Privacy and Cookies Policy
Otherside handles matters in which personal data can be extremely sensitive: political opinions, protection status, alleged offenses. This policy explains what data the firm collects, why, how long it keeps it, who receives it and how you can exercise your rights. It is written for the website otherside.law and for every contact you have with the firm.
Data controller
The data controller is SELARL OTHERSIDE, a French law firm (société d’exercice libéral à responsabilité limitée) registered with the Marseille Trade and Companies Register under number 994 488 617, with its registered office at 66D rue Sainte, 13001 Marseille, France. The firm is represented by Charlie Magri, avocat admitted to the Marseille Bar.
For any question about this policy or about your data, write to contact@otherside.law.
Professional secrecy
As a French avocat, Charlie Magri is bound by professional secrecy (secret professionnel), which covers the information you entrust to the firm in connection with a matter, including before any engagement. This duty applies in addition to the data protection rules described below and is not limited in time.
What data the firm collects, and when
When you browse the website
Technical data needed to display the site securely (IP address, browser type, pages requested), your cookie choices and, only if you accept statistics cookies, audience measurement data. See Cookies.
When you use the contact form
Your name, email address, the service you need, your message and any documents you attach (judicial decisions, warrants, notices, correspondence), including any information you choose to share about your situation. Your message and any documents you attach are sent to the firm’s mailbox. They are not kept on the website: the message is not recorded in its database, and attached files are deleted from the server once the email has been sent. The form is protected against spam by Google reCAPTCHA.
When you use the INTERPOL Notice Removal Check
Your answers to the questionnaire, and, if you ask for the report, your name and email address. The tool has its own section below, because the answers can reveal sensitive data. See INTERPOL Notice Removal Check.
When you write to the firm or become a client
Your identification and contact details, the documents and information you provide about your matter, identity documents required to identify clients, and billing information. In a matter before the Commission for the Control of INTERPOL’s Files (CCF), this includes the data held about you in INTERPOL’s files and the documents relating to the proceedings concerned.
Your name and email address are needed for the firm to reply to you. Identity documents and billing details are required to open a client file; without them, the firm cannot act for you.
If you give the firm information about another person (for example a relative, or a client you represent), please share only what is needed. Where required, the firm informs these persons itself, unless professional secrecy prevents it (Article 14(5)(d) GDPR).
If you apply for a position or an internship, the firm processes your application and the documents you send with it.
The website is not intended for children. Information about a minor, for example a child subject to a Yellow Notice, should be provided by a parent or legal representative.
INTERPOL Notice Removal Check
The INTERPOL Notice Removal Check is a free questionnaire that points to the legal grounds and procedural points that may be worth examining in a request before the CCF.
Your answers on screen
- What is processed. Your answers: the type of INTERPOL data, the countries concerned, your country of residence (you may decline to give it), your profile and protection status, the nature of the case and the penalty, the proceedings, including any arrest or extradition, any fair trial concerns and any prior CCF filing.
- How. The answers are sent securely to the firm’s server to calculate your results and, if you ask for it, to prepare your report. They are not linked to your name or email address, are not recorded in the website’s database and are discarded once the results are calculated. While you answer, they are kept in your own browser for the session, so that you do not lose your progress, and are erased from it once the results are shown.
- No identity needed on screen. The summary of your results is shown without your name or email address. These are asked for only if you want the full report by email.
- Legal basis. Your request to use the tool (Article 6(1)(b) GDPR).
- Automatic results. The results are produced automatically from your answers. They are not a decision about you and have no legal effect: they only point to rules and decisions worth examining, and no advice is given without a review of your matter by a lawyer.
The report sent by email
- What is processed. Your name, your email address and your answers.
- Why. To send you the full report and, if you ask for it, to handle a request for a confidential review. Your name and email address are needed to send the report; without them, you only see the summary of your results on screen.
- Legal basis. Your consent, which you give by ticking two separate boxes, the second being your explicit consent to the processing of sensitive data (Article 9(2)(a) GDPR). You can withdraw it at any time by writing to contact@otherside.law; the firm then deletes its copy.
- Retention. The report is sent from the firm’s mailbox, and a copy is kept there for 12 months from sending or, if you request a review, from your last contact, to handle any review request, then deleted. If you then instruct the firm, your data is kept under the rules for client files.
Spam protection and abuse prevention
The report form uses Google reCAPTCHA, and the tool limits how many results and reports can be requested from the same connection or email address. For these limits, a scrambled (hashed) form of your IP address and, for reports, of your email address is kept on the server for at most 24 hours. The legal basis is the firm’s legitimate interest in protecting the tool and its users from abuse.
The report is not legal advice, and receiving it does not make Otherside your lawyer: no lawyer-client relationship exists until an engagement letter is signed. Otherside does not send marketing messages to people who use the tool. If your safety is at stake, use an email address that only you can access.
Sensitive data and data relating to offenses
The firm’s work may involve data that the GDPR protects more strictly: data revealing political opinions, religious beliefs or ethnic origin, information on refugee or asylum status, which may reveal such data, and data relating to alleged offenses, criminal proceedings and convictions.
- Political opinions, beliefs, ethnic origin and similar data. In the Notice Removal Check report and when you use the contact form, they are processed on the basis of your explicit consent (Article 9(2)(a) GDPR). When you write to the firm directly, they are processed because this is necessary to assess and prepare your legal claims (Article 9(2)(f) GDPR). In a matter the firm handles for you, they are processed because they are necessary for the establishment, exercise or defense of legal claims (Article 9(2)(f) GDPR).
- Data relating to offenses, proceedings and convictions. In every case, including the report, the contact form and your first contacts, they are processed by the firm as an auxiliaire de justice (a legal professional the law entrusts with advising and defending clients), strictly for the needs of its mission of advising and defending you (Article 10 GDPR and Article 46 of the French Data Protection Act).
- On screen, the answers used to calculate your results are not linked to your name or email address and are not stored.
Access to these data is limited to the persons working on your matter, and they are covered by professional secrecy.
Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Notice Removal Check: calculating your results | Your request to use the tool (Article 6(1)(b) GDPR). The answers are not linked to your name or email address and are not stored | Not stored in the website’s database. Kept in your browser tab (session storage) until the results are shown or you close the tab |
| Notice Removal Check: sending the report and handling a review request | Consent, including explicit consent for sensitive data (Articles 6(1)(a) and 9(2)(a) GDPR) | 12 months from sending, or from your last contact if you request a review, then deleted, unless you instruct the firm |
| Protecting the site and the tool against spam and abuse | Legitimate interest (Article 6(1)(f) GDPR) | Rate limit records: 24 hours at most. Server logs: as set by the host, for security only |
| Contact requests and appointments | Steps taken at your request before an engagement (Article 6(1)(b) GDPR) and, for sensitive data, your explicit consent given in the contact form | 12 months from your last contact if no engagement follows, then deleted, for your message, contact details and any documents you attach |
| Handling your matter and the client relationship | Performance of the engagement letter (Article 6(1)(b) GDPR) and the establishment, exercise or defense of legal claims (Article 9(2)(f)) | For the duration of the engagement, then 5 years from its end in archives |
| Client identification checks | Legal obligation under the Bar’s professional rules and, where it applies, anti-money laundering law (Article 6(1)(c) GDPR) | 5 years from the end of the business relationship |
| Billing and accounting | Legal obligation (Article 6(1)(c) GDPR) | 10 years for accounting documents |
| Job and internship applications | Steps taken at your request (Article 6(1)(b) GDPR) | 2 years from the last contact, unless you ask for earlier deletion |
| Audience measurement | Consent given through the cookie banner (Article 6(1)(a) GDPR) | Cookies: 13 months at most. Detailed data in Google Analytics: 14 months at most. Aggregated statistics that do not identify you may be kept longer |
| Handling requests to exercise your rights | Legal obligation (Article 6(1)(c) GDPR) | For the time needed to answer the request and to prove that it was answered. Identity documents are deleted once the request is handled |
Once these periods end, data are deleted or anonymized. Anonymised data may be kept for statistics.
Who receives your data
What you send through the website stays with the firm. The firm does not pass your answers to the Notice Removal Check, your report or your messages to INTERPOL, the CCF, the country that requested the data or any other authority, unless you instruct the firm to file a request for you or the law requires it, within the limits of professional secrecy. The firm does not sell your data and does not share it for marketing.
When you use the website
The following technical providers are involved, each limited to what it needs to run the website:
| Provider | Role | Location |
|---|---|---|
| Website host | Hosting of the website and of the Notice Removal Check server | European Union |
| OVHcloud | Email service: the firm’s mailbox, including the reports sent by the tool and the copies kept | France |
| Google Ireland Limited and Google LLC (reCAPTCHA) | Spam protection on the contact form and the report form | European Union and United States |
| Google Ireland Limited and Google LLC (Tag Manager and Analytics) | Audience measurement, only if you accept statistics cookies | European Union and United States |
| CookieYes | Recording of your cookie choices | United Kingdom |
| Weglot | Translation of the website (French, Spanish, Italian, Russian, Ukrainian, Arabic and Chinese). Weglot translates the text displayed on the pages, not what you type into the forms or the Notice Removal Check, and receives technical connection data, such as your IP address, when its script loads in your browser | France |
These providers act on the firm’s instructions. For reCAPTCHA, however, Google also uses the data under its own privacy policy and terms of service.
For calls and engagements
If you have a video call or sign an engagement letter, two more providers are involved: Zoom, for video calls, and DocuSign, for the electronic signature of the engagement letter. For clients, the firm’s chartered accountant and its professional liability insurer may also receive what they need, and, in a fee dispute, the Bâtonnier of the Marseille Bar.
Only at your request
Beyond these providers, the firm shares what is needed, and nothing more, only in the following cases:
- The CCF, once you have signed an engagement letter, when the firm files the request you have approved. Under its own rules, the Commission may consult the country that recorded the data about the request; the firm discusses with you beforehand what is filed and what may be disclosed.
- Co-counsel working with the firm on your matter, once you have signed an engagement letter and with your agreement.
- An interpreter or a translator, when you ask for one, including for an introductory call before any engagement.
Co-counsel, interpreters and translators are bound by a duty of confidentiality. Professional secrecy protects what you entrust to the firm. Data are disclosed outside these cases only where the law strictly requires it, within the limits of that secrecy.
Transfers outside the EU and to international organizations
The website and the firm’s mailbox are hosted in the European Union. Some data leave it in the following cases:
- Google (reCAPTCHA and, if you accept statistics cookies, Analytics), Zoom and DocuSign may process data in the United States. These companies are certified under the EU-US Data Privacy Framework. The European Commission recognizes that framework as ensuring adequate protection, and these companies also rely on the European Commission’s standard contractual clauses.
- CookieYes is based in the United Kingdom, which benefits from an adequacy decision of the European Commission.
- INTERPOL and the CCF. Only if you instruct the firm to file a request: the request is sent to INTERPOL, an international organization based in Lyon, France, which applies its own data protection rules (the Rules on the Processing of Data and the CCF Statute). This transfer relies on Article 49(1)(e) GDPR, as it is necessary for the establishment, exercise or defense of your legal claims.
- Co-counsel abroad. Only in a matter you have instructed the firm to handle, and with your agreement, where a lawyer in another country works on it with the firm. Where that country has no adequacy decision, the transfer relies on the European Commission’s standard contractual clauses or on Article 49(1)(e) GDPR.
Security
The firm takes technical and organizational measures suited to the sensitivity of the data it handles, including:
- encrypted connections (HTTPS) across the website;
- for the Notice Removal Check, answers that are not stored in the website’s database, full results sent only by email, spam protection and limits on repeated requests;
- access restricted to the persons working on your request or matter, who are bound by professional secrecy.
No transmission over the internet is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, the firm notifies the CNIL and, where the risk is high, informs you as soon as possible.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive the data you provided in a structured and machine-readable format where the processing is based on your consent or a contract, and to object to processing based on the firm’s legitimate interest. Where processing is based on your consent, you can withdraw it at any time; this does not affect what was done before. You can also give general or specific instructions on what should happen to your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, write to:
- Email: contact@otherside.law
- Contact form: otherside.law/contact
- Post: Otherside, Charlie Magri, 66D rue Sainte, 13001 Marseille, France
The firm answers within one month, which may be extended by two months for complex requests. Where there is reasonable doubt about your identity, it may ask for information to confirm it. Some rights are limited by professional secrecy or by the firm’s legal obligations; if so, you will be told why.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL online (cnil.fr) or by post (CNIL, Service des plaintes, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the data protection authority of your country of residence in the European Union.
Changes to this policy
The firm may update this policy, in particular when it changes its services or providers. The date of the latest version is shown at the top of this page.