Personal data Protection Policy

In accordance with the provisions of law n° 78-17 of January 6, 1978 amended by law n° 2018-493 of June 20, 2018, we inform you that the processing of personal data collected from the Website is implemented under the conditions of this privacy policy.

The Firm informs you that within the meaning of the aforementioned regulations:

• “personal data” is any information that identifies, directly or indirectly, an individual
• “processing of personal data” is any operation or set of operations applied to personal data.

Information on personal data processing

The processing of personal data carried out within the framework of the Website is based on the legitimate interest of the Firm to implement such activities.

The Firm collects personal data either directly from users, generally through registration forms, or indirectly during interactions with users and / or customers.

When personal data is collected directly from users and / or customers, the mandatory information is flagged. These are essential for the performance of the contract with the Firm or for compliance with a legal obligation. Failure to communicate may prevent the registration and / or processing of a case.

The processing of personal data carried out by the Firm is carried out for the following purposes and on the following legal basis.

Data from Public Registries

The platform aggregates and displays data relating to French legal entities sourced from these official public registries: INSEE Sirene, the INPI RNE (Registre National des Entreprises), and BODACC (Bulletin Officiel des Annonces Civiles et Commerciales). This data is updated on a daily basis.

This data may include the names, roles and professional addresses of natural persons acting in their capacity as corporate officers, directors, managers (gérants) or beneficial owners of registered French entities. Such information is made publicly available by the relevant French authorities pursuant to applicable law and is processed by the platform on the basis of legitimate interest within the meaning of Article 6(1)(f) of the GDPR, for the purposes of providing a company verification and due diligence service to users.

The platform does not collect, store or process any personal data from these registries beyond what is publicly available. Individuals whose data appears in this capacity may exercise their rights as set out in the User Rights section below.

AI-Powered Features

The platform incorporates AI-powered features, including an AI Article Finder and AI-generated article summaries (collectively, “AI Features”). When a user interacts with these features, the text entered or submitted by the user may be transmitted to and processed by a third-party AI service provider.

The legal basis for this processing is the performance of the contract with the user (Article 6(1)(b) GDPR) and, where applicable, the legitimate interest of the platform in improving service quality (Article 6(1)(f) GDPR).

Users are informed that:

• Text submitted through AI Features is transmitted to the platform's AI service provider solely for the purpose of generating a response.
• The platform does not knowingly submit special category data or confidential client communications through AI Features.
• Users are advised not to enter personally identifiable information, confidential information or privileged communications when using AI Features.
• Data transmitted to the AI provider is processed in accordance with the provider's data processing terms, which include appropriate safeguards for international data transfers where applicable.

The identity of the AI service provider and the applicable data processing terms are available upon request at: contact@french-business-law.com

Subscription and Payment Data

Where a user subscribes to a paid feature of the platform (including the AI Summary subscription of €19 per month), the platform collects and processes billing and payment data for the purposes of subscription management, invoicing and payment processing.

Browser Storage (localStorage)

The platform uses the browser's localStorage mechanism to store certain user preferences locally on the user's device. This may include language preferences for AI-generated content and, where applicable, recent search history for convenience purposes. localStorage data is stored exclusively on the user's device and browser. It is not transmitted to the platform's servers and does not constitute personal data processing by the platform within the meaning of the GDPR. Users may clear localStorage data at any time through their browser settings.

Company Monitoring Alerts

The platform offers an optional company monitoring feature, which allows users to receive email alerts when new information is published in relation to a specified French company (including BODACC publications, director changes, capital modifications and trademark filings).

To activate this feature, the user provides their email address and specifies the companies they wish to monitor.

Users may deactivate monitoring alerts at any time by accessing their account settings or by contacting contact@french-business-law.com.

Search Queries

When a user conducts a search on the platform — whether searching for a French company by name or SIREN, a trademark, a legislation article or a legal query — the platform may record the search query for the following purposes:

• Improving platform functionality and relevance of search results
• Generating anonymised and aggregated analytics on platform usage
• Detecting and preventing abusive or fraudulent use of the platform

Search queries are processed on the basis of the platform's legitimate interest (Article 6(1)(f) GDPR). Where possible, search data is anonymised or pseudonymised before storage.

Search queries are not associated with individually identifiable users unless the user is logged into an account, in which case they may be linked to the user's account for the purposes of search history and personalisation, and are retained for a maximum of 13 months.

Recipients of personal data

The personal data of users and / or customers is processed by the Firm in confidence and with care.

The Firm shares the data only with:

• Service providers engaged to process data on behalf of the Firm, for example for the management of our Website, payments, making appointments and performing agreed services. These service providers are only authorised to use personal data as part of the services they perform on behalf of the Firm and only for the achievement of the purposes set out herein.
• Public bodies or authorities requesting access thereto, to comply with a legal obligation or protect rights.
• Firm employees, associates and interns.

It is also recalled that all exchanges between clients and their lawyer are covered by professional secrecy.

Place and duration of storage of personal data

The Firm stores all personal data within the territory of the European Union. Some of this data may be transferred and stored outside the European Union by service providers hired by the Firm. The Firm undertakes to do everything in its power to ensure that these service providers adopt the relevant organisational and technical measures by taking into account the adequacy decision of the Commission if such providers are located in the United States.

The Firm only keeps personal data for the time necessary to achieve the purpose for which it was collected, in accordance with the above.

International Data Transfers

The platform stores all personal data within the territory of the European Union. However, certain third-party service providers engaged by the platform — including cloud infrastructure providers, analytics tools and the AI service provider referred to above — may process personal data outside the European Union, including in the United States.

Where personal data is transferred to a third country, the platform ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

• Transfers to providers located in the United States, covered by the EU-US Data Privacy Framework (Commission Implementing Decision of 10 July 2023) where the recipient is certified under that framework.
• Transfers to providers not covered by an adequacy decision governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021 pursuant to Article 46(2)(c) GDPR, supplemented as necessary by transfer impact assessments.

NOTE: The previous reference to the EU-US Privacy Shield has been superseded. The Privacy Shield was invalidated by the Court of Justice of the European Union on 16 July 2020 (Schrems II, C-311/18). The EU-US Data Privacy Framework adopted on 10 July 2023 constitutes the applicable adequacy decision for transfers to certified US entities.

Users may request a copy of the applicable transfer safeguards by contacting: contact@french-business-law.com

User rights

In accordance with the French Data Protection Act (“Loi Informatique et libertés”) of 6 January 1978 as amended and the general data protection regulations, you have the right to access, query, limit, delete, modify and rectify the information concerning you, and the right to obtain its portability.

You can exercise these rights by addressing an email to the contact of personal data, as well as a right to object to this data being used for commercial prospecting purposes. Finally, you have the right to define general and specific directives defining the manner in which you intend to exercise these rights after your death.

You can exercise these rights by sending an email to the contact: contact@french-business-law.com, or by post to: SOLARIS LEGALTECH, for the attention of Me Mariela PETROVA, 182 rue de Rivoli, 75001 PARIS, accompanied by a copy of a signed identity document.

Finally, you have the right to lodge a complaint with the National Commission for Information and Freedoms (Commission Nationale de l'Informatique et des Libertés), which is the French supervisory authority in charge of ensuring compliance with the obligations regarding the protection of personal data.