Privacy Policy

Last updated: 5 October 2026

This document provides information on the processing of personal data by ORWL Avocats.

Preamble

By using the orwl.fr website (the “Website”), you are informed of the collection and use of your personal data as described in this privacy policy (the “Policy”).

Any term defined in Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and used in this Policy has the same meaning.

Accordingly, personal data (“Personal Data” or “Data”) means any information relating to an identified or identifiable natural person. Processing means any operation performed on Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

By drafting this Policy and making it available to users of the Website, ORWL intends to fulfill its duty to inform within the meaning of Articles 13 and 14 of the GDPR.

This Policy covers Data collected through the Website. The processing of client Data in connection with matters entrusted to the firm is described in the engagement letter and remains subject to attorney-client privilege (secret professionnel de l’avocat).

ORWL may amend or update this Policy, in which case the new version will be published on the Website with its date of last update. You should therefore check the Website regularly to stay informed of any changes.

Data collected, purposes and legal bases

Your Personal Data collected through the Website is processed by ORWL as data controller. The categories of Data collected (directly from you or through third-party services) depend on the nature of your relationship with ORWL. The Personal Data that ORWL may collect, the purposes of this collection and the corresponding legal bases are set out below.

Browsing the Website

To improve your user experience, ORWL seeks to understand how you interact with the Website. ORWL therefore processes browsing information collected automatically through cookies and other tracking technologies, including the Google Analytics audience measurement service. A cookie is a small file that acts as a tracker; it is stored and read, for example, when the Website is visited or an email is opened, whatever the device used.

When you use the Website, ORWL collects the following browsing Data:

• unique identifiers (browser type and settings, device type and settings, operating system);
• interaction information (IP address, system activity, date and time of requests);
• the pages you view and search for on the Website.

Audience measurement cookies are only placed with your consent, obtained on your first visit, which you may withdraw at any time (Article 82 of the French Data Protection Act, Law No. 78-17 of 6 January 1978). Cookies that are strictly necessary for the operation and security of the Website do not require your consent.

Website security

To protect the Website against intrusion attempts and malicious use, ORWL uses a web application firewall that records the IP address, date, time and nature of requests sent to the Website. This processing is based on ORWL’s legitimate interest in ensuring the security of the Website.

If you wish to restrict, block or delete cookies placed by the Website, you can do so through your browser settings. Most browsers allow you to control cookies, including whether to accept them and how to delete existing ones. However, some features of the Website may not work properly or may be slower if you block cookies.

For more information on cookies and how to delete them from your browser, please refer to your browser’s settings:

• Google Chrome
• Microsoft Edge
• Mozilla Firefox
• Safari (Mac)
• Android
• Safari (iPhone and iPad)
• Opera

Online tools

The simulators and questionnaires available on the Website, such as our tax regularization diagnostic, run locally in your browser. The information you enter is not collected, stored or transmitted to ORWL or to any third party, and is deleted when you leave the page.

Handling of communications

You can contact ORWL through the contact form on the Website, by emailing contact@orwl.fr or by calling the phone number displayed on the Website. If you contact ORWL by any of these means, you will need to provide the following Data:

• last name and first name;
• email address;
• phone number;
• any other Data you choose to provide, including in documents attached to your request.

ORWL collects and processes this Data to respond to your request and to communicate with you on topics or events that may be of interest to you. Requests sent through the contact form are recorded in the firm’s request management tool.

This processing is based on pre-contractual measures taken at your request and on ORWL’s legitimate interest in developing its relationships with prospective clients, clients and partners. The information you provide in this context is covered by attorney-client privilege.

Newsletter subscription

You can subscribe to “Legalchain” on the Website to receive publications and alerts by email. To subscribe, you must provide your email address, your first and last name and the name of your organization.

ORWL uses this Data solely to send you the communications you have subscribed to. You can unsubscribe at any time using the link included in each email.

This processing is based on your consent.

Recipients

ORWL shares Personal Data with third-party service providers that help it achieve the purposes set out in this Policy: hosting of the Website (OVHcloud, a company established in France), Website security, audience measurement (Google), management of contact requests (Asana) and newsletter delivery (Mailchimp). As ORWL’s processors, these providers may access your Data for the sole purpose of performing the tasks entrusted to them. ORWL ensures that its providers offer sufficient guarantees for the performance of these tasks and comply with applicable laws and regulations.

Some of these providers are established in the United States. The corresponding Data transfers are governed by the EU–US Data Privacy Framework where the provider is certified under it or, failing that, by the standard contractual clauses adopted by the European Commission (Articles 45 and 46 of the GDPR).

Where applicable, ORWL will share Personal Data with the competent courts and any other governmental and/or public authority requesting access to it, to the extent permitted by law and in compliance with attorney-client privilege.

In any event, ORWL will only disclose Personal Data to the recipients listed above on a strict need-to-know basis and only to the extent necessary to achieve the purposes of processing identified in this Policy.

Data retention

ORWL retains Personal Data for as long as necessary to:

• achieve the purposes for which it was collected;
• provide the services or information you have requested;
• establish ORWL’s legal defense;
• enforce a contract; and
• comply with all applicable laws.

Audience measurement cookies have a maximum lifetime of thirteen (13) months. The associated audience measurement data is retained for no more than fourteen (14) months.

Website security logs are retained for no more than twelve (12) months.

Data from contact requests that did not lead to a relationship with the firm is retained for three (3) years from the last contact.

Newsletter subscriber Data is retained until you unsubscribe.

Except in the cases described above, ORWL’s standard Data retention period is five (5) years.

During this retention period, if ORWL considers that your Data no longer needs to be kept in the active database, it will be archived, and ORWL will ensure that access to it is limited to a small number of people with a genuine need to access it.

Other information

You are never required to provide the Personal Data requested by ORWL. However, if you decline to provide certain Data, your access to the Website and your subscription or contact requests may be limited, suspended or impossible.

In any event, and regardless of the purpose of the processing concerned, ORWL complies with a strict data minimization principle and therefore processes only the Personal Data necessary for the purposes set out above.

The Website is not intended for use by minors under the age of fifteen (15). If you are under 15, please do not submit any Data on the Website without a legal representative.

Your rights

You have the following rights regarding the processing of your Personal Data, in accordance with Articles 15 to 22 of the GDPR:

• the right of access to the Personal Data collected by ORWL;
• the right to rectification and/or erasure of the Personal Data collected by ORWL;
• the right to restriction of processing by ORWL;
• the right to object to processing based on ORWL’s legitimate interest;
• the right to Data portability;
• the right to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

Under French data protection law (Articles 84 to 86 of Law No. 78-17 of 6 January 1978), you also have the right to give ORWL instructions on how your Personal Data is to be handled after your death.

To exercise your rights or for any privacy-related question, please send your request, together with proof of identity:

• by email to contact@orwl.fr; or
• by post to the address given at the top of this Policy.

ORWL will handle requests within a reasonable time, taking into account their complexity and number, and no later than one (1) month from receipt. ORWL may extend this period by two (2) months for complex requests, in which case you will be informed.

Exercising your GDPR rights is free of charge. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive nature, ORWL may charge a reasonable fee or refuse to act on them (Article 12 of the GDPR).

In the event of a dispute, you may lodge a complaint with the competent supervisory authority, the French data protection authority (Commission Nationale de l’Informatique et des Libertés, “CNIL”). The CNIL’s contact details are available on its website.

This English version is provided for information purposes. In the event of any discrepancy, the French version prevails.