Personal Data Protection Policy

August & Debouzy & Associés (hereinafter referred to as “August Debouzy” or “we”) takes the protection of privacy and Personal Data very seriously.

Accordingly, as Data Controller, we are committed to implementing appropriate measures to ensure the protection, confidentiality, and security of your Personal Data, and to processing and using such Data in compliance with applicable laws and regulations, including Regulation (EU) 2016/679 of April 27, 2016 (the “General Data Protection Regulation” or “GDPR”), and French Law No. 78-17 of January 6, 1978, known as the “Data Protection Act,” as amended or replaced from time to time (collectively, the “Applicable Regulations”).

This Personal Data Protection Policy (hereinafter the “Policy”) is intended to inform you about how we process your Personal Data and about the commitments made by August Debouzy to ensure their protection and respect.

For the purposes of this Policy, the terms “Personal Data”, “Processing”, “Data Controller” and “Processor” have the meanings given to them in Article 4 of the GDPR.

1. What Personal Data Do We Process?

We ensure that all Personal Data we collect and process are relevant, adequate, non-excessive, and strictly necessary to achieve the purposes for which they were collected.

1.1. Business Contacts (Clients, Prospects, Other External Contacts)

In connection with the performance of engagement letters we enter into with our clients (the “Clients”), and more generally in the course of providing legal services on their behalf, we may collect and process Personal Data relating to Clients, as well as their employees, representatives, service providers, and/or officers.

We may also collect and process Personal Data from prospects (“Prospects”) provided by them during events, meetings, or various professional interactions.

Finally, we may collect data relating to various external contacts encountered in the course of our work and day-to-day activities (fellow lawyers, opposing parties, judges, regulatory authorities, students, etc.) (collectively, the “External Contacts”).

In such circumstances, we may access Personal Data such as identity and contact details. However, we may also access other Personal Data that you provide directly to us as part of our engagement, where such information is necessary.

1.2. Visitors to the August Debouzy Website

When using the August Debouzy website, available at https://www.august-debouzy.com/en/ (the “Website”), August Debouzy may collect and process certain Personal Data about you as a user of the Website (the “User(s)”).

Personal Data of Users are collected in the following circumstances:

  • When you subscribe to information sessions or newsletters offered by August Debouzy: in this case, we collect your email address;

  • When you browse the Website: we collect your technical and browsing information (please refer to our Cookie Policy);

  • When you apply online via our recruitment module: we collect your identity and contact details, CV, cover letter, and any additional information you choose to provide that is relevant to your application;

  • When you contact us with questions about our news, training programs, or any other topic related to our activities: we collect your identity and contact details, as well as any information you voluntarily provide that is relevant to handling your request.

Where your Personal Data are transmitted to us through an online form, mandatory fields are identified by an asterisk (*). Failure to provide this information, or providing incomplete or inconsistent information, may result in August Debouzy being unable to process your request.

2. Why Do We Process Your Personal Data and What Is the Legal Basis for Such Processing?

August Debouzy is committed to collecting and processing your Personal Data lawfully and fairly. All processing carried out by August Debouzy serves explicit, legitimate, and specific purposes.

Your Personal Data may be processed for the following purposes:

  • If you are a Client: Personal Data relating to Clients are processed for the purpose of managing our Clients and the contractual relationship we maintain with them. This includes: (i) communication and contact management, (ii) performance of assigned engagements, in particular the provision of legal services, (iii) contract and invoice management, (iv) accounting management, and (v) monitoring of the contractual relationship. Additionally, and unless they object, Clients may receive newsletters, informational content on various professional and legal topics, press releases, and invitations to training sessions or events organized by August Debouzy, all within a strictly professional context. In this framework, the Personal Data collected may also be used to perform analytical studies (such as identifying trends, measuring the progress of marketing actions, and monitoring click and open rates).

    Accordingly, we process your Personal Data for the purpose of performing the contract and complying with our legal obligations (accounting and tax). However, processing activities carried out for analytical and marketing purposes are based on August Debouzy’s legitimate business interest in promoting its services and strengthening client relationships — which benefits both Clients (by providing access to additional services free of charge) and August Debouzy, without infringing upon the Clients’ fundamental rights and freedoms.

  • If you are a Prospect: Personal Data relating to Prospects are processed for communication and contact purposes. Additionally, and unless they object, Prospects may receive newsletters, informational content on various professional and legal topics, press releases, and invitations to training sessions or events organized by August Debouzy, all within a strictly professional context. In this framework, the Personal Data collected may also be used to perform analytical studies (such as identifying trends, measuring the progress of marketing actions, and monitoring click and open rates). 
    Processing in this context is based on August Debouzy’s legitimate business interest in promoting its services and developing its professional network — which benefits both Prospects (by providing access to free professional content and events) and August Debouzy, without infringing upon the Prospects’ fundamental rights and freedoms.

  • If you are an External Contact: Personal Data relating to External Contacts are processed for the purpose of managing our activities (for example, processing student data to provide training, processing data of fellow lawyers and/or opposing parties to manage a Client’s case, or processing data of judicial or administrative authorities to manage ongoing proceedings or submit legal inquiries) and for communication with these individuals. 
    In certain cases, and unless they object, External Contacts may also receive newsletters, informational content on various professional and legal topics, press releases, and invitations to training sessions or events organized by August Debouzy, all within a strictly professional context. 
    Processing in this context is based on August Debouzy’s legitimate interest in carrying out the mandates entrusted to it by its Clients, providing high-quality legal services, and developing professional relationships, without infringing upon the fundamental rights and freedoms of External Contacts.

  • If you are a Website User: Personal Data relating to Users are processed for the following purposes: (i) communication and management of requests or inquiries submitted through the Website, (ii) analysis of Website browsing (please refer to our Cookie Policy), and/or (iii) business development (sending newsletters, informational content on professional and legal topics, press releases, and invitations to training sessions or events organized by August Debouzy) when a User provides their email address for this purpose on the Website and does not subsequently object. 
    Processing in this context is based on August Debouzy’s legitimate business interest in promoting its services and developing its relationships, continuously improving its Website, and communicating efficiently with its Users. This benefits both Users (who access quality services and content) and August Debouzy, without infringing upon the Users’ fundamental rights and freedoms.

  • If you are a Job Applicant: Personal Data relating to job applicants are processed for the purpose of managing and evaluating submitted applications. For more information, please refer to our Candidate Privacy Policy, available via the following link.

3. How Long Do We Retain Your Personal Data?

August Debouzy retains your Personal Data for as long as necessary to fulfill the purposes for which it was collected and processed. However, August Debouzy may retain your Personal Data for a longer period in order to comply with legal obligations, including applicable statutory limitation periods.

Accordingly, August Debouzy retains your Personal Data for the following periods:

  • Client Data are retained for the entire duration of the contractual relationship and for the applicable limitation period (generally 5 years). Please note, however, that in some cases we may retain Client Data for a longer period where necessary to monitor or manage the legal services provided, particularly in connection with litigation proceedings, until all available remedies have been exhausted. Data required for accounting purposes are retained for a total period of 10 years to comply with applicable accounting and tax obligations.

  • Prospect Data are retained for a period of 3 years following the last contact with the Prospect.

  • External Contact Data are retained:
    (i) if collected in connection with a Client matter, for the same duration as Client Data described above; and
    (ii) if collected in another context, for as long as necessary to fulfill the purpose for which the data were collected.

  • Data collected for marketing and analytical purposes are retained for 3 years following the last contact with the individual concerned.

  • When cookies or other non-essential tracking technologies are placed on your device, they are retained for the duration specified in our Cookie Policy.

  • When your Data are collected in connection with inquiries or requests relating to the Website or the services of August Debouzy, they are retained for as long as necessary to process such inquiries or requests.

4. Who Has Access to Your Personal Data?

The Personal Data collected and processed by August Debouzy are accessible to the relevant internal departments, namely the lawyers (and, where applicable, administrative staff such as trainees or assistants) handling Client matters, as well as our billing department, communication department, and IT department.

These Data may also be disclosed to third parties acting as Processors, bound by a data processing agreement, for the purpose of providing services such as hosting, contact management (CRM), billing management, communication, database management, website management, and IT maintenance. These Processors act solely on the instructions of August Debouzy and have access to your Personal Data only to the extent necessary to perform their services. They are bound by the same security and confidentiality obligations as August Debouzy.

In addition, your Personal Data may be shared with third parties for the following reasons:

  • In response to judicial or administrative proceedings of any kind, or in connection with law enforcement requests made by competent authorities;

  • To comply with legal obligations, to protect the rights and/or safety of any individual, to safeguard the rights and property of August Debouzy, and to prevent fraud, security, or technical issues.

Finally, your Personal Data may be shared with co-organizers when you register for an event jointly organized with third parties. In such cases, the co-organizer will be considered an independent data controller and will be responsible for informing you about the processing of your Personal Data that it carries out.

5. Are Your Personal Data Transferred Outside the European Union?

The Personal Data collected by August Debouzy are hosted within the European Union and are not subject to any transfer outside the European Union.

6. What Are Your Rights?

In accordance with the Applicable Regulations, you have the following rights regarding your Personal Data:

  • Right of Access: You have the right to obtain (i) confirmation as to whether or not Personal Data concerning you are being processed, and, where that is the case, (ii) access to such Data and a copy thereof.

  • Right to Rectification: You have the right to obtain the rectification of inaccurate Personal Data concerning you. You also have the right to request that incomplete Personal Data be completed, including by providing a supplementary statement.

  • Right to Erasure: In certain circumstances, you have the right to request the erasure of your Personal Data. This right, however, is not absolute, and August Debouzy may have legal or legitimate grounds to retain such Data.

  • Right to Restrict Processing: In certain circumstances, you have the right to obtain restriction of the processing of your Personal Data.

  • Right to Data Portability: You have the right to receive the Personal Data concerning you that you have provided to August Debouzy in a structured, commonly used, and machine-readable format, and you have the right to transmit those Data to another Data Controller without hindrance from August Debouzy. This right applies only where the processing of your Personal Data is based on your consent or on the performance of a contract and where such processing is carried out by automated means.

  • Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your Personal Data when such processing is based on the legitimate interest of August Debouzy. However, August Debouzy may demonstrate compelling legitimate grounds for continuing such processing.
    Where your Personal Data are processed for direct marketing purposes, you have the right to object at any time to the processing of your Data for such purposes.
    You may object to receiving newsletters, communications, and invitations to training sessions or events organized by August Debouzy by sending an email to one of the addresses listed below. In addition, our marketing messages include an “unsubscribe” option should you no longer wish to receive such communications from us.

  • Right to Give Post-Mortem Instructions: You have the right to provide August Debouzy with specific instructions regarding the use of your Personal Data after your death.

To exercise these rights, you may submit a request:
• by email to: rgpd@august-debouzy.com
• or by mail to: Direction Générale, RGPD, August Debouzy, 7 rue de Téhéran, 75008 Paris, France

If you experience any difficulty regarding the management of your Personal Data, you may lodge a complaint with the CNIL (3 Place de Fontenoy, 75007 Paris, France) or with any other competent supervisory authority. However, we encourage you to contact us first before submitting a complaint to the CNIL.

Clients are responsible for forwarding this information to their employees, representatives, service providers, and/or officers whose Personal Data may be processed by August Debouzy in the course of performing its services.