This translation is provided for information only. Only the French version is legally binding.

Legal document

Personal data protection policy

Version 3.0 — in force since 5 November 2026

Article 1 — Purpose and scope

This policy informs data subjects of the Processing of Personal Data carried out by the Publisher as part of the Service, in accordance with Articles 13 and 14 of the GDPR. It applies to the Site. The Processing specific to the Extension is set out in its privacy policy.

Article 2 — Definitions

In this document, the following capitalised terms have the meaning given below, in the singular as in the plural:

“Publisher”: the company AXO-LAB, single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, which publishes and operates the Site and the Service under a non-exclusive licence granted by the Rights Holders. The Publisher does not hold the intellectual property rights in the Service.
“Service”: the information service named “Recto”, available through the Site and the Extension, which presents, for each news website, a Card made up of Facts.
“Site”: the website available at www.recto-medias.fr and its subdomains.
“Extension”: the web browser extension published by the Publisher under the name “Recto”.
“User”: any person who accesses the Service, in whatever capacity.
“Card”: the record that the Service devotes to a news website, bringing together the Facts about it.
“Fact”: any fact shown on a Card, taken from a public register or from a publication by the publisher of the website concerned, together with its source and its date.
“Personal Data”: any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR.
“Processing”: any operation performed on Personal Data, such as collection, storage, consultation, disclosure or erasure, within the meaning of Article 4(2) of the GDPR.
“Cookie”: any tracker, in particular a text file, placed or read on the User’s device when visiting the Site.
“GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
“French Data Protection Act”: French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés).

The terms “controller” and “processor” have the meaning given to them in Article 4, points 7 and 8, of the GDPR.

Article 3 — Controller

The controller of all the Processing described in this policy is the company that publishes the Service, AXO-LAB, a single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, whose registered office is at Le Point Commun, place Claude Wormser, 03000 Avermes, France. It can be contacted at clement.pandreau@axo-lab.fr.

Any question about Personal Data, and any request to exercise rights, may be sent to the project’s contact point by email at contact@recto-medias.fr, or by post to the address of the registered office.

The Publisher has not appointed a data protection officer, as such an appointment is not mandatory given the Processing it carries out.

Article 4 — Processing carried out

The table below describes each Processing operation carried out, with its purpose, its legal basis under Article 6(1) of the GDPR, the categories of data and of data subjects, the origin of the data where they are not collected from the data subject, their recipients and their retention period.

Processing of personal data carried out
Processing and purpose	Legal basis	Data	Data subjects and source	Recipients	Retention
Server technical logs. Ensuring the operation and security of the Site, detecting abusive use and diagnosing incidents.	Legitimate interest of the Publisher in ensuring the security and proper operation of the Site (Article 6(1)(f) of the GDPR).	IP address; date and time of the request; address of the page requested; browser and system type (User-Agent header); to limit the number of requests from one person: a hash of the IP address, computed with a key drawn at random every day, kept in the server’s memory only and never written.	Anyone who visits the Site.	Authorised staff of the Publisher.	Twelve months at most.
Audience measurement (Matomo). Producing aggregated visit statistics to improve the Site. Visits are not viewed one by one: only aggregated statistics are produced. The data are neither combined with other processing nor passed on to third parties.	Before any choice is made, measurement runs without cookies, under the conditions for exemption from consent set by the CNIL, on the basis of the Publisher’s legitimate interest (Article 6(1)(f) of the GDPR). Audience measurement cookies are only placed with your consent (Article 6(1)(a) of the GDPR). If you refuse, no measurement is carried out.	IP address, truncated by two bytes before anything is recorded; approximate location (country, region, city), derived from the IP address using a database installed on the Publisher’s servers; pages viewed, without their parameters, date and duration of the visit; external links followed and files downloaded; referring site, reduced to its domain name; device type, browser and operating system, without their detailed version; visitor identifier, only if you accept audience measurement cookies.	Anyone who visits the Site.	Authorised staff of the Publisher. Matomo is installed on the Publisher’s servers.	Six months for the data of each visit; after that, only aggregated statistics remain, which no longer relate to any person.
Error tracking (GlitchTip). Detecting and fixing technical errors on the Site.	Legitimate interest of the Publisher in ensuring the proper operation of the Site (Article 6(1)(f) of the GDPR).	technical description of the error; address of the page concerned, without its parameters; browser and system type; date and time; loading time, for 1% of page views.	Anyone visiting the Site when an error occurs.	Authorised staff of the Publisher. GlitchTip is installed on the Publisher’s servers.	Ninety days.
Management of your cookie choices. Recording your cookie choices and being able to demonstrate them.	Compliance with a legal obligation (Article 6(1)(c) of the GDPR), arising from Article 82 of the French Data Protection Act and Article 7(1) of the GDPR.	choice for each category of cookies; date of the choice; version of the cookie policy.	Anyone who makes a choice in the cookie banner.	None: this information stays in your browser, in the recto_consentement cookie.	Six months.
Requests sent by email or through the contact form. Answering requests sent to the Publisher, including requests to exercise rights.	Legitimate interest of the Publisher in answering the requests sent to it (Article 6(1)(f) of the GDPR); for requests to exercise rights, compliance with a legal obligation (Article 6(1)(c) of the GDPR).	name; email address; subject and content of the messages exchanged.	Anyone who writes to the Publisher. Source: The person themselves. A message sent through the contact form is not stored by the Site: it is forwarded to the Publisher’s mailbox.	Authorised staff of the Publisher.	Three years from the last exchange.
Persons named on Cards. Informing the public of the identity of the publishers of news websites, for transparency purposes.	Legitimate interest of the public in knowing the identity of the persons who publish a news website (Article 6(1)(f) of the GDPR).	surname and first name; position (publication director, manager).	Publication directors and managers of the companies that publish the websites presented. Source: Public registers (French national business register, through the API Recherche d’entreprises; Sirene directory; list of the Joint Committee for Press Publications and Agencies) and legal notices published by the websites themselves, read by the Service’s collection robot under the terms of its policy.	The public: Cards can be viewed freely.	As long as the website’s Card is published; a name replaced in its source is made anonymous one year after it is replaced.
Automated collection of websites’ legal pages. Building Cards from what websites declare themselves, keeping proof of what was read, and spotting websites that pose as media.	Legitimate interest of the Publisher and of the public in transparency about the identity of news website publishers (Article 6(1)(f) of the GDPR), balanced in the collector policy.	name and position as published by the website; extract of the page that contains them and its address; date of the reading.	Persons named in the legal notices of the websites read (publication director, publisher, host). Source: Public home pages and legal notices of the websites, read by the Service’s collection robot; a website can object under the collector policy.	The public, for what appears on Cards; Local Correspondents and Lead Reviewers, for extracts, in the signed-in area; competent authorities, for the files sent to them.	Full pages: thirty days on the robot’s server. Extracts: one year after the information is replaced in its source.
Accounts of Local Correspondents, Lead Reviewers and the coordination. Giving access to the signed-in area, by invitation, keeping it secure, and carrying out in it the verification of cases, the review of Cards, exercises, the examination of disputes and the preparation of the files sent to the competent authorities.	Performance of the general terms of use accepted upon invitation (Article 6(1)(b) of the GDPR).	surname and first name; email address; roles and départements; authenticator app registered (its name, never its secret); verification forms, findings and reviews, with their notes; recusals and their reason; exercise results; preferences (time available, email notices, pause); panel votes, linked to a hash and not to the name; history of actions in the area and sign-in logs; versions of the general terms of use and of the charter accepted, and their date.	Local Correspondents, Lead Reviewers, panel members and the coordination.	Authorised staff of the Publisher and of the coordination. Files sent to the competent authorities include the forms without name or note.	Duration of the access, then twelve months after it is withdrawn. Findings and forms of a deleted account remain, without its name.
Applications to the network of Local Correspondents. Examining the applications received through the Site and inviting the persons selected to join the signed-in area.	Consent, given with the form’s tick box (Article 6(1)(a) of the GDPR).	surname and first name; email address; département; profile and availability stated; motivation (optional).	Persons who apply.	Authorised staff of the Publisher and of the coordination.	Six months after the application is sent.
Disputes. Examining and answering disputes about Facts shown on a Card, and publishing on the Card the resulting correction or right of reply.	Legitimate interest of the Publisher in ensuring the accuracy of the Facts published (Article 6(1)(f) of the GDPR).	capacity (publisher, journalist, reader); email address; website and line of the Card disputed; content of the dispute; request to publish a right of reply.	Anyone who disputes a Fact: publisher of the website, person named on the Card, journalist or reader.	Authorised staff of the Publisher; Lead Reviewers and panel members in charge of the examination, who do not see the email address.	Three years after the decision.
Requests to read a website. Limiting the number of requests to read a website per person, so that the Service remains available to everyone.	Legitimate interest of the Publisher in protecting the Service against abusive use (Article 6(1)(f) of the GDPR).	pseudonymous identifier computed from the IP address (keyed hash with a secret key; the IP address itself is not kept); date and time of the request.	Persons who request the reading of a website on the Site.	Authorised staff of the Publisher.	Forty-eight hours after the request.
Trial of Recto by volunteer testers. Assessing whether Cards help people recognise a news website and whether they are understood, as part of a published study (trial from 16 to 27 November 2026).	Consent (Article 6(1)(a) of the GDPR), given at the start of the trial. For political leaning, an optional question asked last: separate explicit consent (Article 9(2)(a) of the GDPR).	answers to the questions and response times; randomly drawn session number, language and order of the questions; news habits stated (optional); political leaning stated, only if the person ticked the box allowing it; free comment (optional).	Persons aged fifteen or over who take part in the trial voluntarily.	Authorised staff of the Publisher in charge of the study.	Until the final report of the study is published; after that, only overall results are kept.
Relations with the project’s partners, funders and supporters. Identifying the actual or potential partners, funders and supporters of the Recto project, contacting them, then maintaining and following up the exchanges with them.	Legitimate interest of the Publisher in seeking and maintaining the partnerships, funding and support the project needs (Article 6(1)(f) of the GDPR). You may object to this Processing at any time, without having to give reasons.	surname and first name; position; organisation; business contact details (email address, telephone, postal address); history of exchanges.	Business contacts of the organisations that are actual or potential partners, funders or supporters of the project. Source: Professional information made public, in particular by the person’s organisation, or provided by the person themselves.	Authorised staff of the Publisher. The contact management tool (Twenty) is installed on the Publisher’s servers.	Three years from the collection of the data or the last contact initiated by the person.

Visiting the Site does not require creating an account; the area of Local Correspondents, Lead Reviewers and the coordination is open by invitation only. No decision based solely on automated Processing, including profiling, within the meaning of Article 22 of the GDPR, is taken in respect of Users.

Trial of Recto. Testers’ answers are not linked to any name, email address, IP address, cookie or browser identifier: only a randomly drawn session number links them together. A tester may stop the trial at any time; the answers already given are then kept with no link to them. Once the session is closed, nothing allows the Publisher to find a person’s answers: it can therefore neither provide them nor erase them on request, unless the person provides information that makes them recognisable (Article 11 of the GDPR). Political leaning is kept only with the box that allows it, separate from the consent given at the start; the answer “I would rather not answer” keeps nothing on this point. No result by political leaning is published for a group of fewer than five people.

Article 5 — Persons named on Cards

Cards may mention the names of natural persons, in particular the publication director of a news website or the manager of the company that publishes it. As these data are not collected from the data subjects, this article provides them with the information required by Article 14 of the GDPR.

5.1 Origin of the data

Public registers (French national business register, through the API Recherche d’entreprises; Sirene directory; list of the Joint Committee for Press Publications and Agencies) and legal notices published by the websites themselves, read by the Service’s collection robot under the terms of its policy.

5.2 Purpose and legal basis

Informing the public of the identity of the publishers of news websites, for transparency purposes. The Processing is based on legitimate interest (Article 6(1)(f) of the GDPR). The Publisher has weighed this interest against the rights of the data subjects: the data are limited to the surname, first name and position; they already appear in public registers or in notices that the law requires publishers to publish; they only concern the exercise of a publishing function; they are not associated with any assessment. Data subjects can reasonably expect this information to be consulted and reproduced.

5.3 Rights to object and to rectification

Any person named on a Card may object to the Processing on grounds relating to their particular situation (Article 21 of the GDPR) and obtain the rectification of inaccurate data (Article 16 of the GDPR), by writing to contact@recto-medias.fr. They may also dispute a Fact under the procedure provided for in the general terms of use.

Article 6 — Recipients and processors

Personal Data are intended solely for the authorised staff of the Publisher, within the limits of their duties. They are not sold, rented out or transferred.

Within the Publisher, Personal Data are only accessible to authorised persons, namely the President of AXO-LAB and the members of the Recto project team, to the extent their duties require. These persons act under the authority of the Publisher, within the meaning of Article 29 of the GDPR: they only process the data on its instructions and are bound by confidentiality.

When the verification of a website leads to a file, the Publisher sends it to the competent authorities. The file includes the Facts of the Card with their sources, the extracts read on the website and the verification forms, without the names of their authors or their notes.

The Publisher uses the following processors, bound by a contract that complies with Article 28 of the GDPR and with which the accounts are opened in its name:

OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix: hosting of the servers of the Site and of the collection robot, of their logs and of the tools installed by the Publisher; place of processing: France.
Brevo SAS, 9-17 rue Salneuve, 75017 Paris: sending of the Service’s emails: invitations and sign-in codes, notices to Local Correspondents, forwarding to the Publisher of the messages and requests received through the Site’s forms; place of processing: European Union (France and Belgium).
Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapour 049513: hosting of the Service’s database, in an Amazon Web Services data centre located in Paris (eu-west-3 region); place of processing: France.

The audience measurement tool (Matomo), the error tracking tool (GlitchTip) and the contact management tool (Twenty) are installed on the Publisher’s servers, hosted by OVH SAS. Their publishers have no access to the data and are therefore not processors.

Article 7 — Transfers outside the European Union

The Publisher’s servers are located in France (OVHcloud data centre in Gravelines).

Brevo SAS, 9-17 rue Salneuve, 75017 Paris: possible access from third countries by Brevo’s sub-processors (Google Cloud Platform, Cloudflare, Zendesk, Omni) and by entities of its group located in the United States and India, governed by standard contractual clauses of the European Commission, the EU–US Data Privacy Framework and binding corporate rules.
Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapour 049513: possible access from third countries, in particular Singapore and the United States, by Supabase and its sub-processors (including Supabase, Inc. and Amazon Web Services, Inc.), governed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914).

Article 8 — Retention periods

Personal Data are kept for as long as is strictly necessary for the purpose pursued, then deleted or anonymised.

Retention periods and their justification
Processing	Period	Justification
Server technical logs	Twelve months at most.	Time needed to analyse a security incident discovered late.
Audience measurement (Matomo)	Six months for the data of each visit; after that, only aggregated statistics remain, which no longer relate to any person.	Long enough to follow changes in traffic, and shorter than the maximum of twenty-five months accepted by the CNIL.
Error tracking (GlitchTip)	Ninety days.	Time needed to fix an error and check that it does not happen again.
Management of your cookie choices	Six months.	Retention period for choices that the CNIL presents as good practice, after which the choice is asked for again.
Requests sent by email or through the contact form	Three years from the last exchange.	Period allowing a later complaint about the request to be answered.
Persons named on Cards	As long as the website’s Card is published; a name replaced in its source is made anonymous one year after it is replaced.	A Fact is only useful as long as it reflects its source.
Automated collection of websites’ legal pages	Full pages: thirty days on the robot’s server. Extracts: one year after the information is replaced in its source.	Time needed to check a Card and prove what was read, keeping no more than the useful extract.
Accounts of Local Correspondents, Lead Reviewers and the coordination	Duration of the access, then twelve months after it is withdrawn. Findings and forms of a deleted account remain, without its name.	Period allowing a dispute about the actions carried out to be handled; findings keep a record of what was checked.
Applications to the network of Local Correspondents	Six months after the application is sent.	Time needed to examine the application and follow it up; a person invited then falls under the accounts processing.
Disputes	Three years after the decision.	Period allowing the decision taken to be justified in the event of litigation.
Requests to read a website	Forty-eight hours after the request.	Time needed to count requests over one hour and over one day.
Trial of Recto by volunteer testers	Until the final report of the study is published; after that, only overall results are kept.	Time needed to analyse the trial and publish its results.
Relations with the project’s partners, funders and supporters	Three years from the collection of the data or the last contact initiated by the person.	Period set by the CNIL’s reference framework for processing carried out to manage commercial activities, for prospects’ data.

Article 9 — Security

In accordance with Article 32 of the GDPR, the Publisher implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular encryption of exchanges between the browser and the Site, hosting of the data in France, restriction of access to authorised staff only, as well as backups and logging of technical access.

Article 10 — Rights of data subjects

10.1 Content of the rights

Under the conditions and within the limits laid down in Articles 15 to 22 of the GDPR, every data subject has:

the right of access to their Personal Data and to information about their Processing (Article 15);
the right to rectification of inaccurate or incomplete data (Article 16);
the right to erasure, in particular where the data are no longer necessary or have been unlawfully processed (Article 17);
the right to restriction of Processing, in particular while the accuracy of the data is being verified (Article 18);
the right to the portability of the data they have provided, where the Processing is based on their consent or on a contract and is carried out by automated means (Article 20);
the right to object at any time, on grounds relating to their particular situation, to Processing based on legitimate interest (Article 21);
the right to object at any time, without having to give reasons, to the Processing “Relations with the project’s partners, funders and supporters” (Article 21);
the right to withdraw their consent at any time, where the Processing is based on it, without affecting the lawfulness of the Processing carried out before its withdrawal (Article 7(3));
the right to set guidelines on the retention, erasure and disclosure of their Personal Data after their death (Article 85 of the French Data Protection Act).

The Publisher notifies any rectification, erasure or restriction to the recipients to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19).

10.2 How to exercise the rights

The rights are exercised free of charge, by email at contact@recto-medias.fr or by post to the Publisher’s registered office. The Publisher only asks for proof of identity where it has reasonable doubts about the identity of the person making the request (Article 12(6) of the GDPR).

The Publisher responds within one month of receiving the request. This period may be extended by two months, taking into account the complexity and number of requests; the data subject is then informed within one month, together with the reasons for the delay (Article 12(3) of the GDPR).

Article 11 — Complaint to the CNIL

Any data subject who considers that the Processing of their Personal Data infringes the GDPR may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (Article 77 of the GDPR): Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; telephone: +33 1 53 73 22 22; online: cnil.fr/fr/plaintes.

Article 12 — Cookies

The use of Cookies and the management of consent are described in the cookie policy.

Article 13 — Amendments to the policy

13.1 Amendments

The Publisher may amend this policy, in particular to take account of changes to the Service, to the regulations or to case law. Each amendment gives rise to a new version, numbered and dated, published on the Site. Earlier versions remain available from the version history at the end of the document.

A new version comes into force on the date it states. Where the amendment is substantial, the Publisher informs Users by a notice on the Site and, for Users with an account, by email, before it comes into force.

Version history

Successive versions of the document
Version	Entry into force	Changes
3.0 (in force)	5 November 2026	Launch of the Service: Cards are public, the Local Correspondents’ area opens by invitation, and the dispute, application and contact forms record or forward data. New processing: automated collection of websites’ legal pages, applications. Processing clarified: accounts (forms, recusals, preferences, exercises, panel votes), disputes (without name, open to journalists and readers), requests through the contact form, limit on the number of requests. Supabase is a processor of each processing it hosts; Brevo’s role is extended to notices and to forwarding forms; files sent to the competent authorities are listed among recipients.
2.0	30 October 2026	Audience measurement described according to the Matomo configuration aligned with the CNIL’s exemption from consent: approximate location (country, region, city) derived from the IP address, referring site reduced to its domain name, device, browser and system without detailed version or screen size, statistics only viewed in aggregated form, retention reduced to six months.
1.2	28 October 2026	Audience measurement described according to the Matomo configuration aligned with the CNIL’s exemption from consent: approximate location (country, region, city) derived from the IP address, referring site reduced to its domain name, device, browser and system without detailed version or screen size, statistics only viewed in aggregated form, retention reduced to six months.
1.1	23 October 2026	Brought into line with the co-ownership and operating agreement signed on 22 October 2026: full identification of the controller, details of the persons authorised to access the data (Article 29 of the GDPR), updated list of processors and of transfers outside the European Union, addition of the processing “Relations with the project’s partners, funders and supporters”.
1.0	Never in force	First version.