In the age of digital transformation and big data, the protection of personal data is both a challenge and a major issue for law firms. Since the General Data Protection Regulation came into force, it has been essential for the Firm to address this issue. Indeed, the protection of personal data constitutes a major competitive advantage and a factor in building trust with clients and members of the firm.

In the course of its business, SELARLU CABINET HOUARI AVOCATS collects and processes personal data.

Consequently, committed to fostering innovation whilst building a lasting relationship of trust based on respect for individuals’ rights and freedoms, SELARLU CABINET HOUARI AVOCATS attaches great importance to the protection of your personal data.

This notice sets out the firm’s data protection policy, which applies to the firm’s website.

The main aim of this policy is to set out, in a concise, transparent, understandable and easily accessible format, information regarding the data processing carried out, so that you can understand the conditions under which your data is processed, what your rights are in this regard, and to outline the commitments of SELARLU CABINET HOUARI AVOCATS.

This policy aims to describe the standards of conduct expected of the firm’s members to ensure the protection of personal data and the privacy of individuals, in particular clients and members of the firm.

The personal data protection policy sets out the responsible and ethical conduct that every member of the firm must observe when collecting and processing personal data. By using the Website, you accept the terms of the data protection policy.

SELARLU CABINET HOUARI AVOCATS is a law firm with its registered office at 92 Boulevard de SEBASTOPOL, 75003 PARIS, registered with the Paris Trade and Companies Register (RCS) under number 423 464 924.

In the interests of fairness and transparency towards our clients, our members and our service providers, our firm takes care to inform data subjects of every processing operation it carries out by means of information notices.

This data is collected fairly; no data is collected without the knowledge of the individuals concerned and without their being informed.

Our firm is also available at the following address to provide any necessary clarification regarding its data protection policy: houari@cabinet-houari-avocats.fr.

When Houari Avocats is required to process data, it does so for specific purposes: every data processing operation carried out serves a legitimate, specific and explicit purpose.

For each data processing operation carried out, SELARLU CABINET HOUARI AVOCATS undertakes to collect and use only data that is adequate, relevant and limited to what is necessary in view of the purposes for which it is processed.

The firm ensures that data is, where necessary, kept up to date and implements procedures to enable the erasure or rectification of inaccurate data.

As part of the data processing activities, the purposes of which are set out below, SELARLU CABINET HOUARI AVOCATS may request and collect personal data and other information from you, in particular on certain pages of the Website.

The firm may collect and process the following categories of data:

· Identification data of data subjects, such as your first name and surname;

· Data relating to the personal life of data subjects, such as your email address, postal address or date of birth;

· Data relating to the professional situation of the data subject, such as their profession or professional contact details;

· Economic and financial data concerning the data subject;

· Data relating to the data subject’s education, qualifications and honours;

· Data containing the data subject’s National Insurance number;

· Sensitive data, such as data relating to health;

· Data relating to criminal convictions and offences, or related security measures;

· Connection data such as the domain names and IP addresses of visitors, usage statistics (including browser types and operating systems used) and browsing history.

More generally, SELARLU CABINET HOUARI AVOCATS collects and processes any personal data that has been provided in connection with the provision of the Firm’s services.

You should not send us any confidential information until we have confirmed in writing that we are representing you. Unsolicited emails from individuals who are not clients of the firm do not create a solicitor-client relationship, may not be protected by legal professional privilege and may be disclosed to third parties.

Where data is required for the conclusion of a contract or to meet legal or regulatory obligations, the data collection forms will indicate this with an asterisk. If this information is not provided, your request may not be considered or its assessment may be delayed.

Personal data provided by you
This refers to personal data that you provide in the context of: your communications or dealings with the Firm; or the creation of a case file. This data is mainly collected through our forms and electronic communications.

Personal data from third parties
Personal data may also be obtained from: fellow lawyers; any third party involved in carrying out the tasks entrusted to the Firm; and courts.

The data processing carried out by the Firm is necessary for the performance of a contract or for the implementation of pre-contractual measures taken at the request of the data subject. This applies to processing carried out for the following purposes: client management (case management and client follow-up, digital archiving, contact management, switchboard management, and the drafting of legal documents).

Data processing activities carried out for the following purposes are undertaken to fulfil the legal and regulatory obligations incumbent upon SELARLU CABINET HOUARI AVOCATS, namely:

· Payroll management;

· Administrative management of the firm’s staff;

· Financial and accounting management (management of accounts and invoicing for clients and suppliers, and management of tax returns).

Processing carried out for the following purposes is undertaken to fulfil the legitimate interests of SELARLU CABINET HOUARI AVOCATS, in particular the management, smooth running and operation of its business:

· Management of paper-based archiving;

· Management of external communications (sending out communications, events, greeting cards, and managing newsletter subscriptions);

· Social media (management of the Facebook page, management of the Google+ page);

· Website management (management of the contact form, management of the client portal);

· Email management;

· Calendar management;

· Directory management;

· Recruitment management;

The personal data we collect, as well as any data collected subsequently, is intended for us in our capacity as data controller.

The following categories of recipients are also recipients of your data:

· members of the Firm;

· any third party acting on behalf of the Firm in connection with the assignments entrusted to it;

· the competent authorities or courts.

Furthermore, we may be legally obliged to disclose the information collected. We ensure that only authorised persons have access to this data.

SELARLU CABINET HOUARI AVOCATS applies strict authorisation policies to ensure that the data it processes is only passed on to those authorised to access it.

The Firm does not transfer your data outside the European Union unless such a transfer is based on exceptions for specific situations (your consent, a transfer necessary for the performance of a contract between you and the Firm or for the implementation of pre-contractual measures taken at your request, etc.).

Should SELARLU CABINET HOUARI AVOCATS need to transfer data outside the European Union outside of these exceptional cases, it would only do so after taking the necessary and appropriate measures to ensure a level of protection and security for personal data equivalent to that provided in Europe, of which it would inform you in advance.

To secure these transfers outside the European Union, we may, for example, implement standard contractual clauses defined by the European Commission to regulate the flow of data.

Every member of SELARLU CABINET HOUARI AVOCATS undertakes to ensure that data is retained in a form that allows the identification of the data subjects only for as long as is necessary for the purposes for which it is processed.

The retention periods we apply to your personal data are proportionate to the purposes for which it was collected.

More specifically, we organise our data retention policy as follows:

SELARLU CABINET HOUARI AVOCATS attaches particular importance to the security of personal data.

Appropriate technical and organisational measures are implemented to ensure that data is processed in such a way as to guarantee its protection against accidental loss, destruction or damage that could compromise its confidentiality or integrity.

When developing and designing, or when selecting and using the various tools that enable the processing of personal data, SELARLU CABINET HOUARI AVOCATS ensures that they provide an optimal level of protection for the data being processed.

Nevertheless, the security and confidentiality of personal data depend on everyone’s adherence to best practice; the data subject is therefore urged to remain vigilant in this regard.

SELARLU CABINET HOUARI AVOCATS has adopted internal policies and procedures and implements measures that comply with the principles of data protection by design and by default. As such, SELARLU CABINET HOUARI AVOCATS is able to use pseudonymisation or data encryption techniques where possible and/or necessary.

Any member of the firm who subcontracts part or all of the processing of personal data undertakes to contractually require their subcontractor to provide guarantees regarding the confidentiality of personal data through technical and organisational measures to protect such data.

Consequently, only a data processor that provides sufficient guarantees regarding the implementation of appropriate technical and organisational measures may be engaged, so that the processing meets the requirements of the Regulation and ensures the protection of the data subject’s rights.

Indeed, in accordance with its commitments, our firm selects its data processors and service providers with care and requires them to:

· a level of personal data protection equivalent to its own;

· the use of personal data or information solely for the purpose of managing the services they are required to provide;

· strict compliance with applicable legislation and regulations regarding confidentiality and personal data;

· the implementation of all appropriate measures to ensure the protection of any personal data they may be required to process;

· the definition of the technical and organisational measures necessary to ensure security.

Consequently, a written contract is entered into between our firm and the data processor, setting out, in particular, the purpose, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects concerned, as well as the obligations and rights of the data controller.

Every member of the firm responsible for processing personal data undertakes to put in place, internally, all the human and technical resources necessary to effectively ensure compliance, in particular with the data subjects’ rights of access, rectification and objection on legitimate grounds.

It is specified that we may refuse requests that are manifestly abusive – in particular due to their number, repetitive or systematic nature – and requests for access made by data subjects in relation to the processing of personal data carried out.

Your right of access
In this regard, you are entitled to confirmation as to whether or not your personal data is being processed and, where it is, you have the right to request a copy of your data and information concerning:

· the purposes of the processing;

· the categories of personal data concerned;

· the recipients or categories of recipients and, where applicable if such disclosures are to be made, the international organisations to which the personal data have been or will be disclosed, in particular recipients established in third countries;

· where possible, the envisaged retention period for the personal data or, where this is not possible, the criteria used to determine that period;

· the existence of the right to request from the data controller the rectification or erasure of your personal data, the right to request a restriction on the processing of your personal data, and the right to object to such processing;

· the right to lodge a complaint with a supervisory authority;

· information regarding the source of the data where it is not collected directly from the data subjects;

· the existence of automated decision-making, including profiling, and, in the latter case, relevant information regarding the underlying logic, as well as the significance and anticipated consequences of such processing for the data subjects.

Your right to rectification of your data
You may request that we rectify or, where appropriate, complete your personal data if it is inaccurate, incomplete, ambiguous or out of date.

Your right to erasure of your data
You may request that we erase your personal data where one of the following grounds applies:

· the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

· you withdraw the consent previously given;

· you object to the processing of your personal data where there is no overriding legitimate ground for the processing;

· the processing of personal data does not comply with the provisions of applicable legislation and regulations.

Please note that the right to erasure is not a general right and that it can only be granted if one of the grounds set out in the applicable regulations applies.

Therefore, if none of these grounds apply, SELARLU CABINET HOUARI AVOCATS will not be able to grant your request; this will be the case if it is required to retain the data due to a legal or regulatory obligation or for the establishment, exercise or defence of legal claims.

Your right to restrict data processing
You may request that the processing of your personal data be restricted in the cases provided for by legislation and regulations.

Your right to object to data processing
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data where the legal basis is the legitimate interest pursued by the data controller (see the section above on the legal basis for processing). Should you exercise this right to object, we will ensure that we no longer process your personal data in the context of the processing in question, unless we can demonstrate that we have legitimate and compelling grounds for continuing such processing. These grounds must override your interests, rights and freedoms, or the processing must be necessary for the establishment, exercise or defence of legal claims. You have the right to object to personalised marketing and to profiling insofar as it is linked to such marketing.

Your right to data portability
You have the right to data portability in respect of your personal data. Please note that this is not a general right. Not all data from all processing operations is portable, and this right applies only to automated processing, excluding manual or paper-based processing. This right is limited to processing operations where the legal basis is your consent or the performance of pre-contractual measures or a contract. This right does not include derived data or inferred data, which are personal data created by the Firm. The data to which this right may be exercised are: solely your personal data, which excludes anonymised personal data or data that do not relate to you; declarative personal data as well as the operational personal data referred to above. The right to data portability must not infringe the rights and freedoms of third parties, such as those protected by trade secrets. You may request data portability in accordance with the procedure set out below, specifying whether you wish to receive the data yourself or, where technically feasible for us, for us to transfer it directly to another data controller. In the latter case, please ensure you provide us with the exact name of that controller, their contact details and the department or person to whom the data should be sent. To facilitate the exercise of this right, you must inform that recipient of your request to our organisation.

Your right to withdraw your consent
Where the data processing we carry out is based on your consent, you may withdraw it at any time. We will then cease processing your personal data, without this affecting the lawfulness of any previous processing for which you had given your consent.

Your right to lodge a complaint
You have the right to lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris) in France, without prejudice to any other administrative or judicial remedy.

Your right to set out post-mortem instructions
You may set out specific instructions regarding the retention, erasure and disclosure of your personal data following your death to our services in accordance with the procedures set out below. These specific instructions will relate solely to the processing carried out by us and will be limited to that scope alone. You will also be able, once this person has been appointed by the executive authority, to set out general instructions for the same purposes.

How to exercise your rights
Contact us Our firm is able to respond to requests from data subjects to exercise their rights at any stage of the processing, in accordance with the conditions and time limits set out in the applicable regulations. All the rights listed above may be exercised by emailing houari@Cabinet-houari-avocats.fr or by post to

SELARLU CABINET HOUARI AVOCATS

92 Bd de SEBASTOPOL

75003 PARIS.

The data subject must clearly state their full name, enclose a copy of a valid identity document and specify the address to which they wish the reply to be sent. Our firm will inform any data subject wishing to exercise their rights should it be impossible to comply with their request.

We may need to amend this Data Protection Policy. We therefore invite you to check this policy regularly on our website.

Such amendments take effect on the date indicated at the top of the page, which is the date of the last revision or substantial amendment to the Data Protection Policy. By continuing to use the Website after this date, you accept the amendments made to the Data Protection Policy.