GUSTAVE is a sole proprietorship with limited liability (entreprise unipersonnelle à responsabilité limitée), with a share capital of 1,000 euros, registered with the Montpellier Trade and Companies Register under number 942 785 122, having its registered office at GUSTAVE, 7236 Rue Waverly, Montréal, QC, H2R 0C2, Office 212 (hereinafter “GUSTAVE”).
This data protection policy (hereinafter the “Policy”) informs you about how GUSTAVE processes your personal data within the scope of its
activities, particularly regarding the management of its client files, prospects, job applicants, and users of its website accessible at: https://gustave.legal/ (hereinafter the “Site”).
GUSTAVE understands the importance of protecting minors’ privacy. The Site and services are not designed for or directed at minors aged 15 or under. This Policy is not intended to intentionally collect or retain personal data from
minors.
The terms “data controller”, “joint controller”, “processor”, “data subject”, “personal data”, “processing”, “personal data breach”, and “Member State” have the same meaning as defined in European
Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), and derived terms shall be interpreted accordingly.
1. Data Controller
GUSTAVE is the controller for the processing of your personal data.
For any questions, you may contact GUSTAVE by:
- Email: [email protected]
- Mail: GUSTAVE, 7236 Rue Waverly, Montréal, QC, H2R 0C2, Office 212
GUSTAVE processes the following personal data:
- For managing inquiries, appointment requests, and quotes, the collection of the following personal data is mandatory: first name, last name, email address or phone number, employer, and job title.
Without this information, GUSTAVE will be unable to respond to your inquiry, appointment request, or quote request. Providing this personal data is a contractual requirement. - For contract execution and client relationship management, the collection of the following personal data is mandatory: first name, last name, email address or phone number, and any information or document necessary for managing the matter entrusted to GUSTAVE, including defending your interests.
Without this information, GUSTAVE cannot execute contracts or manage the client relationship. Providing this personal data is a contractual requirement. - For managing job applications, the collection of the following personal data is mandatory: name, email address or phone number, LinkedIn profile, curriculum vitae, education, professional experience, skills, information related to the position applied for, and desired role.
Without this information, GUSTAVE will be unable to respond to your application. Providing this personal data is a contractual requirement. - For managing newsletters and information messages regarding GUSTAVE’s activity, the collection of your email address is mandatory.
Without this information, GUSTAVE will not be able to send you newsletters and/or information messages about its activities. Providing this personal data is a regulatory requirement. - For managing events organized by GUSTAVE, the collection of the following personal data is mandatory: first name, last name, company/organization name, and email or postal contact details.
Without this information, GUSTAVE will be unable to send you invitations to events it organizes. Providing this personal data is a regulatory requirement. - To exercise your rights enumerated in Section 4 of the Policy, GUSTAVE may request information or proof of identity documents, or additional information regarding the nature of your requests.
Without this information or documents, GUSTAVE will not be able to fulfill your rights request. Providing this personal data is a regulatory requirement.
Finally, in accordance with Article 9 of the GDPR, when necessary for the establishment, exercise, or defense of legal claims, or whenever courts act in their judicial capacity, GUSTAVE may process personal data considered sensitive, such as data concerning your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning health or sex life.
3. Purposes and Legal Bases for Processing Your Personal Data
Your personal data processed by GUSTAVE pursues explicit, specified, and legitimate purposes and is based on a valid legal ground (legal basis).
| Purposes | Legal Bases |
| Management of your inquiries, appointment requests, and quotes | Performance of pre-contractual measures taken at your request |
| Management of contracts concluded with GUSTAVE and client relationships | Performance of a contract to which you or your organization are party (performing services in accordance with contractual obligations and establishing necessary elements for the proper organization of GUSTAVE’s missions) |
| Management of your job applications at GUSTAVE | Performance of pre-contractual measures taken at your request |
| Management of newsletters, information messages regarding GUSTAVE’s activity, and events organized by GUSTAVE | GUSTAVE’s legitimate interest (promotion of its activities) or consent depending on the subject of prospecting (related to your professional activity and likely to interest you) |
| Management of complaints, pre-litigation, and litigation | GUSTAVE’s legitimate interest (defending its rights and interests) or compliance with its legal, regulatory, or ethical obligations, as applicable |
| General accounting management of GUSTAVE | Compliance with GUSTAVE’s legal obligations |
| Management of the exercise of your rights | Compliance with GUSTAVE’s legal obligations |
| Management of the proper functioning, maintenance, and improvement of the Site Adapting Site content for a more personalized experience, and improving your experience on our Site | GUSTAVE’s legitimate interest in personalizing the online user experience, improving Site performance and usability, conducting and measuring marketing efficiency, or your consent to cookie usage when required (collected via cookie banner) |
4. Your Rights
Under the conditions defined in Articles 15 et seq. of the GDPR, you have the following rights:
- Right of access: right to obtain confirmation as to whether your personal data is or is not being processed, and, where applicable, the right to obtain a copy of your personal data as well as several items of information regarding the processing carried out by GUSTAVE;
- Right to rectification: right to request GUSTAVE to rectify or complete your personal data, as applicable, if it is inaccurate, incomplete, ambiguous, or out of date;
- Right to erasure or “right to be forgotten”: right to obtain the erasure of your personal data under certain conditions;
- Right to restriction of processing: right to obtain the restriction of processing under certain conditions;
- Right to object: right to object, on grounds relating to your particular situation, to the processing of your personal data;
- Right to object to direct marketing: right to object to the processing of your personal data for direct marketing purposes;
- Right not to be subject to automated individual decision-making: right not to be subject to a decision based solely on automated processing producing legal effects concerning you or similarly significantly affecting you;
- Right to data portability: right to receive the personal data you provided to GUSTAVE in a structured, commonly used, and machine-readable format, and/or request GUSTAVE to transmit that data to another controller, when processing is based on consent or a contract and is carried out by automated means;
- Right to withdraw consent: right to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal;
- Right to define post-mortem directives: right to define, modify, and revoke at any time specific directives regarding the retention, erasure, and communication of your personal data after your death. These specific directives will only concern processing implemented by GUSTAVE and will be limited solely to this scope;
- Right to lodge a complaint with a supervisory authority: right to lodge a complaint with the competent supervisory authority, which in France is the Commission Nationale de l’Informatique et des Libertés (CNIL), and to seek a judicial remedy before competent courts if you consider that the processing of your personal data by GUSTAVE constitutes a violation of applicable laws.
The existence or non-existence of these various rights depends notably on the legal basis of the processing concerned by the request. These rights are not unlimited, and in certain cases, GUSTAVE may refuse your request (for instance, for compelling legitimate grounds regarding the right to object).
You can exercise your rights by writing to the following email address: [email protected] or to the following postal address: GUSTAVE, 7236 Rue Waverly, Montréal, QC, H2R 0C2, Office 212.
In case of reasonable doubt on GUSTAVE’s part regarding your identity, GUSTAVE may request additional information or documents in order to verify your identity.
To respond to you, GUSTAVE will have a period of one (1) month from receipt of your request, which may be extended by two (2) months in cases of numerous simultaneous or concurrent requests within the allotted timeframe and/or substantial or formal complexity relating to said request.
5. Retention Period of Your Personal Data
GUSTAVE ensures that your personal data is retained only for the duration necessary for the purposes for which it is processed, according to the following data retention policy:
| Personal Data Concerned | Retention Period |
| Data used within the scope of contracts concluded with GUSTAVE | During the period during which GUSTAVE’s liability may be incurred (taking into account any interruptions or suspensions of civil or criminal statutory limitation periods) |
| Data relating to your job application at GUSTAVE | In case of an unsuccessful application, 2 years from the last contact In case of a successful application, for the duration of the contractual relationship and until the expiration of legal limitation and retention periods |
| Data required to satisfy GUSTAVE’s accounting obligations | 10 years from the close of the relevant financial year |
| Data linked to directives concerning the fate of your data after death | For as long as the data concerned by the directives is retained |
| Data relating to the exercise of access, rectification, or erasure rights | 5 years from the conclusion of the procedure related to your request |
| Data relating to the exercise of a right to object | 6 years from the conclusion of the procedure related to your request |
| Data relating to the exercise of a right to restriction of processing | 5 years from the termination of the processing restriction |
| Data used for GUSTAVE’s commercial prospecting (newsletters, information messages regarding GUSTAVE’s activity, and events organized by GUSTAVE) | 3 years from the last contact initiated by you |
| Data used to respond to various inquiries, appointment requests, or quote requests (in the event no file is entrusted to GUSTAVE following these requests) | 3 years from collection |
At the end of the periods listed above, your data will be subject to deletion or anonymization (a process making it impossible to identify a person from a dataset).
6. Recipients of Your Personal Data
Personal data is intended strictly for authorized personnel of GUSTAVE.
GUSTAVE may also communicate your personal data to:
- The GUSTAVE INC. agency in Montreal (Canada);
- Its service providers (collaborating attorneys of GUSTAVE);
- Its subcontractors (marketing providers, software publishers used by GUSTAVE to provide its services, Site host, IT service providers operating system support and maintenance, PSPs, insurers, recruitment agencies);
- Debt collection agencies, accounting firms, and statutory auditors (for GUSTAVE’s needs);
- Persons with whom GUSTAVE collaborates within the framework of files entrusted to GUSTAVE by you (lawyers, judicial officers/bailiffs, notaries, experts, translators, consultants, brokers, auditors), judicial, administrative, financial authorities, public bodies, Lawyers’ Pecuniary Payment Fund (CARPA), regulatory authorities, mediators, arbitrators, and more broadly, any party whose involvement is relevant to the files.
7. Storage Location of Your Personal Data
Your personal data is stored on secure servers located in France.
Certain recipients of your personal data mentioned above may reside in a country whose laws and regulations do not provide the same level of protection for personal data as the GDPR.
In these situations, GUSTAVE ensures that the protection measures implemented to safeguard your personal data comply with applicable legal obligations and will put in place appropriate safeguards to secure the data transfer.
8. Security of Your Personal Data
GUSTAVE implements technical and organizational security measures tailored to the sensitivity of the personal data processing operations it carries out.
These measures include in particular:
- Technical controls to restrict access to personal data strictly to persons who need to know it for any of the aforementioned purposes;
- IT security measures ensuring protection against attacks and failures, including firewalls, encryption, antivirus, antimalware software, and tools aimed at preventing cyberattacks and personal data breaches;
- Physical security measures designed to protect GUSTAVE’s premises, including access badges.
Although GUSTAVE takes all appropriate security measures upon collecting your personal data and throughout any processing of your data, data transmission over the Internet (including by email) is never completely secure.
9. Policy Updates
GUSTAVE may update its Policy, particularly due to legislative and/or regulatory developments. Where your consent is required for the update, GUSTAVE will obtain it.
The latest version of the Policy is the one accessible on the Site. GUSTAVE invites you to regularly consult the Policy on the Site.