Personal Data Processing Policy of LEFEBVRE Group (France)

March 2025

Download Personal Data Processing Policy

Privacy Policy of LEFEBVRE Group

The subsidiaries of LEFEBVRE SARRUT Group located in FRANCE (listed in Annex A) (hereinafter referred to as the “LEFEBVRE Group“) place great importance on respecting privacy and the protection of personal data. As such, they are committed to implementing appropriate measures to ensure the protection of personal data, and to processing and using such data in compliance with applicable regulations, in particular the European Regulation 2016/679 of April 27, 2016 (General Data Protection Regulation, hereinafter the “GDPR”) and French Law No. 78-17 of January 6, 1978, known as the Data Protection Act.

Terms capitalised in this document are defined by the General Data Protection Regulation.

1. DATA CONTROLLER

Your data is collected by the subsidiaries of the LEFEBVRE Group (listed in Annex A), acting on behalf of: LEFEBVRE SARRUT.

A public limited company with a Management Board and Supervisory Board, with a share capital of

€5,188,008, registered with the Nanterre Trade and Companies Register under number 542 052 451, with its registered office at 10, Place des Vosges – Tour LEFEBVRE DALLOZ – 92400 Courbevoie, acting as the Data Controller.

This privacy policy applies when the LEFEBVRE Group acts as the Data Controller within the meaning of Article 24 of the General Data Protection Regulation 2016/679 of April 27, 2016.

2. WHO IS THE DPO?

We have appointed a Data Protection Officer (DPO), whose contact details are as follows: dpo_office@lefebvre-sarrut.eu

3. GENERAL PRINCIPLES ON PERSONAL DATA PROTECTION

In accordance with Article 5 of the GDPR, LEFEBVRE Group commits to ensuring that personal data is:

  • Processed lawfully, fairly, and transparently;
  • Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
  • Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
  • Accurate and, where necessary, kept up to date;
  • Retained for no longer than is necessary for the purposes for which they are processed;
  • Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures tailored to the

PRINCIPLES APPLICABLE TO THE PROCESSING OF YOUR PERSONAL DATA

In the collection and processing of your personal data, we are committed to the following principles:

  • Lawfulness: Your personal data is collected for specific, explicit, and legitimate purposes, based on an appropriate legal basis.
  • Transparency: You are informed of each processing activity and its characteristics through information notices made available to No processing of your personal data is carried out without your knowledge.
  • Data Minimisation: We commit to collecting and processing only the personal data strictly necessary for the intended purpose and to keeping it regularly updated.
  • Data Protection by Design and by Default: When developing, designing, configuring, and using applications, services, and products that involve personal data processing, we take your data protection rights into account. We also ensure that our partners comply with legal requirements and effectively protect the personal data they process.
  • Personal Data Security: We have implemented technical and organisational measures appropriate to the sensitivity of the personal data collected, to ensure the integrity and confidentiality of your data and protect it from malicious intrusion, loss, alteration, or unauthorised disclosure. In particular, we use encryption and/or pseudonymisation techniques whenever possible, useful, and/or
  • Commitments from Our Service Providers and Partners: We carefully select our subcontractors, service providers, and partners, and require them to (i) ensure a level of personal data protection equivalent to ours, (ii) use your personal data only to the extent necessary to provide the services we have entrusted to them, and (iii) comply with personal data protection regulations.

4. WHAT DATA DO WE COLLECT?

As the Data Controller, the LEFEBVRE Group collects, accesses, uses, modifies, stores, transmits, and deletes personal data (hereinafter referred to as “Data”) in the course of its activities.

This Data is mostly collected directly from the individuals concerned, particularly when they:

  • Create a personal account on one of the LEFEBVRE Group’s websites, platforms, and/or software;
  • Request information via one of the LEFEBVRE Group’s websites;
  • Place an order on one of the LEFEBVRE Group’s websites or by other means, or subscribe to a free trial;
  • Browse one of the LEFEBVRE Group’s websites and/or view products;
  • Request to be contacted by a LEFEBVRE Group sales representative;
  • Download a white paper from one of the LEFEBVRE Group’s websites;
  • Subscribe to a newsletter;
  • Participate in a game or contest;
  • Attend a trade show or webinar;
  • Contact our services;
  • Leave a review/comment visible on one of the LEFEBVRE Group’s websites;
  • Apply for a job via one of the LEFEBVRE Group’s
  • The types of data collected may include:
  • Identity data;
  • Contact details;
  • Billing and payment information;
  • Details of subscribed services and subscriptions;
  • Contractual relationship history;
  • Copies of correspondence with our sales teams;
  • Survey and questionnaire responses, reviews/comments;
  • Technical browsing information (e.g., IP address);
  • Anonymised case law data;
  • Salary expectations and all data provided in a CV for spontaneous applications or responses to job offers within the LEFEBVRE

5. WHY DO WE COLLECT YOUR PERSONAL DATA?

To help you better understand how your data is processed, the LEFEBVRE Group informs you that your data may be processed for the following purposes:

  • Contract Management:
    • Managing contracts and client accounts;
    • Processing orders and deliveries;
    • Invoicing and debt collection;
    • Managing job applications and recruitment.
  • Customer Relationship Management:
    • Managing customer reviews of products, services, or content;
    • Conducting satisfaction surveys;
    • Managing loyalty programs within one or more legal entities;
    • Selecting clients and users for loyalty, survey, or product testing campaigns.
  • Commercial Prospecting:
    • Selecting individuals for marketing campaigns;
    • Conducting marketing outreach;
    • Updating prospecting databases via the national opt-out list;
    • Organising contests, lotteries, or promotional events.
  • Complaint Management:
    • Handling complaints and after-sales service;
    • Processing requests for access, rectification, objection, or deletion;
    • Managing legal disputes.
  • Business Activity Monitoring:
    • Selecting individuals for studies and/or surveys;
    • Creating commercial statistics;
    • Intelligent data classification.

6. ON WHAT LEGAL GROUNDS DO WE COLLECT YOUR PERSONAL DATA?

The LEFEBVRE Group collects and processes your personal data in compliance with applicable regulations and only under the following legal bases:

  • When necessary for the performance of a contract;
  • When necessary to comply with legal obligations;
  • When you have expressly consented to the processing of your data;
  • When necessary to protect our legitimate

7. WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?

Your personal data is shared with various entities we work with to provide the services offered, after ensuring they comply with data processing and security obligations.

Data may be shared with:

  • All companies within the LEFEBVRE Group and those in which the Group holds a stake or partnership;
  • Third-party service providers, such as subcontractors performing IT services, commercial statistics, direct marketing, IT system providers, hosting services, payroll processors, consultants, and other vendors. This includes those involved in product delivery and logistics.

We only share the data necessary for them to perform the services we entrust to them. These third parties act only on our instructions and are contractually obligated to ensure the same level of data security and confidentiality as we do, and to comply with applicable data protection laws.

  • We share data with our commercial partners only if you have consented to such
  • In certain cases, the LEFEBVRE Group may be required to disclose data in response to a request from a public authority, a subpoena, or any legal request under applicable

8. WHERE IS YOUR PERSONAL DATA TRANSFERRED?

The data collected and processed by the LEFEBVRE Group is hosted within the European Union.

However, your data may be transferred to subcontractors located outside the European Union for the duration necessary for processing. In such cases, the LEFEBVRE Group commits to taking the necessary steps with its subcontractors and partners to ensure an adequate level of data protection, in full compliance with applicable regulations.

If these providers operate in a country not recognised by the European Commission as offering adequate protection, we implement Standard Contractual Clauses approved by the Commission as part of our contractual relationships with these providers.

These transfers occur in the context of operating our IT infrastructure and for certain telesales and external appointment scheduling operations.

In accordance with data protection legislation, the LEFEBVRE Group prohibits the transfer of data without implementing appropriate safeguards under Article 46 of the GDPR, outside of:

  • The European Union,
  • The European Economic Area,
  • Countries recognised by the European Commission as providing an adequate level of

9. HOW LONG IS YOUR DATA RETAINED?

Your data is retained only for the time strictly necessary to fulfill the purposes outlined in this policy and in accordance with applicable laws and regulations. After this period, personal data will be deleted.

  • Client data is retained for the duration of the contractual relationship and may be kept for up to ten (10) years after its end, particularly to meet accounting and tax obligations.
  • Prospect data (individuals) may be retained for up to three (3) years after the last contact from the prospect.
  • Job application data is retained, unless the candidate objects, for a period of two (2) years from the date of submission or last After this period, the data will be deleted.

10. HOW DO WE PROTECT YOUR DATA?

The LEFEBVRE Group continuously implements all appropriate technical and organisational measures to ensure a level of security appropriate to the risks.

LEFEBVRE Group employees are subject to an IT charter annexed to the internal regulations to ensure an appropriate level of security. They are also trained and made aware of data protection and security.

In accordance with Articles 33 and 34 of the GDPR, any data breach will be reported to the French supervisory authority (CNIL) and, if necessary, to the individuals affected by the breach.

INFORMATION FOR INDIVIDUALS

At the time of data collection, the LEFEBVRE Group commits to providing individuals, to the extent possible and regardless of the processing activity, with at least the following information:

  • Contact details of the Data Controller and the Data Protection Officer;
  • The purposes of the processing and its legal basis;
  • The recipients of the data;
  • Any transfers outside the EU, if applicable;
  • The data retention period;
  • The possibility to exercise rights under applicable regulations;
  • The right to lodge a complaint with the supervisory

The LEFEBVRE Group may also receive personal data from third-party sources such as lead providers. Such data is used solely to:

  • Update, enrich, or correct inaccurate data and analyse the client/prospect database;
  • Identify new prospects;
  • Provide information about relevant products and

11. HOW TO EXERCISE YOUR RIGHTS?

In accordance with the General Data Protection Regulation 2016/679 of April 27, 2016, each individual has the right to access, rectify, delete, and port their personal data, as well as the right to restrict or object to its processing.

These rights can be exercised by contacting us at: droitsrgpd@lefebvre-sarrut.eu

When exercising your rights, you must provide proof of identity by any means. However, if there are reasonable doubts about your identity, the LEFEBVRE Group may request additional information, such as a copy of your ID.

Individuals also have the right to lodge a complaint with the CNIL.

Additionally, under Law No. 2016-1321 of October 7, 2016, individuals may organise the handling of their data after death. For more information: https://www.cnil.fr

12. WHERE TO WRITE FOR MORE INFORMATION?

For any questions regarding this policy, you can contact us by email at:

dpo_office@lefebvre-sarrut.eu

Cookie Management Policy of LEFEBVRE Group

INFORMATION ABOUT COOKIES

  • When you visit our websites and/or applications, “cookies” or “trackers” may be placed and stored on your device. This document helps you better understand how cookies work and how to manage them.
  • Personal data collected through cookies is processed by the LEFEBVRE Group with your consent or under the legitimate interest of the data controller (for trackers legally exempt from consent), for the purposes described below. Your data may be shared with LEFEBVRE Group entities, external service providers responsible for processing, or authorised third parties in response to legal requests or with your consent.
  • The maximum lifespan of cookies or trackers is 13 months. Data collected through them may be retained for up to 25 months.
  • Your data may be transferred to countries outside the European Union for the purposes detailed below. These transfers are subject to legal safeguards and specific security measures to ensure an adequate level of protection.

WHAT IS A COOKIE?

  • A cookie is a small text file placed on a device when visiting a website or application. The LEFEBVRE Group uses cookies to:
  • Provide a tailored browsing experience by adapting content and display to your device;
  • Remember information entered in forms or related to products/services;
  • Personalise content and ads based on your interests;
  • Generate statistics and audience measurements for site traffic;
  • Enable social media sharing;
  • Optimise the delivery and assess the effectiveness of advertising messages sent by the Group.
  • We use the DIDOMI cookie manager, which provides a Consent Management Platform (CMP) on our websites. This CMP allows you to view all cookies we use and to consent to or refuse, at any time, all or part of the cookies that are not essential to the functioning of the sites.
  • Some cookies are strictly necessary for our websites to function. According to the French Data Protection Authority (CNIL), these essential cookies are exempt from requiring your consent.
  • You can accept or refuse other cookies using the CMP mechanism available at the bottom of each page on our websites.
  • To learn more about the privacy policy of our cookie manager, you can consult it here: Didomi Privacy Policy.

WHY DO WE USE COOKIES?

This section outlines the categories of cookies most commonly used on our websites.

TECHNICAL COOKIES (NECESSARY)

Technical cookies allow the LEFEBVRE Group to monitor the technical performance of its websites, detect issues to minimise disruptions, enable and support security features, and help detect malicious activity or violations of terms of use. Examples of commonly used technical cookies: Cookies

  • ADRUM
  • ADRUM_BT1
  • ADRUM_Bta
  • ADRUM_BTs
  • AWSALB
  • AWSALBCORS
  • ASP.NET_SessionId
  • dzelserveur
  • ELS_NETSCALER
  • ELSSERVER
  • navId
  • http_referer
  • JSESSIONID
  • SameSite
  • private_content_version
  • isInternal
FUNCTIONAL COOKIES (NECESSARY)

Functional cookies are essential for the operation of the website or for fulfilling contractual obligations. They allow authentication data to be remembered on a site and enhance your user experience.These cookies are indispensable for the proper functioning of the LEFEBVRE Group’s websites and for your navigation on them. They enable you to use the main features of the sites, secure your connection, and access restricted areas directly using identifiers or stored data.Examples of commonly used functional cookies include: Cookies :

  • didomi_token
  • euconsent-v2
  • form_key
  • mage-banners-cache-storage
  • mage-cache-sessid
  • mage-cache-storage
  • mage-cache-storage-section-invalidation
  • mage-messages
  • PHPSESSID
  • STUID
  • X-Magento-Vary
  • private_content_version
  • PHPSESSID
  • CONSENTMGR
  • utag_main
  • cf_bm
  • iadvize-XXXX-vuid
PERSONALISATION COOKIES (OPTIONAL)

Personalisation cookies help optimise the performance of the LEFEBVRE SARRUT Group’s websites. They also allow the presentation of these websites to be adapted to the display preferences of the device you are using during your visit. These cookies provide a smooth and tailored browsing experience. While browsing the LEFEBVRE Group’s commercial websites, personalisation cookies may be used to enhance your visit and shopping experience. These cookies enable the Group to offer personalised support and assistance while using its services-for example, by inviting you to interact with them. If you refuse the use of these cookies, you will not be able to benefit from the features described above. Examples of commonly used user experience personalisation cookies include: Cookies :

  • product_data_storage
  • recently_compared_product
  • recently_compared_product_previous
  • recently_viewed_product
  • recently_viewed_product_previous
  • section_data_ids
  • product_data_storage
  • recently_compared_product_previous
  • kameleoonVisitorCode
  • ownpage_fp2
  • t2s-analytics
  • t2s-p
  • t2s-rank
AUDIENCE MEASUREMENT AND STATISTICS COOKIES (OPTIONAL)

Audience measurement and statistics cookies help us understand how our websites are used and how they perform. They allow us to generate statistics, track traffic volumes, and analyse the use of various elements (such as visited content and user journeys) to improve the relevance and usability of the services offered (e.g., most visited pages or sections, most read articles). These cookies also help measure website traffic. Consent is required for these cookies, except in cases exempted by the CNIL (French Data Protection Authority). Refusing or deleting these cookies does not affect your ability to browse the websites, but it may prevent the LEFEBVRE Group from improving the quality of services offered on the sites. Some clients request access to statistics related to their users in order to monitor usage levels of the websites. These statistics are always anonymised. Examples of commonly used audience measurement and statistics cookies include: Cookies :

  • _clck
  • _clsk
  • atidvisitor
  • atuserid
  • xtantXXXXXX
  • xtanXXXXXX
  • xtvrn
  • _ga_
  • _gat_UA-XXXXXXXX-X
  • _gid
  • _hjAbsoluteSessionInProgress
  • _hjFirstSeen
  • _hjIncludedInPageviewSample
  • _hjIncludedInSessionSample
  • _hjSession_XXXXXXX
  • _hjSessionUser_XXXXXXX
ADVERTISING COOKIES (OPTIONAL)

While browsing any page of its websites, the LEFEBVRE Group may process browsing data and/or use advertising cookies to display ads tailored to your interests. These ads may appear on LEFEBVRE Group websites as well as on other websites you visit. These cookies also help limit the number of times you see an ad and allow the Group to evaluate the effectiveness of its advertising campaigns. You have the option to consent or not to the collection of these cookies. Refusing advertising cookies does not affect your ability to use the LEFEBVRE Group’s websites. Examples of commonly used advertising cookies include: Cookies :

  • _uetsid
  • IDE
  • _fbp
  • _tt_enable_cookie
  • _ttp
  • _gcl_au
  • visiblee_e
SOCIAL MEDIA COOKIES (OPTIONAL)

The LEFEBVRE Group’s websites may include social media buttons or modules that allow visitors to share content from the Group’s websites with others or to express their views about content on the sites. When you use these sharing buttons, a third-party cookie from the social network is installed. If you are logged into the social network while browsing the sites, the sharing buttons can link the viewed content to your user account. You may choose not to consent to the transmission of your cookies to third parties. We encourage you to consult the privacy policies of these social networks to understand the purposes- particularly advertising-related-of the browsing information they may collect through these application buttons, as well as the lifespan of the associated cookies. Examples of the most common third-party cookie transfers include: Cookies :

  • Facebook Social Plugins

COOKIE SETTINGS

You can change your cookie preferences at any time by clicking on “Cookie Settings”, available in the banner at the bottom of the website pages.

You can also configure your browser settings regarding cookies:

  • Google Chrome: https://support.google.com/chrome/answer/95647?hl=fr
  • Safari: https://support.apple.com/fr-fr/guide/safari/sfri11471/mac
  • Firefox: https://support.mozilla.org/fr/kb/protection-renforcee-contre-pistage-firefox-ordinateur
  • Microsoft Edge:
    • French version : https://support.microsoft.com/fr-fr/windows/g%C3%A9rer-les-cookies- dans-microsoft-edge-afficher-autoriser-bloquer-supprimer-et-utiliser-168dab11-0753-043d- 7c16-ede5947fc64d
    • English version : https://support.microsoft.com/en-us/windows/manage-cookies-in- microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d
  • Other browsers: Please refer to your browser’s help section or visit the website of its publisher.

13. Annex A – List of LEFEBVRE Group Subsidiaries – FRANCE

Company Name Registered Office Address Legal Information
EDITIONS DALLOZ Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SAS with a capital of €3,956,040, RCS Paris 572 195 550
EDITIONS LEGISLATIVES Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SAS with a capital of €1,920,000, RCS Nanterre 732 011 408
SOCIETE DES EDITIONS FRANCIS LEFEBVRE Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SAS with a capital of €241,608, RCS Nanterre 414 740 852
LEFEBVRE DALLOZ LOGICIELS Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SARL with a capital of €988,000, RCS Nanterre 793 177 890
LEFEBVRE DALLOZ SERVICES Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SAS with a capital of €500,000, RCS Nanterre 509 620 290
LEFEBVRE DALLOZ EDUCATION Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SARL with a capital of €100,000, RCS Paris 805 091 139
LEFEBVRE DALLOZ COMPETENCES Tour Lefebvre Dalloz 10 Place des Vosges 92400 Courbevoie SAS with a capital of €1,000,000, RCS Paris 479 163 131

LOCAL PRIVACY POLICIES