How Transdoc collects, uses, retains and protects your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978, as amended.
Last updated: 17 April 2026
English translation for information purposes only. This policy is governed by French and EU law; in the event of any discrepancy, the French version prevails.
Preamble
Protecting privacy and personal data is a strong commitment of Legal230 SAS, publisher of the Transdoc service. This policy transparently describes the data processing carried out in connection with browsing the Site and providing our certified translation services. It is drafted in accordance with Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and French Act No. 78-17 of 6 January 1978, as amended ("Data Protection Act").
1. Data controller
The controller for the personal data collected via the Site is:
Legal230 SAS, a simplified joint-stock company with capital of €100,000
Registered office: 128 rue La Boétie, 75008 Paris, France
Legal230 SAS has appointed a Data Protection Officer (DPO) responsible for ensuring compliance of data processing and serving as the primary point of contact for data subjects and the CNIL (French data protection authority):
Postal address: Legal230 SAS · Attn: DPO, 128 rue La Boétie, 75008 Paris, France
3. Personal data collected
We collect only the data strictly necessary for the purposes pursued, in accordance with the data minimisation principle (Article 5.1.c of the GDPR). The categories of data processed are as follows:
Identity data: title, last name, first name, date of birth (where necessary for performing the translation).
Contact details: billing and delivery postal address, email address, phone number.
Documents submitted: source documents uploaded for translation (civil status records, diplomas, judgments, etc.), which may contain personal data and, in some cases, special category data within the meaning of Article 9 of the GDPR (health, religion, criminal convictions, ethnic origin). Their processing is strictly limited to providing the service.
Payment data: billing information and transaction identifier. Full card details are never stored by Transdoc; they are processed directly by our PCI-DSS compliant payment provider (Stripe).
Connection data: IP address, connection logs, browser type, pages viewed, timestamps, for security and audience measurement purposes.
Customer relationship data: order history, exchanges with support, communication preferences.
Cookies and trackers: technical identifiers placed on the user's device, detailed in section 11.
4. Purposes of processing
Data is processed for the following purposes:
Providing the service (order management, translation delivery, customer support);
Invoicing and accounting (issuing invoices, archiving, tax obligations);
Legitimate interest (Article 6.1.f): securing the Site, preventing abuse, marketing to existing clients for similar products, continuous service improvement.
Where consent is the legal basis for processing, it may be withdrawn at any time without affecting the lawfulness of processing based on consent given before its withdrawal.
6. Data recipients
Depending on their nature and the purpose of processing, your data is shared with the following categories of recipients:
Authorised Legal230 SAS staff (production, support, accounting and legal teams), strictly within the scope of their duties;
Partner sworn translators involved in performing your order, bound by an individual confidentiality undertaking and a data processing agreement compliant with Article 28 of the GDPR;
Technical service providers: hosting provider (OVHcloud, France), payment provider (Stripe), transactional email provider, customer support tool, audience measurement tool;
Carriers (La Poste or equivalent) for shipping the paper original;
Competent administrative or judicial authorities, upon proper request and in accordance with the applicable legal framework.
Transdoc does not sell, rent or otherwise transfer its clients' personal data to third parties for commercial purposes.
7. Transfers outside the European Union
Data is, in principle, hosted and processed within the European Union, mainly in France. Should a transfer to a third country not covered by a European Commission adequacy decision become necessary (e.g. for certain technical subcontractors), Legal230 SAS implements appropriate safeguards in accordance with Article 46 of the GDPR:
Standard contractual clauses adopted by the European Commission (Implementing Decision 2021/914);
Transfer Impact Assessments;
Additional technical and organisational measures (encryption, pseudonymisation).
Data subjects may obtain a copy of these safeguards on request from the DPO.
8. Retention periods
Retention periods are determined according to the purposes pursued, applicable legal obligations, and statutory limitation periods:
Active client data: for the entire duration of the business relationship;
Invoices and accounting records:10 years from the end of the financial year (Article L.123-22 of the French Commercial Code);
Source documents and delivered translations: stored securely for 5 years at the client's request, to allow reissuing if needed; automatically deleted otherwise;
Marketing data (clients): 3 years from the end of the business relationship;
Marketing data (prospects): 3 years from the prospect's last contact;
Connection data and security logs: 12 months (Article L.34-1 of the French Postal and Electronic Communications Code);
Cookies: 13 months maximum from being placed;
Data related to litigation: duration of proceedings plus applicable limitation and appeal periods.
Beyond these periods, data is deleted, anonymised, or archived on a restricted basis only where a legal obligation requires it.
9. Data security
Legal230 SAS implements appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, to ensure a level of security appropriate to the risk:
Encryption in transit: SSL/TLS (HTTPS) protocols across the entire Site;
Encryption at rest: AES-256 for storing source documents and sensitive databases;
Hosting in France by OVHcloud, certified ISO/IEC 27001, ISO/IEC 27701 and as a Health Data Host (HDS);
Strict access control (two-factor authentication, strong password policy, least-privilege principle);
Logging and monitoring of access to sensitive data;
Encrypted backups daily, with regular restoration tests;
Ongoing staff awareness and training;
Documented procedure for managing data breaches and notifying the CNIL within 72 hours if required.
10. Rights of data subjects
In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights over your data:
Right of access (Article 15): obtain confirmation that your data is being processed and receive a copy of it;
Right to rectification (Article 16): have inaccurate or incomplete data corrected;
Right to erasure or "right to be forgotten" (Article 17): obtain deletion of your data in the cases provided for by the regulation;
Right to restriction of processing (Article 18);
Right to data portability (Article 20): receive your data in a structured, commonly used, machine-readable format;
Right to object (Article 21): object to processing based on legitimate interest or for marketing purposes;
Right not to be subject to a solely automated individual decision producing legal effects (Article 22);
Right to withdraw your consent at any time, for processing based on this ground;
Post-mortem directives: pursuant to Article 85 of the French Data Protection Act, you may set directives regarding the fate of your data after your death.
10.1 How to exercise your rights
Your rights may be exercised by contacting the DPO:
By post: Legal230 SAS · Attn: DPO, 128 rue La Boétie, 75008 Paris, France
To preserve data confidentiality, proof of identity may be requested in case of reasonable doubt. A response is provided within one (1) month of receiving the request, which may be extended by two months given the complexity or number of requests.
11. Cookies and trackers
The Site uses cookies and trackers, divided into four categories:
Strictly necessary cookies: essential for the Site to function (session, cart, load balancing, security). Exempt from consent (Article 82 of the French Data Protection Act).
Audience measurement cookies: internal statistics and analytics configured in accordance with CNIL guidelines (exempt from consent if configured correctly, otherwise subject to consent).
Functional cookies: remembering preferences (language, display, last step of the order tunnel).
Marketing and personalisation cookies: targeted advertising, campaign tracking, social media sharing. Placed only after explicit consent.
On your first visit, a consent management banner (CMP) lets you accept, refuse, or finely configure the categories of cookies that are not strictly necessary. Your choice is stored for six (6) months; you can change it at any time via the "Manage cookies" link in the footer.
Cookies do not last longer than 13 months. Information collected via these trackers is not kept beyond 25 months.
12. Right to lodge a complaint with the CNIL
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the French supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 place de Fontenoy · TSA 80715 · 75334 Paris Cedex 07, France
We nevertheless encourage you to contact us first to seek an amicable solution.
13. Changes to this policy
This policy may change to reflect regulatory, technical or organisational developments. Any substantial change will be brought to users' attention via a notice on the Site and, where applicable, by email. The applicable version is identified by the last-updated date at the top of the page. We encourage you to review this policy regularly.
14. Contact
For any question relating to this policy or the processing of your data:
Our commitment. Document confidentiality, hosting in France, end-to-end encryption, an individual undertaking from every translator: protecting your data is at the heart of our service.
Need a certified translation?
Order online, receive your certified translation in 48h from an approved sworn translator. No travel, 100% secure.