Skip to content
Legle

Privacy policy

Last updated: 17 April 2026.

Data controller

The controller of the personal data collected on this website is LEGLE LEGRAND LEBOUC (hereinafter "Legle"), whose contact details are provided in the legal notices of the website.

Given the nature and volume of the processing carried out, Legle is not required to appoint a Data Protection Officer (DPO) within the meaning of article 37 of the GDPR. Any request relating to the protection of your data may be sent to contact@legle.fr.

Data collected

Legle only collects data that is strictly necessary for the purposes described below.

Contact form, catalogue request and sales enquiry

When you fill in a form, we collect:

  • your name (required),
  • your email address (required),
  • your company name (optional),
  • the message you send us (required),
  • the date of submission.

The fields marked as required are essential to process your request. Failing to provide them prevents Legle from replying to you. The company field is optional; not filling it has no impact on the handling of your request.

Audience measurement

The website uses Umami (umami.is), a solution published by Umami Software, Inc. and hosted by Legle on the Umami Cloud infrastructure in the European Union region (Frankfurt, Germany). Umami is configured in cookie-less mode without visitor identification: no cookies are placed, and no data is shared with third parties for advertising purposes.

No automated decision-making

Your data is not subject to any fully automated decision or profiling within the meaning of article 22 of the GDPR. Responses to your requests are handled individually by our teams.

Purposes and legal bases

  • Responding to your requests (contact, catalogue, sales) — pre-contractual measures / legitimate interest (GDPR art. 6.1.b and 6.1.f).
  • Improving navigation and measuring audience — legitimate interest (art. 6.1.f); audience measurement compliant with the CNIL's exemption criteria (recommendation on cookies and other trackers of 17 September 2020, amended by deliberation n° 2021-126 of 14 October 2021).
  • Meeting our legal and accounting obligations — legal obligation (art. 6.1.c).

Retention periods

  • Form submissions: 3 years from the last contact, in line with CNIL recommendations for B2B prospecting.
  • Umami audience statistics: 13 months maximum, in aggregated non-identifying form.
  • Accounting obligations: 10 years for documents relating to a commercial relationship, as required by the French Commercial Code.

Data recipients

Your data is intended solely for Legle staff authorised to handle your requests. It is never sold or transferred to third parties for commercial purposes.

To operate the website, we rely on the following processors, all of which are contractually bound to comply with the GDPR:

  • Vercel Inc. (USA) — web hosting. Transfers outside the EU are covered by the European Commission's Standard Contractual Clauses (SCC).
  • Neon Inc. (USA) — database. Data is physically stored in the AWS eu-central-1 region (Frankfurt, Germany).
  • Cloudflare, Inc. (USA) — media storage (R2) and CDN. Transfers covered by SCCs.
  • Resend (USA) — transactional emails related to forms. Transfers covered by SCCs.
  • Umami Software, Inc. (publisher, USA) — anonymous audience measurement. The instance used by Legle is hosted in the EU region (Frankfurt, Germany); no audience-measurement data is transferred outside the EU.

Transfers outside the European Union

Some of our processors are based outside the European Union, mainly in the United States. Such transfers are governed by the Standard Contractual Clauses adopted by the European Commission (decision 2021/914), complemented by appropriate technical and organisational safeguards (encryption in transit and at rest).

Your rights

Under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act, you have the following rights:

  • right to access your data,
  • right to rectification of inaccurate data,
  • right to erasure ("right to be forgotten"),
  • right to restriction of processing,
  • right to data portability,
  • right to object to processing,
  • right to issue post-mortem directives regarding the fate of your data after your death.

You may exercise these rights by writing to contact@legle.fr, providing proof of identity. A reply will be sent within a maximum of one month.

If you believe that the processing of your data is not compliant, you are entitled to lodge a complaint with the French data protection authority: Commission nationale de l'informatique et des libertés (CNIL) — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

Residents outside the European Union

California (CCPA/CPRA)

California residents benefit from specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what data is collected, the right to request its deletion and the right to opt out of its "sale". Legle does not sell or share personal data within the meaning of CCPA/CPRA.

Brazil (LGPD)

Brazilian residents benefit from equivalent rights under the Lei Geral de Proteção de Dados (LGPD). The same procedures as for the GDPR apply (contact@legle.fr).

Security

Legle implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of your data: HTTPS encryption, environment isolation, access control, encrypted backups.

Changes

This policy may be updated to reflect legal or technical developments. The date of the latest update is shown at the top of the page.