Privacy policy

PROVISIONAL translation – subject to final review by the Lawyer. Reference text is the French version.

Preamble

Cabinet DBCR Avocat attaches the highest importance to the protection of personal data of its clients, prospects, professional contacts and visitors to the website dbcr-avocat.fr.

This privacy policy aims to inform the persons concerned about the processing of personal data carried out by the Firm, in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and French Law no. 78-17 of 6 January 1978, as amended, on data processing, files and freedoms.

As the practice of law is subject to the absolute professional secrecy provided for in article 66-5 of French Law no. 71-1130 of 31 December 1971, as amended, on the reform of certain judicial and legal professions, all information exchanged with the Firm benefits from reinforced legal protection.

1. Data controller

The controller of the personal data collected via the website dbcr-avocat.fr is:

2. Data collected

The Firm only collects data strictly necessary for the purposes pursued.

2.1 Data collected through the contact form

• First and last name
• Email address
• Telephone number (optional)
• Nature of the request (area of practice)
• Content of the message
• Date and time of submission

2.2 Data collected as part of the client relationship

As part of the missions entrusted to the Firm, additional personal data may be collected: identity documents, detailed contact information, professional and family situation, case-file documents, written exchanges, financial data related to invoicing.

This data is covered by the lawyer’s professional secrecy.

2.3 Technical data collected via navigation

• IP address (anonymised if analytics are activated)
• Browser type and operating system
• Pages visited and duration of visits
• Date and time of connection

2.4 Data collected via newsletter subscription

• Email address
• Explicit consent to receive the Firm’s publications
• Date and time of subscription

3. Purposes of processing

Personal data collected is processed for the following purposes:

• Responding to requests made via the contact form or by any other means of communication
• Executing entrusted missions and managing the client relationship
• Complying with legal obligations applicable to the legal profession (tax returns, accounting obligations, anti-money laundering, etc.)
• Sending the Firm’s newsletter to persons who have explicitly consented to receive it
• Improving the website’s operation and analysing its frequency anonymously
• Ensuring website security and preventing intrusion attempts

4. Legal bases

Processing relies on the following legal bases within the meaning of article 6 of the GDPR:

Processing	Legal basis
Response to contact requests	Pre-contractual measures at the request of the person concerned (art. 6.1.b GDPR)
Execution of entrusted missions	Performance of the service contract (art. 6.1.b GDPR)
Firm’s legal obligations	Compliance with a legal obligation (art. 6.1.c GDPR)
Newsletter	Explicit consent (art. 6.1.a GDPR)
Audience analysis and security	Legitimate interest of the Firm (art. 6.1.f GDPR)

5. Recipients of the data

Personal data collected is intended exclusively for Maître Drusilla Bret-Cunynghame-Robertson, the data controller.

In certain strictly necessary situations, data may be communicated to:

• The Paris Bar Council as part of its ethical supervision missions
• The competent jurisdictions and administrative authorities in the context of ongoing proceedings
• Other parties and their counsel in strict compliance with procedural framework
• Experts and colleagues intervening occasionally on a case with the client’s prior agreement
• Technical service providers of the Firm, acting as processors within the meaning of article 28 of the GDPR (see section 6)

No data is sold, leased or transferred to third parties for commercial purposes.

6. Processors and data transfers

The Firm uses technical service providers for the operation of the website and its activity. These providers are bound by contractual confidentiality and security commitments compliant with the GDPR.

6.1 Website hosting

The website is hosted by IONOS SARL, 7 place de la Gare, 57200 Sarreguemines, France. Data is stored on servers located within the European Union.

6.2 Email routing

Emails transit through the professional messaging services used by the Firm, hosted within the European Union.

6.3 Third-party technical tools

• jsDelivr (CDN, distribution of technical libraries): no personal data transmitted, exclusive provision of JavaScript scripts
• OpenStreetMap (cartographic display on the Contact page): the user’s IP address may be collected by the OpenStreetMap Foundation when the map loads

The website makes no use of Google Fonts, Google Analytics, Google Maps or Facebook Pixel in its default configuration.

6.4 Transfers outside the European Union

No personal data transfers outside the European Union are carried out by the Firm in the normal course of its activity.

In the specific case of international matters requiring the transmission of data to a third country, the Firm relies on the appropriate guarantees provided for in articles 44 to 50 of the GDPR (adequacy decisions, standard contractual clauses, etc.) and informs the persons concerned in advance.

7. Retention periods

Personal data is retained for the following periods, in accordance with the legal and ethical obligations applicable to the legal profession:

Data category	Retention period
Contact form requests (without follow-up)	3 years from the last exchange
Active client files	For the entire duration of the contractual relationship
Archived client files (closed)	5 years after the end of the mission (article 2225 of the French Civil Code), extended in accordance with the ethical obligations of the National Council of Bars
Accounting and tax records	10 years (article L.123-22 of the French Commercial Code)
Newsletter subscriptions	Until unsubscription or 3 years of inactivity
Technical logs and connection data	1 year maximum

8. Rights of data subjects

In accordance with articles 15 to 22 of the GDPR, any person concerned has the following rights over their personal data:

• Right of access: obtain confirmation that their data is being processed and receive a copy
• Right of rectification: correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): obtain the deletion of data in cases provided for by the GDPR
• Right to restriction of processing: temporarily suspend processing
• Right to portability: receive their data in a structured and commonly used format
• Right to object: object to processing on legitimate grounds
• Right to withdraw consent: withdraw at any time consent previously given (in particular for the newsletter)
• Right to issue directives concerning the fate of their data after their death (article 85 of the French Data Protection Act)

These rights may be exercised by addressing a written request, accompanied by proof of identity, to the postal or electronic address indicated in section 1.

The Firm undertakes to respond to any request within one month, which may be extended by two months in the event of particular complexity.

Specific limitations linked to professional secrecy

Certain rights may be limited due to the lawyer’s absolute professional secrecy (article 66-5 of the law of 31 December 1971) or to the legal and ethical obligations weighing on the profession. These limitations comply with article 23 of the GDPR and article 90 of the French Data Protection Act.

Appeal to the CNIL

If the response is deemed unsatisfactory, any person has the right to lodge a complaint with the French Data Protection Authority (Commission nationale de l’informatique et des libertés, CNIL):

9. Cookies and trackers

The website dbcr-avocat.fr uses a limited number of cookies, in strict compliance with applicable regulations.

9.1 Strictly necessary cookies

These cookies are essential to the website’s operation and do not require the user’s consent:

• WordPress session cookies
• Consent banner management cookies
• Security cookies

9.2 Audience measurement cookies

The website may use audience measurement tools configured in compliance with CNIL recommendations (IP address anonymisation, no cross-referencing with other processing, retention period limited to 13 months).

9.3 Third-party cookies

Loading the OpenStreetMap map on the Contact page may deposit technical cookies by the OpenStreetMap Foundation, managed directly by it.

9.4 Cookie management

The user may at any time configure cookie deposit via the dedicated banner displayed on the first visit, or via their browser settings. Removing or refusing cookies may affect the operation of certain pages.

10. Data security

The Firm implements appropriate technical and organisational measures to guarantee the security, integrity and confidentiality of personal data processed:

• Secure hosting in the European Union
• Encryption of communications via SSL/TLS certificate (HTTPS protocol)
• Data access limited to authorised persons only
• Regular data backups
• Regular security updates of systems
• Awareness of occasional collaborators of professional secrecy

11. Data breach

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the persons concerned, the Firm undertakes to notify the breach to the CNIL within 72 hours and to inform the persons concerned as soon as possible, in accordance with articles 33 and 34 of the GDPR.

12. Policy modifications

This privacy policy may be modified to reflect legislative, regulatory or technical developments. The date of the last update is indicated at the top of the document.

Users are invited to consult this page regularly.

13. Contact

For any question concerning the processing of your personal data or to exercise your rights, you can contact the Firm: