 MB per file), paste text, add a URL, or sync a SharePoint site. Uploading a whole folder keeps its structure — the directory levels are recreated as folders, so a re-upload updates the same documents instead of duplicating them.
Binary office files are handled honestly. PDF, DOCX and XLSX are run through a text extractor before they are indexed. A file type that cannot be read is reported as unsupported, and a scanned PDF with no text layer ingests as empty rather than pretending it worked. That distinction matters when your NDA template is a scan: you find out at upload time, not when the head answers from nothing.
Scope each document to head:legal if only the legal head should see it, or tenant-wide if everyone
should. Data sources covers scoping and the sync in detail.
Can it sign, send or commit to anything?
Section titled “Can it sign, send or commit to anything?”No, and this is the one guarantee that does not move. Every head’s charter carries the same named prohibition: never move money, sign contracts, or send external communications without explicit human approval. That is not a setting you have turned on — it is the floor the product is built on.
Concretely, for legal work this means:
- Nothing signs. No e-signature service is connected, so there is no path by which an agreement gets executed by the system.
- Nothing sends externally — no reply to opposing counsel, no notice to a supplier, no message to an authority — until a person approves that specific item.
- Nothing commits money. The legal head has no spend authority at all.
The hard floor explains why external sends and money stay human-approved permanently rather than graduating as trust builds. If you ever need to stop everything at once, the panic switch returns every head to supervised immediately — see the autonomy dial and panic switch.
What record is kept of who decided what?
Section titled “What record is kept of who decided what?”Two records are kept, and together they answer most “who approved this, and when” questions. This is the part compliance usually cares about most.
The approval queue keeps its history. Alongside the open queue there is a History view of decided approvals, newest first, and each row carries the human who decided it and when. Nothing consequential executes without passing through this queue — see working the queue.
The audit trail is append-only and admin-only. Entries are added and never edited, each records the actor, the target entity and the outcome, and you can filter by event kind. Where an event targets a run, opening it shows that run’s step-by-step trace.
Reversals are audited too. Some inbound actions a person committed — creating a task, filing a document — can be undone within 24 hours, but only by the person who committed them, and the undo writes its own reversal entry rather than erasing the original. An external send can never be undone, which is the honest consequence of it having actually left.
How do I answer a data-subject request?
Section titled “How do I answer a data-subject request?”Business-Gym ships the two DSGVO subject rights that a small company is asked for most often, and both are in Settings in the web app.
Export (Art. 15 and 20). A signed-in person clicks Download my data and gets their own personal-data bundle as a JSON file. It is scoped to the caller — you can export your own data and nobody else’s.
Deletion (Art. 17). Delete account… starts an erasure with two guards: you must type your exact account email, and you must then click a single-use verification link sent to that address. Nothing is deleted until that link is clicked. What gets erased depends on your role — an Owner or Admin deletes the tenant and everything in it, revoking every member; a Member removes only their own membership and leaves the rest of the company untouched.
Deletion is not total, on purpose. A minimal anonymized billing and audit record survives, because HGB §257 and AO §147 require accounting and tax records to be kept and DSGVO Art. 17(3)(b) allows exactly that carve-out. Amounts, dates and hashes are retained; every identifier is stripped or replaced with an irreversible pseudonym.
The app also states its data residency in the same Settings area: Germany West Central.
What is not available yet?
Section titled “What is not available yet?”These gaps are listed because discovering them mid-audit is far worse than reading them here.
No e-signature and no contract lifecycle management. Nothing signs, and you should not plan work on the assumption that the platform tracks an agreement from draft through signature to renewal.
The Compliance page is a placeholder. The Compliance entry under Resources currently renders a “Coming soon” stub. There is no compliance workspace to work in behind it.
No audit-log export. Settings lists log export as Coming soon. You can read and filter the trail in the app; you cannot yet ship it to an external log sink or download it as a file.
No legal hold and no retention schedules. There is no way to freeze a document against deletion, and no per-document retention policy you can configure.
No automatic clause flagging, contract extraction or vendor screening run. Those sit in the legal head’s charter as its remit; they are not shipped pipelines.
DATEV is not connected, which matters if your document flow ends at your Steuerberater — see DATEV and the full integrations status matrix.
No mobile app and no push notifications. There is no native app and no push infrastructure, so an approval waiting on you will not reach your phone as an alert.
No learning from your decisions yet. Your approvals and edits are recorded, but they do not yet change what the head proposes next time. How your team learns covers the intended design and its current state.
How should a legal or compliance owner start?
Section titled “How should a legal or compliance owner start?”Start by making the head useful before asking it for anything, because a head with no documents can only give you generic text.
- Load your own material first. Your AGB, your Datenschutzerklärung, your standard NDA, your DPA
templates and your supplier terms — scoped to
head:legalif they should not be company-wide. - Ask questions against those documents. “What notice period does our standard NDA use?” is the kind of question grounded retrieval answers well, and the answer cites what it read.
- Keep the approval queue as your record. Decide items in the app rather than out of band, so the History view stays a complete account of what was decided and by whom.
- Check the audit trail before you need it. Confirm you can see it, and that it shows what you would want to show an auditor, while there is no pressure on you.
Adjacent pages worth reading: finance for the money-side approvals and HR for personnel data, both of which touch the same DSGVO surfaces. The glossary defines the terms, and the FAQ covers control and data questions.
What happens when a customer sends a DSGVO data-subject request?
Section titled “What happens when a customer sends a DSGVO data-subject request?”You handle it yourself. Business-Gym has no screen that receives, tracks or answers a data-subject request from one of your customers — there is no intake form, no case file, and nothing that tracks a response deadline. If such a letter or email arrives, managing and answering it stays with you, outside the product.
What the app does have is aimed at your own Business-Gym account, not your customers’. The Settings screen has a Privacy · DSGVO card with a Download my data button that produces a file of your own account information, and a delete-account flow that makes you retype your account email and then confirm through a link sent to that address before anything is removed.
If a legal-looking message lands in a connected mailbox, it is flagged as high risk, proposed for forwarding, and escalated to a person. It is never answered automatically.
Two things look further along than they are. A DSGVO DSAR card sits in the workflow template gallery under the Legal head, but there is no workflow behind it — opening the card starts a blank draft, and the description and the cost-and-SLA line printed on the card are catalogue text, not a running process. And every head’s settings carry a Run DSAR purge button in the danger zone: confirming it records an approval-required intent and says on screen that it was not executed. Nothing is deleted.
For questions about legal basis, retention, or what our data-processing agreement covers, ask us for the DPA and check with your own data-protection adviser.