Privacy Policy

This policy concerns the askalf.com website only: what happens when you browse our pages, complete a form, or subscribe to our newsletter.

It does not concern the Alf platform. The data our clients place in their subscriber workspace — matters, documents, attachments — falls under an entirely separate processing operation, in which Alf acts not on its own behalf but on its client’s, and which is described in the Platform’s Personal Data Protection Policy and in the contractual schedule attached to it. The website gives access to no matter, hosts no client content, and does not communicate with the platform in any way.

If you are looking for what happens to data held in an Alf matter, this is not the place: write to hello@askalf.com and you will be directed accordingly.

1. Who is responsible

The controller is Alf SAS, a French simplified joint-stock company with a share capital of EUR 8,606.50, whose registered office is at 9 rue des colonnes, 75002 Paris, France, registered with the Paris Trade and Companies Register under number 845 055 102, intra-Community VAT number FR90845055102, represented by Sabine Zylberbogen in her capacity as President.

Alf has not appointed a data protection officer. The single point of contact for any question concerning your data is hello@askalf.com.

Website hosting. The website is hosted within the European Union, on the infrastructure of Amazon Web Services EMEA SARL, Europe (Paris) region.

2. What the website processes, why, and for how long

On IP addresses. An IP address is personal data, including where it is dynamic, where the party holding it has legal means enabling the individual to be identified (CJEU, 19 October 2016, Breyer, C-582/14). We therefore treat it as such, even though we never seek to know who you are.

The legitimate interests we pursue, since Article 13(1)(d) GDPR requires them to be stated: operating the website and protecting it against attacks and abusive use; and making our services known to people whose professional role relates directly to what we sell. You may object to either, on the terms set out in Article 6.

3. Whether providing data is mandatory

No data is required in order to browse the website.

The fields marked as mandatory in our forms are necessary to handle your request: without them, we cannot reply to you. All other fields are optional and leaving them blank has no consequence.

Server logs are generated automatically by the technical operation of the website and do not result from anything you enter.

4. Who receives this data

We do not sell your data. We do not rent it. We do not pass it to anyone for that party’s own marketing purposes.

It is accessible to Alf personnel whose duties justify it, and to the following providers, which act as Alf’s processors:

The complete, up-to-date list of names is published at askalf.com/sous-traitants/, a dated and versioned page.

Alf remains fully liable to you for the performance by these providers of their data protection obligations, in accordance with Article 28(4) GDPR.

We may also be required to disclose data to a judicial or administrative authority, in performance of a legal obligation or an enforceable decision.

5. Transfers outside the European Union

Website hosting is located within the European Union.

Some of our providers belong to groups established in the United States and may, depending on their configuration, access data from there.

The table below sets out, for each of them, the legal basis for the transfer and exactly where the corresponding safeguards are published. You can consult them directly, without having to ask us for them.

Should you nonetheless wish to be sent a copy, write to hello@askalf.com: we will provide it within the time limits set out in Article 6.

One reservation, which we prefer to state. The adequacy decision of 10 July 2023 is the subject of an appeal pending before the Court of Justice of the European Union, registered on 31 October 2025 under number C-703/25 P, and the European Data Protection Board requested its review on 31 July 2026. Should it be suspended, annulled or repealed, Alf would move the transfers concerned onto the standard contractual clauses and would update this policy. As at the date of this version, it remains in force.

6. Your rights

You have, on the terms set out in the GDPR, the following rights:

• access (Art. 15) — to know whether we process data concerning you, and to obtain a copy of it;
• rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed;
• erasure (Art. 17);
• restriction of processing (Art. 18);
• portability (Art. 20) — to receive the data you provided to us in a machine-readable format;
• objection (Art. 21) — to object, on grounds relating to your particular situation, to processing based on our legitimate interest. You may object to commercial prospecting at any time and without giving reasons;
• withdrawal of your consent (Art. 7(3)), at any time, for the newsletter and for trackers, without affecting what was done beforehand.

How to exercise them: write to hello@askalf.com, or by post to Alf SAS, 9 rue des colonnes, 75002 Paris, France.

We reply within one month of receiving your request.

That period may be extended by a further two months, three months in total, taking into account the complexity and number of requests. In that case, we inform you of the extension and of its reasons within the first month.

We ask for proof of identity only where there are reasonable doubts as to your identity, and we destroy it as soon as verification is complete.

7. What happens to your data after your death

In accordance with Article 85 of the French Data Protection Act, you may give directions concerning the retention, erasure and communication of your data after your death — general directions registered with a trusted third party certified by the French Data Protection Authority (Commission nationale de l’informatique et des libertés, “CNIL”), or specific directions sent to us at hello@askalf.com. You may amend or revoke them at any time.

8. Complaints

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL:

• online: https://www.cnil.fr/fr/plaintes
• by post: Commission nationale de l’informatique et des libertés, 3 Place de Fontenoy, 75007 Paris, France

9. Security

Communications with the website are encrypted using the TLS protocol. Our personnel’s access is limited by named authorisations and is subject to a confidentiality undertaking. The website is hosted on certified infrastructure, on the terms described in Article 4 of the Terms of Use.

Alf is not ISO/IEC 27001 certified and does not produce a SOC 2 report. It applies an internal security framework informed by those standards.

10. Amendments to this policy

Each version is dated and numbered. Earlier versions remain available on request at hello@askalf.com. The Schedule on trackers is dated and versioned separately and may be amended without this policy being amended.

11. Language and governing law

This policy is drafted in French; any translation is provided for information only. It is governed by French law.

Schedule — Website trackers and cookies

Version 1.2 — 13 August 2026

A.1 What a tracker is

A tracker is a file or technology allowing information to be written to your device or accessed on it — a cookie, pixel, session identifier or local storage. Article 82 of the French Data Protection Act makes such operations subject to your prior consent, except where the tracker’s exclusive purpose is to enable or facilitate electronic communication, or where it is strictly necessary for the provision of a service you have expressly requested.

A.2 Your consent

Trackers that are not strictly necessary are placed only after your consent.

• Refusing is as simple as accepting: the banner includes a global refusal button at the same level and with the same appearance as the acceptance button.
• You may consent purpose by purpose.
• You may change your choice at any time through the “Manage my cookies” link in the footer.
• Your choice, whatever it is, is retained for 6 months, after which the banner is shown to you again.
• Making no choice does not amount to consent. Continuing to browse does not amount to consent. Closing the banner does not amount to consent.
• If your browser sends the Global Privacy Control signal, it is honoured.

A.3 Trackers placed

The durations and purposes of the HubSpot trackers below are those published by HubSpot in its official documentation. Live chat trackers are placed only where that tool is enabled on the page you are viewing.

[To be confirmed before publication] This table must be confirmed by an audit carried out on the website in production, before and after consent — in particular the existence of a language preference tracker.

Strictly necessary — exempt from consent

Subject to your consent

Audience measurement

Live chat — only where the chat tool is enabled

The hubspotutk and messagesUtk trackers identify the visitor and link a form submission or a conversation to their earlier browsing. They are not necessary for the website to work and are therefore placed only after your consent.

A.4 Audience measurement

The website uses Google Analytics to measure its traffic.

The CNIL considers that Google Analytics does not benefit from the consent exemption available to audience measurement trackers, since that solution reuses the data on its publisher’s own behalf. These trackers are therefore placed only after your consent, and you may refuse them without your browsing being affected.

Placing them involves a transfer of data to the United States, on the terms described in Article 5.

A.5 Advertising and social media trackers

As at the date of this version, the website places no advertising tracker and carries out no retargeting.

Should Alf come to use such trackers — a social media pixel, a conversion measurement tag, a retargeting or advertising personalisation tool — they would be placed only after your consent, obtained on the terms of Article A.2, under a separate category which you will be able to refuse without affecting the others. This Schedule would then be supplemented and its version date changed before any such tracker is placed.

Alf will under no circumstances take part in a real-time advertising auction involving your data, nor pass your data to a third party for that third party’s own advertising purposes.

A.6 Browser settings

You may also configure your browser to refuse trackers. That setting may affect certain features of the website. The procedure varies from browser to browser and is described in the browser’s help menu.

Alf SAS — 9 rue des colonnes, 75002 Paris, France — Paris Trade and Companies Register 845 055 102 — hello@askalf.com