Privacy Policy

Gino LegalTech (hereinafter "Gino LegalTech" or "we") attaches great importance to the protection of your personal data. This privacy policy (hereinafter the "Policy") explains which data we process, for what purposes, on what legal basis, with whom it is shared, how long it is retained, and how you can exercise your rights.

It is established in compliance with the General Data Protection Regulation No. 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act ("Informatique et Libertés") No. 78-17 of 6 January 1978 (hereinafter together the "Regulations").

1. Data controller

The data controller is Gino LegalTech, a limited liability company (société à responsabilité limitée) with share capital of EUR 200,000, represented by Philippe Ginestié, whose registered office is located at 11 Rue Galilée, 75116 Paris, France, registered with the Paris Trade and Companies Register (RCS) under No. 830 029 211, intra-Community VAT number FR63830029211.

2. Data Protection Officer

Gino LegalTech has appointed a Data Protection Officer (DPO), whom you may contact for any question relating to the processing of your data or to exercise your rights, at charline.mainguet@ginolegaltech.com or by post at the registered office.

3. What data do we process, and where does it come from?

Depending on the context, we process the following categories of data:

• Identity and contact details: title, surname, first name, email address, telephone number.
• Professional life: job title, department or service, employing organisation.
• Connection and usage data relating to our products and services.
• Information relating to your needs concerning our products and services.

This data is collected in three ways:

• Directly from you, when you complete a form on our website, interact with our teams, or use our products and services.
• Indirectly, from third parties, as part of our commercial prospecting. Your professional contact details may come from publicly accessible professional sources and from providers specialising in the supply and enrichment of professional data, in particular Pharow and FullEnrich, as well as, where applicable, from professional social networks, professional directories, professional events, or a previous contact with Gino LegalTech.
• Indirectly, through cookies and trackers, during your browsing (see Article 8).

4. For what purposes, and on what legal basis?

We only process your data for specific purposes, each based on a precise legal basis:

• Commercial prospecting aimed at professionals (presenting our products and services in connection with your role): our legitimate interest (Art. 6(1)(f) GDPR) in developing our business with professionals likely to have a use for it. We have balanced this interest against your rights: we only process professional data, directly related to your role, and you may object at any time.
• Provision of our products and services, their security and incident resolution: performance of the contract entered into with you or of pre-contractual measures.
• Improvement, development and security of our products and services, and the prevention and detection of fraud: our legitimate interest.
• Marketing communications by electronic means: depending on the case, our legitimate interest in a professional context, or your consent where it is required (for example, subscription to a newsletter).
• Non-strictly-necessary cookies and trackers: your consent (see Article 8).

Where processing is based on your consent, you may withdraw it at any time; such withdrawal does not affect the lawfulness of processing carried out before it.

Gino LegalTech never uses your data to develop, improve or train generative artificial intelligence or machine learning models.

5. Who has access to your data?

Your data is accessible to authorised personnel of Gino LegalTech in charge of the commercial relationship, the provision of products and services, and their development and security.

It is also processed by processors, acting on our instructions and on our behalf, under a contract compliant with Article 28 GDPR:

• HubSpot (customer relationship management), Lemlist (sending our communications) and Neverbounce (email address validation) for prospecting and the commercial relationship;
• Microsoft (Azure hosting), OVHcloud (hosting, depending on the subscribed offering) and Universign (electronic signature) for the provision of the platform.

In addition, we use professional data providers — in particular Pharow and FullEnrich — to identify and enrich professional contacts as part of our prospecting. These providers determine the means of their own collection and act, in this respect, as independent data controllers; we select them for the compliance of their practices with the Regulations.

Finally, your data may be disclosed to advisers involved in connection with your contract, or to public authorities, exclusively to meet our legal and regulatory obligations.

6. Is your data transferred outside the European Union?

The hosting of the platform is located in France: it is provided, depending on the subscribed offering, via Microsoft Azure or via OVHcloud.

Some of our providers may nevertheless process your data outside the European Union, in particular in the United States. This is the case for Google's audience-measurement and advertising tools (see Article 8), for email address validation, and, where applicable, for certain prospecting tools. These transfers are governed by appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular the standard contractual clauses adopted by the European Commission and, where applicable, the provider's certification under the Data Privacy Framework. A copy of these safeguards may be obtained by writing to us at the address indicated in Article 2.

7. How long do we retain your data?

• Prospects: your data is retained for three years from our last contact, then deleted or anonymised. A purge is carried out at the end of this period.
• Customers: data is retained for five years from the end of the contract, in order to cover the limitation period in commercial matters. Accounting and supporting documents are retained for ten years, in accordance with the French Commercial Code.
• Objection to prospecting: if you object, your email address is kept on an objection list, for the sole purpose of no longer soliciting you.
• Cookies and trackers: the validity period of your consent does not exceed thirteen months; information collected via trackers is not retained beyond twenty-five months.

8. Cookies and trackers

Gino LegalTech uses cookies to improve your experience, ensure the proper functioning and security of its products and services, and measure audience. You may accept or refuse non-strictly-necessary cookies via the banner on our website — refusal being as simple as acceptance — and through your browser settings. The validity period of your consent does not exceed thirteen months.

• Session cookies: necessary to maintain your session and your connection to our products and services.
• Audience measurement: we use Google Analytics (Google LLC). The information collected may be transmitted to Google servers located in the United States. Google's privacy policy is available at https://policies.google.com/privacy?hl=en.
• Advertising: we use DoubleClick (Google LLC), for the delivery of advertising and related services (data collection, behavioural analysis, retargeting). The information collected may be transmitted to the United States.
• Social networks: the sharing buttons of Facebook, LinkedIn and X (formerly Twitter) deposit third-party cookies, governed by the privacy policies of these networks.
• CRM: the calls to action generated via HubSpot deposit cookies governed by HubSpot's privacy policy, available at https://legal.hubspot.com/privacy-policy.

9. Specific features of the Gino platform

As part of the provision of the Gino platform, which enables you to create document-drafting robots and produce documents, Gino LegalTech acts as a processor within the meaning of the GDPR, following your instructions as data controller.

The data recorded by your robots is stored with our hosting provider. You may be led to record personal data of clients, providers, suppliers or staff members. It is your responsibility to store only the data strictly necessary for your purposes, in accordance with the data minimisation principle. Depending on your input, the platform may host any type of data, including sensitive data; our products incorporate appropriate security measures in this respect, and access to data is subject to an authentication process and is logged. You are responsible for the security of your credentials.

For electronic signature, we use Universign, a French company, whose data protection policy is available at https://www.universign.com/fr/politique-protection-donnees/.

10. Your rights

In accordance with the Regulations, you have the following rights over your data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to portability, where applicable;
• right to object;
• right to define directives relating to the fate of your data after your death.

With regard to commercial prospecting, your right to object is absolute: you may object at any time, without having to give reasons, by using the unsubscribe link included in each of our messages, or by contacting us at the address indicated in Article 2.

11. Automated decision-making and profiling

Gino LegalTech does not implement any decision producing legal effects concerning you, or similarly significantly affecting you, that is based solely on automated processing.

12. How to exercise your rights and lodge a complaint

To exercise your rights, contact our DPO at charline.mainguet@ginolegaltech.com, or by post at Gino LegalTech, Legal Department, 11 Rue Galilée, 75116 Paris, France.

We will respond within one month of receiving your request. This period may be extended by two months in the case of complex or numerous requests, in which case we will inform you within the first month.

We will only ask you for proof of identity in the event of reasonable doubt as to your identity, and in a manner proportionate to the request.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, telephone +33 1 53 73 22 22, or at www.cnil.fr.

13. Updates to the Policy

This Policy was last updated on 16/07/2026. We reserve the right to modify it at any time and invite you to consult it regularly.