Privacy policy

GAUTELIER AVOCATS attaches great importance to the protection of personal data, a natural extension of the professional secrecy by which lawyers are bound. This policy explains what data is collected on this website, why, how long it is kept and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978.

Data controller

GAUTELIER AVOCATS, SELARL law firm, 109, avenue Gaston Cabrier, 13300 Salon-de-Provence, France.

For any question regarding your data: rgpd@gautelier-avocat.com.

Data processed, purposes and legal bases

Contact form and appointment requests

• Data: surname, first name, company, email address, telephone number, nature of the enquiry, message, any deadline.
• Purposes: responding to your enquiry, directing it to the right person and, where applicable, checking for conflicts of interest before accepting any instructions.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and the professional obligation to check for conflicts of interest (Art. 6(1)(c)).
• Retention period: 3 years from the last contact if no instructions are given. If the firm is instructed, data is kept for the duration of the relationship and then for the retention periods applicable to lawyers’ files.

Please do not send any confidential or sensitive information (health, criminal convictions, etc.) through this form until an appropriate communication channel has been established.

“What is your challenge?” guided request

• Data: your answers to the questions (profile, subject, nature of the request, any deadline), an optional short description, your name and, depending on the contact method chosen, your telephone number or email address.
• Purpose: sending your request to the firm and getting back to you. No automated analysis is performed on these answers.
• Legal basis and retention period: the same as for the contact form. Answers are emailed to the firm and are not stored on the website.

Online appointment booking

• Data: the information you enter in the booking calendar (name, email address, any details) and the time slot chosen.
• How it works: the calendar is provided by Cal.com, which handles the booking, confirmation and reminders. It is only loaded with your consent.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

Job applications

• Data: surname, first name, contact details, contract and position sought, education, availability, covering message, CV and cover letter (PDF or Word).
• Purpose: reviewing your application and getting back to you.
• Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR).
• Retention period: 2 years from the last contact, unless you object. Attachments are emailed to the firm and are not stored on the website.

Home page search bar

• Data: the free text you enter.
• Purpose: showing the firm’s practice areas that match your question.
• How it works: the text is sent to a large language model provider (OpenAI, via the Vercel AI Gateway) to be matched against our practice areas. It is neither stored nor logged by the firm and is not used to train models. The provider may retain it for up to 30 days for abuse monitoring. If this service is unavailable, a keyword analysis is performed directly on our servers.
• Legal basis: the firm’s legitimate interest in offering a search tool (Art. 6(1)(f) GDPR).

Do not enter any confidential, identifying or sensitive information.

Security and abuse prevention

• Data: IP address, date and time of requests, technical browser information.
• Purposes: website security, limiting the number of form submissions (anti-spam), technical diagnostics.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention period: no more than 1 hour for anti-abuse counters; the host’s technical logs according to its standard retention periods (a few days to 30 days).

Audience measurement

• Vercel Web Analytics, enabled by default: cookieless audience measurement with no persistent identifier, producing aggregated, anonymous statistics. Legal basis: legitimate interest.
• Google Analytics 4, only if you accept it via the cookie banner: detailed browsing statistics. Legal basis: consent (Art. 6(1)(a) GDPR). IP address anonymised; data retention in Google Analytics: 14 months.

Third-party services

The Google Maps map on the Contact page and the Cal.com calendar on the Appointment page are only loaded with your consent. Otherwise, a directions link and the switchboard number are offered, without any data being sent to these services.

Recipients and processors

Your data is intended solely for authorised members of the firm. It is never sold or transferred. The firm uses the following technical processors:

• Vercel Inc. — Website hosting, cookieless analytics — United States / EU
• MongoDB, Inc. (Atlas) — Website content database — European Union
• Resend (Plus Five Five, Inc.) — Delivery of form emails — United States
• OpenAI, L.L.C. — Classification of search bar text — United States
• Cal.com, Inc. — Online appointment booking, subject to consent — United States / EU
• Upstash, Inc. — Anti-abuse counters — European Union
• Google Ireland Ltd / Google LLC — Google Analytics 4 and Google Maps, subject to consent — EU / United States

Transfers outside the European Union

Some processors are based in the United States. These transfers are governed by the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework for certified providers and, failing that, by the standard contractual clauses adopted by the European Commission.

Security

The website is served exclusively over HTTPS. Access to the administration interface is restricted to authorised members of the firm and protected by authentication. Forms are protected against automated submissions.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time and to set instructions regarding your data after your death.

To exercise these rights, write to rgpd@gautelier-avocat.com or to the firm’s registered office. You will receive a response within one month.

These rights are exercised subject to lawyers’ professional secrecy, which may limit the disclosure of certain information relating to a matter.

You may also lodge a complaint with the French data protection authority, the CNIL — 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.

Changes to this policy

This policy may be updated, in particular if the services offered on the website change. The date of the latest update is shown at the top of the page. In the event of any discrepancy, the French version prevails.