Privacy Policy
Last updated: August 2026
1. Data controller
The controller of the personal data collected through Kortlex is:
Etienne ORLEANSKI
Sole trader
58 rue de Monceau - CS 48756 - 75008 Paris, France
SIRET: 945 094 779 RCS Paris
Contact: through the contact form available on the site.
Kortlex undertakes to comply with the General Data Protection Regulation (GDPR) and with the French Data Protection Act. Given its size and the nature of its activities, Kortlex is not required to appoint a data protection officer and has not appointed one: requests are handled directly by the controller.
Kortlex makes no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The monitoring content you are shown depends on the searches you save yourself: this is personalisation that you control, not profiling.
2. Processing activities
Each processing activity carried out by Kortlex has its own expandable entry below: purposes, data subjects, source of the data, data concerned, retention period, legal basis and processors. This part therefore serves as a record of processing activities as much as an information notice. An overview of recipients and of transfers outside the European Union is given in section 3.
Unless stated otherwise, providing your data is optional; only your email address and, for paid subscriptions, billing information are required: without them, an account cannot be created and the subscription contract cannot be performed.
2.1 For all users
Site and account administration, preventive maintenance
- Purposes
- Managing and administering the Kortlex site
- Creating and managing user accounts
- Preventive maintenance of the platform
- Data subjects
- Anyone registered on Kortlex
- Source of the data
- The data subjects
- Data concerned
- Email address and what it may reveal, sign-up and last login dates, display language
- Retention period
- Last login + 2 years
- Legal basis
- Performance of the contract
- Processors
- OVH (France)
Onboarding and personalisation of your monitoring
- Purposes
- Setting up your monitoring based on the profile you declare
- Tailoring our communications to your profile
- Data subjects
- Anyone registered who completes onboarding
- Source of the data
- The data subjects
- Data concerned
- Profile declared at sign-up (DPO, consultant, lawyer, student, other) and chosen interests (sectors, regions)
- Retention period
- Lifetime of the account
- Legal basis
- Performance of the contract
- Processors
- OVH (France), Brevo (France)
Personalised monitoring and email alerts
- Purposes
- Saving your searches and their filters
- Building your personalised monitoring feed
- Sending the email alerts you enable
- Data subjects
- Anyone registered who saves a search
- Source of the data
- The data subjects
- Data concerned
- Label, query and filters of your saved searches, chosen frequency, whether alerts are enabled, date of the last send
- Retention period
- Until the search or the account is deleted
- Legal basis
- Performance of the contract; consent for sending alerts (enabled per search, and can be switched off at any time, including globally from your account)
- Processors
- OVH (France), Brevo (France)
Workspaces, bookmarks and notes
- Purposes
- Filing the documents you set aside
- Sharing workspaces within your team
- Data subjects
- Anyone registered who files a document; the members of their organisation for shared workspaces
- Source of the data
- The data subjects
- Data concerned
- Documents filed in your workspaces, labels, personal notes and comments shared with your team
- Retention period
- Until the workspace or the account is deleted, subject to contributions made to a shared workspace (see below)
- Legal basis
- Performance of the contract
- Processors
- OVH (France)
When you add a document or a comment to a workspace shared with your team, that contribution belongs to the workspace rather than to your account alone: it is kept after your account is deleted, so that the organisation's collective work is not lost. It is then detached from your identity (your name is no longer attached to it and the contribution appears as that of a former member). Your private workspaces, personal notes and saved searches are, by contrast, deleted along with the account.
Use of the search engine
- Purposes
- Running your searches and returning the results
- Data subjects
- Anyone using the search engine
- Source of the data
- Your browser, which queries the search service directly and in doing so passes on your IP address and the terms of your query
- Data concerned
- IP address, search terms and filters applied
- Retention period
- Not retained: queries are neither logged nor used for statistical purposes
- Legal basis
- Performance of the contract
- Processors
- Search engine self-hosted by Kortlex at OVH (France)
Contact, support and feedback forms
- Purposes
- Collecting requests (contact, information, support, feedback)
- Handling those requests, including corrective maintenance
- Improving the platform
- Data subjects
- Any visitor filling in a form; any subscriber contacting support
- Source of the data
- The data subjects
- Data concerned
- Email address and what it may reveal, content of the message
- Retention period
- 1 year from the last exchange; 3 years for feedback
- Legal basis
- Legitimate interest; performance of the contract for subscriber support
- Processors
- Brevo (France), Proton (Switzerland)
Security - logging of sensitive actions
- Purposes
- Managing the security of the service
- Logging sensitive events (sign-in, password change, member management, billing)
- Data subjects
- Anyone registered who signs in or performs actions on their account
- Source of the data
- Kortlex's information system, when you carry out actions
- Data concerned
- Account identifier, IP address, declared browser (user-agent), timestamp, nature and outcome of the action (success or failure)
- Retention period
- 90 days
- Legal basis
- Legitimate interest
- Processors
- OVH (France)
Security - detection and prevention of malicious activity
- Purposes
- Detecting malicious activity
- Preventing malicious activity
- Data subjects
- Any visitor to the site
- Source of the data
- The device you use to connect to Kortlex
- Data concerned
- Technical logs, IP address, timestamp
- Retention period
- 1 year, unless a permanent block is decided
- Legal basis
- Legitimate interest
- Processors
- OVH (France)
Exercise of GDPR rights
- Purposes
- Collecting requests to exercise rights
- Handling those requests
- Archiving requests for pre-litigation purposes
- Data subjects
- Anyone exercising the rights conferred on them by the GDPR
- Source of the data
- The data subjects and, where applicable, their representatives
- Data concerned
- Identification data needed to handle the request and any data included in it
- Retention period
- 5 years from the last contact (pre-litigation archiving)
- Legal basis
- Legal obligation
- Processors
- Proton (Switzerland)
Customer relationship management (follow-up, renewals, disputes)
- Purposes
- Managing the customer relationship
- Following up subscriptions, renewals and any disputes
- Communicating by email, telephone and video call: platform news, tutorials, demos
- Data subjects
- Anyone registered on Kortlex, or who has been in contact with Kortlex
- Source of the data
- The data subjects
- Data concerned
- Identity and contact details, professional data, subscription and correspondence history
- Retention period
- 3 years from the last contact for prospects; duration of the commercial relationship + 5 years for customers
- Legal basis
- Performance of the contract, legitimate interest
- Processors
- Brevo (France), Proton (Switzerland)
Marketing communications and the "GDPR monitoring" newsletter
- Purposes
- Sending the legal monitoring newsletter
- Informing you about new features and offers
- Measuring the overall open rate
- Data subjects
- Anyone who has signed up to the newsletter or to email communications
- Source of the data
- The data subjects
- Data concerned
- Email address and what it may reveal, overall open rate
- Retention period
- 14 days if the sign-up is not confirmed; otherwise until you unsubscribe, which is possible at any time from every email
- Legal basis
- Consent (voluntary sign-up)
- Processors
- Brevo (France)
Audience measurement and service improvement
- Purposes
- Measuring the site's audience
- Improving the service from aggregated data
- Data subjects
- Any visitor to the site
- Source of the data
- The device you use to connect to Kortlex
- Data concerned
- Pages visited, browser and device type, language, country, traffic source - aggregated data, not linked to an individual identifier. No tracking cookie is used.
- Retention period
- 13 rolling months
- Legal basis
- Legitimate interest
- Processors
- Umami, self-hosted by Kortlex at OVH (France)
2.2 For paying subscribers
Subscription management, collection of payments and invoicing
- Purposes
- Entering into and managing subscriptions (plan, validity, renewal)
- Collecting payments
- Issuing and archiving invoices
- Data subjects
- Kortlex subscribers; in some cases, employees or processors (accountants) of subscribing legal entities
- Source of the data
- The data subjects, or the employer / group manager subscribing on their behalf
- Data concerned
- Identity and contact details, professional data, payment methods (collected and stored by Stripe, never by Kortlex), subscription type and validity
- Retention period
- Duration of the subscription + 10 years from the issue of the invoice
- Legal basis
- Performance of the contract; legal obligation for the retention of invoices
- Processors
- Stripe (United States) - transfer outside the EU, see §3; OVH (France)
Organisations, seats and sub-accounts
- Purposes
- Creation and management of sub-accounts by group managers
- Allocation of seats and roles within the organisation
- Data subjects
- Members of a subscribing organisation and the manager of that group
- Source of the data
- The group manager (your employer), and the data subjects when activating their account
- Data concerned
- Members' email addresses, role within the organisation (owner, manager, member, DPO), link to the organisation
- Retention period
- Until the member is removed by the group manager. Removing a member deletes their Kortlex account and the associated personal data; the same applies when the organisation's subscription ends.
- Legal basis
- Performance of the contract
- Processors
- OVH (France)
Marketing to existing customers
- Purposes
- Informing you about new features and changes to the offering
- Suggesting changes of plan
- Data subjects
- Kortlex subscribers
- Source of the data
- The data subjects
- Data concerned
- Email address, current plan, use of the service
- Retention period
- Duration of the commercial relationship, or until you object
- Legal basis
- Legitimate interest
- Processors
- Brevo (France)
Where a company subscribes on behalf of its staff, it decides itself who is given access and for what purposes: it is the controller for that membership data, with Kortlex acting as a processor for that part. Kortlex remains the controller for the operation of the service itself.
2.3 Data about people who do not use Kortlex
The following activities concern data that we did not collect from you. They concern you if you are named in a decision, a sanction or a news item referenced by Kortlex, or if we have contacted you in a professional capacity.
Legal monitoring content
- Purposes
- Gathering content published by authorities, courts and the press
- Automated processing of that content (formatting, extraction of information, cross-referencing)
- Publishing the content to Kortlex users
- Data subjects
- People named in the decisions, sanctions and news items reproduced; authors of the publications; representatives of the organisations concerned
- Source of the data
- Public websites publishing the information reproduced: supervisory authorities, courts, specialised press
- Data concerned
- Any data appearing in the public document reproduced may be collected. We endeavour to pseudonymise such data before republication, where this can be automated technically.
- Retention period
- Until the draft news item is published or deleted; where the published content contains personal data, 5 years at most, or earlier at your request
- Legal basis
- Legitimate interest: informing data protection professionals about the state of the law and the practice of supervisory authorities
- Processors
- OpenAI (United States) and Google (United States) for automated summarising and qualification - transfers outside the EU, see §3; OVH (France)
Marketing outreach to professionals in the sector
- Purposes
- Marketing outreach to professionals in the sector, including on social media
- Data subjects
- Data protection professionals who may be interested in Kortlex's services
- Source of the data
- Public data available online, in particular on professional social networks
- Data concerned
- Identity and contact details, professional data (employer, role), content of exchanges
- Retention period
- 1 year from the last contact, or earlier at your request
- Legal basis
- Legitimate interest
- Processors
- Brevo (France), Proton (Switzerland)
Management of social media accounts (mainly LinkedIn and X/Twitter)
- Purposes
- Managing Kortlex's social media accounts
- Exchanges with users (outside marketing and outreach)
- Data subjects
- Any user of social media platforms who interacts with Kortlex
- Source of the data
- The data subjects and/or the social media platforms
- Data concerned
- Data made public by you or by third parties, content of exchanges
- Retention period
- Until the account concerned no longer exists, or earlier at your request. Exchanges hosted by the platform follow the retention period it defines, over which Kortlex has no control: at best we can delete the conversation from our own account.
- Legal basis
- Legitimate interest
- Processors
- The social media platforms concerned, each a controller for its own processing
3. Recipients, processors and transfers outside the EU
The only recipients of the processing activities described above are the manager of Kortlex and the processors listed below. No data is sold or disclosed to third parties for advertising purposes.
- OVH (France): hosting of the application, the database, the search engine and the audience measurement tool.
- Proton (Switzerland): email, calendars and video conferencing.
- Brevo (France): CRM, transactional email and marketing communications.
- Stripe (United States): payment and invoicing.
- OpenAI (United States) and Google (United States): automated summarising and qualification of monitoring content (§2.3), excluding any account data.
The database, the search engine and the audience measurement tool are self-hosted by Kortlex on its own infrastructure in France: your account data, your saved searches and your workspaces are not entrusted to any third-party software-as-a-service provider.
Transfers outside the European Union. Switzerland benefits from an adequacy decision of the European Commission. Transfers to Stripe, OpenAI and Google in the United States are covered by those companies' certification under the EU-US Data Privacy Framework and, in addition, by the European Commission's standard contractual clauses. You may obtain a copy of the applicable safeguards by contacting us. In the interest of transparency: we sought to give preference to European providers and did not manage to do so for payments and for the automated processing of content.
4. Cookies and trackers
Kortlex only uses cookies that are strictly necessary for the service to work. They are all set by Kortlex (first party), never by a third party, and most are httpOnly (inaccessible to JavaScript):
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-sb_access_token |
Authentication - keeping the session signed in (access token) | Session lifetime (~1 h) |
__Host-sb_refresh_token |
Authentication - automatic session renewal | 30 days with "Remember me", otherwise session lifetime |
__Host-sb_remember |
Authentication - remembering the "Remember me" choice | 30 days |
__Host-kx_pwreset |
Security - validating a password reset in progress | 15 minutes |
__Host-csrf_token |
Security - protection against CSRF (cross-site request forgery) attacks | 1 year |
lang |
Preference - remembering the display language | 1 year |
The __Host- prefix is a standardised security measure: it guarantees that these
cookies can only be set by the site itself, over an encrypted connection (HTTPS), and never by
another domain or subdomain.
Kortlex also stores your display preferences in your browser's local storage
(localStorage): list or grid mode (view, feedView) and
whether the annotated GDPR table of contents is open (rgpdMenu). This information
never leaves your browser, is never sent to our servers and is erased when you clear the
site's data.
No advertising or third-party tracking cookie is used. No consent is required under the ePrivacy Directive for these strictly necessary and functional cookies and trackers.
For audience measurement, Kortlex uses Umami, an open source analytics tool hosted on our own servers. Umami sets no cookie, does not collect the full IP address and does not combine browsing data with other sources. The data is aggregated and anonymised; it never leaves Kortlex's infrastructure.
5. Your rights
Under the GDPR, you have the following rights:
- Right of access to your personal data and to information about any processing not described on this page;
- Right to rectification of inaccurate data;
- Right to erasure ("right to be forgotten");
- Right to data portability;
- Right to object to processing;
- Right to restriction of processing;
- Right to withdraw your consent at any time where processing is based on it (newsletter, email alerts) - withdrawal does not affect the lawfulness of sends already carried out;
- For French residents: right to give directions as to what happens to your data after your death.
To exercise these rights, contact us through the contact form on the home page, or through the support form if you are signed in. Email alerts and the newsletter can also be switched off directly from your account and from every email you receive.
Exercising a right does not mean it will automatically be granted: whether it applies depends on the legal basis of the processing and on the conditions set out in the regulation. Where relevant, we will explain this to you as transparently as possible. We reply within one month, which may be extended by two months for complex requests, in which case we will tell you.
If you receive no reply within that period, or if you are not satisfied with the reply, you may lodge a complaint with the French supervisory authority, the CNIL.
6. Security
Kortlex implements appropriate technical and organisational measures to protect your data: encryption of communications (HTTPS), secure authentication, restricted access, access logging.
7. Changes to this policy
This policy may be updated. In the event of a substantial change, users will be informed by email. The date of the last update appears at the top of this page.
This is a translation provided for convenience. In the event of any discrepancy, the French version prevails.