Good old games (GOG) is 100% legit, they make deals directly with the publishers. They got a (a bit limited) deal with EA a few months ago for some great old Bullfrog and Origin games. I bought many games from them as they are a great (and in many cases the only legal) source for old PC games, DRM free and made compatible with modern Windows systems. The DOS games use DOSBox i.e., with custom configs. Not all games there are totally bug free, but that can't be helped as they normally don't get access to the games' source.
They also have a nice forum community.
As mentioned above they have some free games, the newest one they added was Ultima IV. And you don't need to input any credit card or PayPal information for the free games as mentioned above. And I think they don't store the payment information, but I'm not sure about that as I only used PayPal there so far.
Oh and they don't email you stuff if you don't want to, although the standard settings are that they send mails for their weekend and other promotions.