This page is a translation of a document in French. This translation is provided for information purposes only. The final version is the one in French.
The purpose of the present document is to inform the User (as this term is defined below) and, more generally, any person concerned:
Indeed, GIE Infogreffe delegates the management of the Site to the partner company Legaware, which operates the Site and delivers, via the Site, Services (as this term is defined hereafter) which include (i) a service of identification of rights and legal and regulatory obligations ("LegalScan") which is performed by Legaware (ii) and a service allowing a User to ask, via the Site, questions to Referred Professionals, The answers to these questions are then provided by the Referred Professionals and not by Legaware (iii) as well as a service to put the User in contact with a Referred Professional in the context of compliance support by a Referred Professional, this service thus allowing the User to entrust a Referred Professional with the execution of a compliance support service, this service being then executed by the Referred Professional and not by Legaware.
The response to questions asked by Users to Referred Professionals and the performance by a Referred Professional of services entrusted to him by a User imply that Legaware grants the Referred Professional access to certain personal data concerning the User (via access to his computer system), which is why the Referred Professional and his role in the processing of such personal data (in the event that the User asks questions or entrusts a service to a Referred Professional) are identified herein.
The purpose of this privacy policy (hereinafter the "User Privacy Policy") is to identify the description of the rights of the User and more generally of all persons concerned under the provisions of Law No. 78-17 of January 6, 1978 and EU Regulation 2016/679 of April 27, 2016 (RGPD) and other legal provisions in force (hereinafter the "Regulation in force") and the resulting protection.
In this context, the User Privacy Policy (i) is accepted by the User when ordering the Services and (ii) is also published on the Site.
The User and, more generally, all persons concerned, are hereby informed that this User Privacy Policy (i) applies to personal data communicated by the User to Legaware in the context of the collection of personal data identified below, i.e. as part of the "Legaware Personal Data Processing" (as this term is defined hereafter in (a) of the article "Personal data collected") and (ii) also applies to the personal data to which Legaware grants access to Referred Professionals when a User asks a question or entrusts a Service to a Referred Professional, i.e. in the context of the "Processing of Personal Data Accessible to Referred Professionals" (as this term is defined hereafter in (b) of the article "Personal data collected") (iii) this User Privacy Policy does not apply to personal data that would be directly transmitted by the User to the Referred Professional outside the context of the Processing of Personal Data Accessible to Referred Professionals, in particular in the context of the direct contractual relationship that the User has with any Referred Professional so that in such a case and concerning such transmission of data, only the privacy policy that would have been established by the Referred Professional would apply.
For a proper understanding of the present, it is specified that it is understood by :
Other capitalized terms not defined above are defined in the body of this Agreement.
(a) The personal data collected by Legaware are the following: (i) the personal data that the User provides by filling in the forms relating to the creation of his/her account and/or relating to his/her identification, or by communicating with Legaware (by any means of communication or online communication, or by answering questionnaires or satisfaction surveys) or by communicating via the Site with the Referred Professional (in the event that the User wishes to ask a question or entrust a service to a Referred Professional) (ii) which concerns the surname, first name, electronic mail address (e-mail), telephone number, postal address (iii) as well as information relating to the contractual and commercial relationship between the User and Legaware (in particular the details of the Services ordered) and between the User and the Referred Professional (in the event that the User wishes to ask a question or entrust a service to a Referred Professional) (iv) the User's IP address (only when the User clicks on an offer from a Referred Professional, (iv) the User's IP address (only when the User clicks on the "subscribe" or "learn more" button in relation to a Referred Professional's offer, so that Legaware can provide anonymous audience measurement statistics to the Referred Professional who has published the offer concerned) (regarding our cookie policy, click here) (v) payment information (bank details, credit card numbers) in order to ensure the payment of the Services before authorizing access to them (vi) the processing of this data is hereinafter referred to as "Legaware's Personal Data Processing".
These personal data may only be communicated to Legaware by the Users concerned and each User is prohibited from communicating personal data of another person and/or personal data that do not concern him/her.
(b) It is specified that (i) among the above-mentioned personal data and subject of the above-mentioned collection (ii) the personal data that are the surname, first name, electronic mail address (e-mail), telephone number (iii) give rise to an access granted to the Referred Professionals by Legaware when the User asks a question to a Referred Professional or entrusts a service to a Referred Professional (iv) the processing of these personal data that are the surname, first name, e-mail address, telephone number and to which the Referred Professionals can thus have access is hereinafter referred to as the "Processing of Personal Data Accessible to Referred Professionals".
It is hereby specified that, as indicated below, this Processing of Personal Data accessible to Referred Professionals constitutes a joint processing between Legaware and the Referred Professional, in respect of which Legaware and the Referred Professional concerned act as joint data controller.
(c) It is specified that the Legaware Personal Data Processing and the Personal Data Processing accessible to Referred Professionals are hereinafter referred to together as the "Processing".
The purpose of the present document is to provide the User and, more generally, any person concerned, with the legal information required, which is as follows :
(a) Identity and contact details of the Data Processors
(a.1) The identity and contact details of the person responsible for processing Legaware Personal Data are as follows
(a.2) With regard to the Processing of Data Accessible to Referred Professionals, this is a joint processing between Legaware and the Referred Professional in which Legaware and the Referred Professional act as joint managers of the Processing of Data Accessible to Referred Professionals, the identity and contact details of the two joint managers of the Processing of Data Accessible to Referred Professionals being the following:
(b) Contact details of data protection officers
(b.1) The contact details of the Data Protection Officer for the Legaware Personal Data Processing are as follows:
(b.2) The contact information for the Data Protection Officer under the Referred Professional Accessible Data Processing is as follows:
(c) Purposes of the Processing
(c.1) The purposes of the Legaware Personal Data Processing are the following: (i) identification of the persons who wish to use the Website and/or the Services and/or who wish to use a Referred Professional (in case the User wishes to ask a question or to entrust a service to a Referred Professional) (ii) provision of the Website for the benefit of the Users and/or realization of the Services by Lagaware and/or realization of the connection desired by the User with the Referred Professional and/or realization by the Referred Professional of the service entrusted to him/her (iii) administration of the Website and/or the Services and/or the services provided by the Referred Professional (if the User wishes to ask a question or entrust a service to a Referred Professional) (iv) sending information (newsletters and other information media) and/or service proposals to the User.
(c.2) The purposes of the Processing of Data Accessible to Referred Professionals are as follows: (i) answers by the Referred Professionals to the questions asked of them (ii) to ensure the establishment of the relationship desired by the User (iii) to perform the Service entrusted to them by the User;
(d) Legal basis of the Processing
(d.1) The legal bases for the Processing of Legaware Personal Data are (i) the User's consent (ii) the need to carry out pre-contractual measures in relation to the relationship that the User wishes to enter into with Legaware (iii) the performance of the contractual relationship that the User wishes to enter into with Legaware by using the Services as well as the performance of the contractual relationship that the User wishes to enter into with the Referred Professional (in case the User wishes to ask a question or entrust a service to a Referred Professional) and (iv) Legaware's legitimate interest in keeping evidence of the processing of the Personal Data. (iv) Legaware's legitimate interest in retaining evidence of transactions with the User and the Referred Professional's legitimate interest in retaining evidence of transactions or operations with the User (in case the User wishes to ask a question or entrust a service to a Referred Professional).
(d.2) The legal bases for the Processing of Personal Data Accessible to Referred Professionals are (i) the consent of the User (ii) the need for the execution of pre-contractual measures under the relationship that the User wishes to establish with the Referred Professional (iii) the execution of the contractual relationship that the User wishes to establish with the Referred Professional (in case the User wishes to ask a question or entrust a service to a Referred Professional) and (iv) the legitimate interest of the Referred Professional. (iv) the legitimate interest of the Referred Professional to keep evidence of transactions or operations with the User (in the case where the User wishes to ask a question or entrust a service to a Referred Professional).
(d.3) It is reminded that the Personal Data Accessible to Referred Professionals comes from the collection of personal data carried out by Legaware, in particular but not exclusively at the time of the creation of the User's account, so that the stipulations below apply to both the Processing of Legaware Data and the Processing of Personal Data Accessible to Referred Professionals. In this respect, the User is informed, as regards both the Processing of Legaware Personal Data and the Processing of Data Accessible to Referred Professionals, that (i) the request to provide personal data is contractual in nature (in the context of the relationship that the User wishes to establish with Legaware by accessing the Site and/or the Services and/or that the User wishes to establish with the Referred Professional (in the event that the User wishes to ask a question or entrust a service to a Referred Professional) (ii) the provision of such data insofar as it is necessary for access to the Services as well as to the services delivered by the Referred Professional (in the case where the User wishes to ask a question or entrust a service to a Referred Professional) is a condition for the conclusion of this contractual relationship (iii) as such, the User is obliged to communicate his personal data if he wishes to access the Services as well as the services delivered by the Referred Professional (in the case where the User wishes to ask a question or entrust a service to a Referred Professional) (iv) the non-provision of this personal data does not allow access to the Services as well as to the services delivered by the Referred Professional (in the case where the User wishes to ask a question or entrust a service to a Referred Professional).
(e) Recipients of personal data
(e.1) The recipients of the personal data contained in the Legaware Personal Data Processing are: Legaware's staff in charge of the services related to the Website and/or the Services and, where applicable, Legaware's subcontractors involved in the performance of these services and who are required to intervene in the Legaware Personal Data Processing (only when necessary) such as, for example, IT and/or ITC service providers and/or hosting companies and/or maintenance companies;
(e.2) The recipients of the personal data contained in the Personal Data Processing accessible to Referred Professionals are (i) Legaware's staff in charge of the services related to the Website and/or the Services and, where applicable, Legaware's subcontractors participating in the realization of these services and being brought to intervene in this respect on the Processing (only when necessary) such as, for example, IT service providers and/or information and communication technologies and/or hosting companies, and/or maintainers and (ii) the Referred Professional's staff in charge of answering questions asked by Users and/or in charge of services entrusted to them by the User and, where applicable, the Referred Professional's subcontracted service providers participating in the performance of these answers or services and being brought in to intervene in this respect on the Processing of Personal Data Accessible to Referred Professionals (only where necessary);
(f) Transfer of personal data
It is reminded that the data contained in the Personal Data Processing accessible to Referred Professionals comes from the data collected by Legaware and communicated to the Referred Professional when a User wishes to ask a question to a Referred Professional or to entrust a service to a Referred Professional.
Furthermore, the User is informed, both in relation to the Legaware Personal Data Processing and to the Processing of Data accessible to Referred Professionals, that the Legaware Data Processor and the joint Processors of the Data Processing accessible to Referred Professionals may, where applicable, transfer personal data to a third country or to an international organization subject to an adequacy decision issued by the European Commission, it being specified that in the case of a transfer to a country or international organization that is not subject to an adequacy decision, then this may only be carried out on the condition that appropriate safeguards are put in place and that the persons concerned by the Processing of personal data have enforceable rights and effective means of redress, under the conditions of the Regulations in force.
(g) Duration of retention of personal data
(g.1) The duration of storage of personal data contained in the Legaware Personal Data Processing is as follows: as the personal data is necessary for the performance and/or administration of the Services via the Website and/or of the services entrusted by the User to a Referred Professional, the personal data is kept as long as the User is likely to be able to use the Services or the services provided by the Referred Professional, i.e. as long as the User has not expressed his/her intention to no longer have his/her personal data kept, by means of a request made by the User to Legaware at the address identified in point (b.1) above, for a period of 36 (thirty-six) months from the last use of the Site or the last order for a Service made by the User or the last question or the last order for a service made with a Referred Professional, after which date the personal data is no longer kept. As an exception to the foregoing, it is specified that payment information (bank details, credit card numbers) is stored by the operator Stripe Payments Europe, Limited ("SPEL") and that Stripe retains this data for the following period: 5 years.
(g.2) The duration of storage of personal data contained in the Data Processing Accessible to Referred Professionals is as follows : the personal data being necessary for the realization and/or administration of the services entrusted by the User to a Referred Professional (in case the User wishes to ask a question or entrust a service to a Referred Professional), the personal data are kept as long as the User is likely to be able to use the services provided by the Referred Professional, i.e. as long as the User has not expressed his intention to no longer have his personal data kept, by means of a request made by him to Legaware at the address identified in point (b.1) above or to the Referred Professional at the address identified in point (b.2) above, for a period of 36 (thirty-six) months from the last use of the Site or the last order for a Service made by the User or the last question or the last order for a service made with a Referred Professional, after which date the personal data is no longer kept . If necessary, it is specified that when the data contained in the Data Processing Accessible to Professionals is subject to an access granted to Referred Professionals, i.e. in the case where a User asks a question or entrusts a service to a Referred Professional, then the Referred Professional is granted access to this data as long as he is a client of Legaware but within the limits set out in this point (g.2), i.e. as long as the User has not expressed his intention to no longer have his personal data kept, by means of a request made by him to Legaware at the address identified in point (b.1) above or to the Referred Professional at the address identified in point (b.2) above, within the limit of 36 (thirty-six) months from the last use of the Site or the last order for Service made by the User or the last question or the last order for service made with a Referred Professional, after which date the personal data is no longer kept.
(h) User's rights that may be exercised with the data controllers (as identified above)
With regard to the legal basis for the Processing of Legaware Personal Data and the legal basis for the Processing of Personal Data accessible to Referred Professionals, including in particular that of the User's consent, the User and, more generally, all persons concerned in this context, have the following rights, under the conditions provided for by the Regulations in force, both with regard to the Processing of Legaware Personal Data and to the Processing of Personal Data accessible to Referred Professionals :
The exercise of the rights as identified in this (h) may be accomplished:
Where necessary, it is stipulated that (i) the exercise of the right to the erasure of his/her personal data and/or the exercise of the right to object to the processing of his/her personal data and/or the exercise of the right to restrict the processing of his/her personal data and/or the exercise of the right to withdraw consent at any time to the processing of his/her personal data (in accordance with the aforementioned provisions) (ii) which would be exercised at the level of the Legaware Personal Data Processing or which would be exercised at the level of the Personal Data Processing Accessible to Referred Professionals (iii) would lead to not making or no longer making possible the access to the Services so that, in this case (a) if these rights are exercised at the time of ordering the Services, then the User will not be able to place the order and, furthermore, the User will not be able to use a Referred Professional (b) in any case, from the moment of exercising the aforementioned rights, the User will no longer be able to access the Services and the services provided by the Referred Professional, and the account of the User who has received the personal data will be deleted.
(i) Complaint to the CNIL
The persons concerned by the Processing of Personal Data of Legaware and by the Processing of Personal Data Accessible to Referred Professionals, are informed of the right to lodge a complaint with the supervisory authority which is the Commission Nationale de L'Informatique et des Libertés (CNIL): 3 Place de Fontenoy - TSA 80715 - 75334 Paris 07.
(j) Automated decision making
It is hereby stated, both with regard to the Processing of Personal Data by Legaware and with regard to the Processing of Personal Data accessible to Referred Professionals, that the personal data collected does not lead to automated decision-making in the sense of the current Regulations.
(k) Possible further processing of personal data
In the event that the personal data is further processed for purposes other than those identified above, both with regard to the Processing of Personal Data by Legaware and with regard to the Processing of Personal Data accessible to the Referred Professionals the relevant controller (i.e. Legaware in respect of the Processing of Personal Data of Legaware and Legaware and the relevant Referred Professional in respect of the Processing of Personal Data Accessible to Referred Professionals) will provide the data subjects with the required information about such other purpose and any other relevant legal information required in advance.
(l) Regarding the Processing of Personal Data Accessible to Referred Professionals: Outline of the agreement between the joint controllers, i.e. Legaware and the Referred Professional
In accordance with the provisions of Article 26 of Regulation EU 2016/679 of 27 April 2016 (GDPR), the joint controllers shall define in a transparent manner their respective obligations for the purpose of ensuring compliance with the requirements of the said Regulation, in particular with regard to the exercise of the rights of the data subject, and their respective obligations with regard to the provision of the information referred to in Articles 13 and 14 of the said Regulation, by means of an agreement between them, with the broad outlines of the agreement made available to the data subject.
In this regard, with regard to the Processing of Personal Data Accessible to Referred Professionals, the following are the main lines of the agreement concluded for this purpose between the joint managers of this processing, namely Legaware and the Referred Professional and the respective obligations of the joint managers of the Processing of Personal Data Accessible to Referred Professionals:
It is agreed that these contact points are also those applicable to the supervisory authorities.
Thus, in the event of a personal data breach, the joint manager of the Referred Professional Accessible Data Processing concerned by the personal data breach case undertakes to:
In the event that such a breach is likely to result in a high risk to the rights and freedoms of the data subjects, the joint controller of the Referred Professional Accessible Data Processing concerned by the case of personal data breach shall communicate to the data subjects the information about the breach as prescribed by Article 34 of the EU Regulation 2016/679 of 27 April 2016 (RGPD).
In addition, and without prejudice to the foregoing, in the event of a personal data breach in the context of the Processing that they provide, the joint controller of the Processing of Data Accessible to Referred Professionals affected by the said breach undertakes to inform, without undue delay, the other joint controller of the Processing, and at the latest within seventy-two (72) hours, of the said breach in the terms required by Article 33 of the RGPD.
This information shall include at a minimum (1) details of the nature of the personal data breach (categories of data, categories of individuals affected, approximate number of individuals affected, categories and approximate number of personal data affected); (2) the likely impact of the breach on the personal data; (3) a description of the steps taken to remedy the breach of confidentiality.
In any case, each of the joint managers of the Processing of Data Accessible to Referred Professionals imposes on its subcontractors the same obligations in terms of data protection as those binding it to the other joint manager of the Processing of Data Accessible to Referred Professionals, and to provide sufficient guarantees as to the implementation of appropriate technical and organizational measures so that the processing satisfies the requirements of the Regulations in force.
With regard to both the Processing of Personal Data by Legaware and the Processing of Personal Data accessible to Referred Professionals, the following is stipulated : The collection of personal data can only concern persons aged at least 15 years (without prejudice to the stipulations of the CGUV providing in their article 1 that the acceptance of the CGUV and, consequently, the access to the Services, implies that the User has full legal and civil capacity), it is hereby stipulated, in any case, that persons under 15 (fifteen) years of age may only give their consent to the collection of their personal data (and consequently access the Services) on the condition that they are authorized by the holder of parental responsibility for them.
The present terms and conditions may be updated. In this respect, the User and, more generally, any person concerned, is invited to take note of the latest version of the present, accessible on the Site, and also in the CGUV.
