Privacy policy.

2. Data collected

The data collected varies depending on the nature of the relationship. Hello Justice applies data minimisation and collects only the information necessary for each purpose.

2.1 Prospective investors

Last name, first name, email, phone number, company, function, declaration of qualification within the meaning of Article D. 411-1 CMF, capacity to commit EUR 100,000.

KYC data where applicable: valid identity document, proof of address less than three months old, proof of financial capacity, statement on the source of funds.

Source: forms /investisseurs/acces and /investisseurs/entretien.

Legal basis: pre‑contractual measures, legitimate interest to qualify prospects, legal obligation (AML‑CFT) when KYC is triggered.

2.2 Subscribed LP investors

Data above, supplemented by: subscription form, bank details (RIB), units held, amounts committed, distributions received, tax documents (IFU), correspondence with the manager.

Legal basis: performance of the contract, legal obligation (KYC‑AML‑CFT, tax).

2.3 Litigants: applicants and funded clients

At the application stage (forms /eligibilite, /financement/soumettre and the CHF landing /annuler-mon-pret-chf): identity, contact details and a description of the dispute. For the CHF programme, the loan documents you upload (loan offer and agreement, amortisation schedule, amendments) are hosted at Supabase (EU, Frankfurt) in a dedicated restricted‑access storage bucket. They are shared with COGEP AVOCATS and Hello Justice for the review of your file, in accordance with professional secrecy. Nothing is sent to your bank while your file is being reviewed. If proceedings are brought, the lawyer communicates the necessary documents to the opposing party and to the court, as the rules of civil procedure require.

Legal basis at this stage: your consent and the performance of pre‑contractual measures.

Interrupted form: if you leave one of these forms before sending it, the contact details already entered (your phone number and, where applicable, your email and name), your answers and the step reached are saved as soon as they are entered, so that a member of the team can call you back about your request. The form tells you so under the phone field. This information is kept for as long as it takes to get back in touch with you about that request, and you can ask for it to be deleted at any time (section 7).

Legal basis for this record: Hello Justice’s legitimate interest in getting back in touch with a person who has started a request, and the pre‑contractual measures taken at your request.

After acceptance and signature: complete legal file, partner lawyer contact, evidentiary documents related to the dispute, exchanges and procedural progress, amounts committed and received.

Legal basis: performance of the tripartite agreement (client, partner lawyer, Hello Justice).

2.4 Partner lawyers

Identity, bar association, certificate of registration, professional liability insurance certificate, files handled, invoices and fees.

Legal basis: performance of the partnership agreement, RIN compliance.

2.5 Newsletter subscribers

Email, first name where applicable, language preference, registration date, source.

Legal basis: explicit consent (GDPR art. 6.1.a).

2.6 Resource downloads (lead magnet)

Email, first name, last name, function, company, resource viewed, date.

Legal basis: legitimate interest, consent for commercial prospecting.

2.7 Press and contact requests

Identity, email, media or organisation, message, subject of the request.

Legal basis: legitimate interest to respond to enquiries.

2.8 Website visitors

Truncated IP address, user‑agent, navigation path, referrer, anonymised audience measurement via Plausible Analytics.

Legal basis: legitimate interest, audience measurement exempted from consent (CNIL recommendation 2020-091).

Hello Justice does not collect any sensitive data within the meaning of Article 9 GDPR through public forms. Any sensitive data contained in a legal file is processed under the responsibility of the partner lawyer, within the framework of professional secrecy.

3. Purposes of processing

• Assessment of investor eligibility (qualification within the meaning of Article D. 411-1 CMF).
• Conduct of KYC and AML‑CFT due diligence (legal obligation, Articles L. 561-2 and following CMF).
• Administrative management of the LP relationship: subscription, capital calls, distributions, quarterly reporting.
• Production of annual tax documents (IFU).
• Evaluation and funding of litigation files.
• Calling back a person who started a funding request without sending it.
• Monitoring of judicial proceedings and progress.
• Communication with partner lawyers.
• Provision of educational resources (whitepaper, glossary, case law).
• Anonymised audience measurement of the website.
• Site security, fraud and abuse prevention, traceability of data room access.
• Response to press and contact enquiries.
• Retention for evidentiary purposes in the event of litigation.

4. Retention period

Retention periods are set according to the purpose and applicable legal obligations.

• Investor KYC data: 5 years after the end of the business relationship (Article L. 561-12 CMF).
• Active LP investor: throughout the holding period of the units, then 10 years (civil limitation).
• Funded client file: during the proceedings, then 5 years after their conclusion.
• Partner lawyer: during the partnership, then 5 years.
• Newsletter: until unsubscription, followed by deletion within 30 days.
• Lead magnet: 3 years from the last active contact.
• Press / contact request: up to 3 years after the last active contact, unless there is a contractual relationship.
• Technical connection logs: 13 months (CNIL recommendation).
• Data room access logs: 5 years (audit evidence).
• Essential cookies: session duration.
• Audience measurement cookies: 13 months.
• Personalisation cookies: 6 months.
• Marketing cookies: 13 months maximum.
• Cookie consent record: 6 months.
• Login attempts (security): 90 days.
• Email delivery log: 12 months.
• Unfinished form drafts: 6 months.
• Contact details entered in an interrupted request form: for as long as it takes to get back in touch with you about that request.
• Files uploaded for temporary automated analysis: 7 days.
• Economic simulation files: 2 years.

Beyond these periods, data are deleted or irreversibly anonymised. A daily automated job deletes expired technical traces, and a monthly job deletes documents whose retention period has elapsed. Every deletion is logged. Accounting and tax obligations (10 years for accounting records, Article L. 123-22 of the French Commercial Code) prevail in the event of conflict with the above periods.

5. Recipients of the data

Your data is accessible to authorised personnel at Hello Justice (management, compliance, finance teams) and, on the basis of a mandate or agreement, to partners necessary for the performance of the service.

Operational partners

• COGEP AVOCATS: partner law firm for the legal pre‑analysis of files.
• COGEP: provider for the vehicle’s accounting and investor reporting.
• Statutory auditor: legal audit of the vehicle.

Technical processors

• Database hosting, authentication and file storage (EU, Frankfurt).
• Site hosting, build and deployment (third‑party provider).
• Resend: sending of transactional emails and the newsletter.
• Google (Google Ads): advertising measurement on campaign pages, only after your consent via the cookie banner.
• Frankfurter (api.frankfurter.app): European Central Bank exchange rates displayed by the CHF simulator. The call is made from the browser and carries no form data, only the technical IP address is seen by this service.
• Plausible Analytics: privacy‑first audience measurement (EU, Germany).
• Yousign: electronic signature of subscription forms and documents (EU, France).
• Qonto: management of the vehicle’s bank account (France).
• Sentry: application error monitoring when enabled.

Public authorities

Hello Justice may be required to transmit data to Tracfin, to the Autorité des Marchés Financiers, to the tax authorities or to the courts, in response to a legal obligation or a requisition.

Hello Justice does not sell or rent any personal data. No transfer takes place for any purpose other than those described in this policy.

6. Transfers outside the European Union

Hello Justice prioritises processors located in the European Union. When a transfer outside the EU is necessary, it is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) and by complementary technical measures.

• Supabase Pte. Ltd. (headquartered in Singapore): Hello Justice project data is hosted in the European Union (Frankfurt, Germany). The data processing agreement includes the Standard Contractual Clauses for any support access from a third country.
• CDN: routing potentially via the United States, governed by SCCs and end‑to‑end TLS encryption.
• Resend: US‑based, governed by the Standard Contractual Clauses.
• Google (Google Ads, on consent): United States, governed by the EU‑US Data Privacy Framework, under which Google LLC is certified.
• Plausible Analytics: hosting in Germany, no transfer outside the EU.
• Yousign: France, no transfer outside the EU.
• Qonto: France, no transfer outside the EU.
• Sentry: EU region selected for Hello Justice projects.

You can obtain a copy of the applicable safeguards upon request to the DPO.

7. Your rights

In accordance with Articles 15 to 22 of the GDPR and the provisions of the French Data Protection Act, you have the following rights over your personal data.

• Right of access: obtain confirmation that your data is processed and receive a copy.
• Right to rectification: correct inaccurate data or complete incomplete data.
• Right to erasure: obtain the deletion of your data in the cases provided for by the GDPR, within the limits of legal obligations (in particular AML‑CFT, tax, accounting).
• Right to restriction: suspend the processing of your data during the resolution of a dispute.
• Right to portability: receive your data in a structured, commonly used and machine‑readable format.
• Right to object: object to processing based on legitimate interest or to a use for commercial prospecting.
• Right to withdraw your consent at any time, when processing is based on consent.
• Right to define directives concerning the fate of your data after your death (Article 85 of the French Data Protection Act).
• Right not to be subject to a decision based solely on automated processing producing legal effects.

How to exercise your rights

Send your request to the DPO at contact@hello-justice.com by stating the purpose of your request and attaching any document allowing your identity to be verified.

Hello Justice responds within one month of receiving the request. This period may be extended by two months for complex or numerous requests, with prior notification.

If you consider that your rights are not respected, you can lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

8. Cookies and trackers

The hello-justice.com website uses cookies and trackers strictly necessary for the operation of the service and audience measurement tools exempted from consent (CNIL recommendation 2020-091).

Audience measurement relies on Plausible Analytics, which works without cookies or personal identifiers. It can be disabled at any time. Non‑essential cookies (marketing) are only deposited with your prior consent, collected through a banner on our campaign pages. Your choices are managed via the Manage cookies link available in the footer.

Details of cookie categories, their purposes, their duration and the list of issuers are specified in the preference centre accessible from that same link.

9. Security

Hello Justice implements appropriate technical and organisational measures to protect your data against any loss, alteration, disclosure or unauthorised access.

• TLS 1.3 encryption on all communications with the site.
• At‑rest encryption of Postgres databases (Supabase).
• Multi‑factor authentication required for all administrator accounts.
• Postgres Row Level Security (RLS) policies ensuring strict separation of data by user and by role.
• Logging of sensitive access (auth_security, dataroom_access_logs).
• Encrypted daily backups and documented restoration procedure.
• Regular review of access rights and least‑privilege principle.
• Procedure for notifying breaches to the CNIL within 72 hours (Article 33 GDPR).

In the event of a breach likely to result in a high risk to your rights and freedoms, Hello Justice will inform you without undue delay in accordance with Article 34 GDPR.

10. Changes to this policy

Hello Justice may amend this policy to reflect legal, regulatory or operational changes. The applicable version is the one published on this page at the date of your consultation.

In the event of a substantial change, enhanced information will be communicated to the persons concerned (information banner, email to subscribers and active investors).

Current version: 2.0 - 10 May 2026.