This translation is provided for information only. Only the French version is legally binding.

Legal document

Personal data protection policy

Version 2.0 — in force since 30 October 2026

Archived version, replaced on 5 November 2026. See the version in force

Article 1 — Purpose and scope

This policy informs data subjects of the Processing of Personal Data carried out by the Publisher as part of the Service, in accordance with Articles 13 and 14 of the GDPR. It applies to the Site. The Processing specific to the Extension is set out in its privacy policy.

Article 2 — Definitions

In this document, the following capitalised terms have the meaning given below, in the singular as in the plural:

“Publisher”: the company AXO-LAB, single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, which publishes and operates the Site and the Service under a non-exclusive licence granted by the Rights Holders. The Publisher does not hold the intellectual property rights in the Service.
“Service”: the information service named “Recto”, available through the Site and the Extension, which presents, for each news website, a Card made up of Facts.
“Site”: the website available at www.recto-medias.fr and its subdomains.
“Extension”: the web browser extension published by the Publisher under the name “Recto”.
“User”: any person who accesses the Service, in whatever capacity.
“Card”: the record that the Service devotes to a news website, bringing together the Facts about it.
“Fact”: any fact shown on a Card, taken from a public register or from a publication by the publisher of the website concerned, together with its source and its date.
“Personal Data”: any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR.
“Processing”: any operation performed on Personal Data, such as collection, storage, consultation, disclosure or erasure, within the meaning of Article 4(2) of the GDPR.
“Cookie”: any tracker, in particular a text file, placed or read on the User’s device when visiting the Site.
“GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
“French Data Protection Act”: French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés).

The terms “controller” and “processor” have the meaning given to them in Article 4, points 7 and 8, of the GDPR.

Article 3 — Controller

The controller of all the Processing described in this policy is the company that publishes the Service, AXO-LAB, a single-shareholder simplified joint-stock company (SASU) with a share capital of 5 000 euros, registered with the Trade and Companies Register of Cusset under number 103 310 017, whose registered office is at Le Point Commun, place Claude Wormser, 03000 Avermes, France. It can be contacted at clement.pandreau@axo-lab.fr.

Any question about Personal Data, and any request to exercise rights, may be sent to the project’s contact point by email at contact@recto-medias.fr, or by post to the address of the registered office.

The Publisher has not appointed a data protection officer, as such an appointment is not mandatory given the Processing it carries out.

Article 4 — Processing carried out

The table below describes each Processing operation carried out, with its purpose, its legal basis under Article 6(1) of the GDPR, the categories of data and of data subjects, the origin of the data where they are not collected from the data subject, their recipients and their retention period.

Processing of personal data carried out
Processing and purpose	Legal basis	Data	Data subjects and source	Recipients	Retention
Server technical logs. Ensuring the operation and security of the Site, detecting abusive use and diagnosing incidents.	Legitimate interest of the Publisher in ensuring the security and proper operation of the Site (Article 6(1)(f) of the GDPR).	IP address; date and time of the request; address of the page requested; browser and system type (User-Agent header).	Anyone who visits the Site.	Authorised staff of the Publisher.	Twelve months at most.
Audience measurement (Matomo). Producing aggregated visit statistics to improve the Site. Visits are not viewed one by one: only aggregated statistics are produced. The data are neither combined with other processing nor passed on to third parties.	Before any choice is made, measurement runs without cookies, under the conditions for exemption from consent set by the CNIL, on the basis of the Publisher’s legitimate interest (Article 6(1)(f) of the GDPR). Audience measurement cookies are only placed with your consent (Article 6(1)(a) of the GDPR). If you refuse, no measurement is carried out.	IP address, truncated by two bytes before anything is recorded; approximate location (country, region, city), derived from the IP address using a database installed on the Publisher’s servers; pages viewed, without their parameters, date and duration of the visit; external links followed and files downloaded; referring site, reduced to its domain name; device type, browser and operating system, without their detailed version; visitor identifier, only if you accept audience measurement cookies.	Anyone who visits the Site.	Authorised staff of the Publisher. Matomo is installed on the Publisher’s servers.	Six months for the data of each visit; after that, only aggregated statistics remain, which no longer relate to any person.
Error tracking (GlitchTip). Detecting and fixing technical errors on the Site.	Legitimate interest of the Publisher in ensuring the proper operation of the Site (Article 6(1)(f) of the GDPR).	technical description of the error; address of the page concerned, without its parameters; browser and system type; date and time; loading time, for 1% of page views.	Anyone visiting the Site when an error occurs.	Authorised staff of the Publisher. GlitchTip is installed on the Publisher’s servers.	Ninety days.
Management of your cookie choices. Recording your cookie choices and being able to demonstrate them.	Compliance with a legal obligation (Article 6(1)(c) of the GDPR), arising from Article 82 of the French Data Protection Act and Article 7(1) of the GDPR.	choice for each category of cookies; date of the choice; version of the cookie policy.	Anyone who makes a choice in the cookie banner.	None: this information stays in your browser, in the recto_consentement cookie.	Six months.
Requests sent by email. Answering requests sent to the Publisher, including requests to exercise rights.	Legitimate interest of the Publisher in answering the requests sent to it (Article 6(1)(f) of the GDPR); for requests to exercise rights, compliance with a legal obligation (Article 6(1)(c) of the GDPR).	email address; name, if you give it; content of the messages exchanged.	Anyone who writes to the Publisher.	Authorised staff of the Publisher.	Three years from the last exchange.
Relations with the project’s partners, funders and supporters. Identifying the actual or potential partners, funders and supporters of the Recto project, contacting them, then maintaining and following up the exchanges with them.	Legitimate interest of the Publisher in seeking and maintaining the partnerships, funding and support the project needs (Article 6(1)(f) of the GDPR). You may object to this Processing at any time, without having to give reasons.	surname and first name; position; organisation; business contact details (email address, telephone, postal address); history of exchanges.	Business contacts of the organisations that are actual or potential partners, funders or supporters of the project. Source: Professional information made public, in particular by the person’s organisation, or provided by the person themselves.	Authorised staff of the Publisher. The contact management tool (Twenty) is installed on the Publisher’s servers.	Three years from the collection of the data or the last contact initiated by the person.
Requests to read a website. Limiting the number of requests to read a website per person, so that the Service remains available to everyone.	Legitimate interest of the Publisher in protecting the Service against abusive use (Article 6(1)(f) of the GDPR).	pseudonymous identifier computed from the IP address (keyed hash with a secret key; the IP address itself is not kept); date and time of the request.	Persons who request the reading of a website on the Site.	Authorised staff of the Publisher.	Forty-eight hours after the request.
Trial of Recto by volunteer testers. Assessing whether Cards help people recognise a news website and whether they are understood, as part of a published study (trial from 16 to 27 November 2026).	Consent (Article 6(1)(a) of the GDPR), given at the start of the trial. For political leaning, an optional question asked last: separate explicit consent (Article 9(2)(a) of the GDPR).	answers to the questions and response times; randomly drawn session number, language and order of the questions; news habits stated (optional); political leaning stated, only if the person ticked the box allowing it; free comment (optional).	Persons aged fifteen or over who take part in the trial voluntarily.	Authorised staff of the Publisher in charge of the study.	Until the final report of the study is published; after that, only overall results are kept.

Visiting the Site does not require creating an account. No decision based solely on automated Processing, including profiling, within the meaning of Article 22 of the GDPR, is taken in respect of Users.

Trial of Recto. Testers’ answers are not linked to any name, email address, IP address, cookie or browser identifier: only a randomly drawn session number links them together. A tester may stop the trial at any time; the answers already given are then kept with no link to them. Once the session is closed, nothing allows the Publisher to find a person’s answers: it can therefore neither provide them nor erase them on request, unless the person provides information that makes them recognisable (Article 11 of the GDPR). Political leaning is kept only with the box that allows it, separate from the consent given at the start; the answer “I would rather not answer” keeps nothing on this point. No result by political leaning is published for a group of fewer than five people.

Article 5 — Recipients and processors

Personal Data are intended solely for the authorised staff of the Publisher, within the limits of their duties. They are not sold, rented out or transferred.

Within the Publisher, Personal Data are only accessible to authorised persons, namely the President of AXO-LAB and the members of the Recto project team, to the extent their duties require. These persons act under the authority of the Publisher, within the meaning of Article 29 of the GDPR: they only process the data on its instructions and are bound by confidentiality.

The Publisher uses the following processors, bound by a contract that complies with Article 28 of the GDPR and with which the accounts are opened in its name:

OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix: hosting of servers and data; place of processing: France.
Brevo SAS, 9-17 rue Salneuve, 75017 Paris: sending of the Service’s transactional emails (invitations, sign-in, password reset); place of processing: European Union (France and Belgium).
Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapour 049513: hosting of the Service’s database, in an Amazon Web Services data centre located in Paris (eu-west-3 region); place of processing: France.

The audience measurement tool (Matomo), the error tracking tool (GlitchTip) and the contact management tool (Twenty) are installed on the Publisher’s servers, hosted by OVH SAS. Their publishers have no access to the data and are therefore not processors.

Article 6 — Transfers outside the European Union

The Publisher’s servers are located in France (OVHcloud data centre in Gravelines).

Brevo SAS, 9-17 rue Salneuve, 75017 Paris: possible access from third countries by Brevo’s sub-processors (Google Cloud Platform, Cloudflare, Zendesk, Omni) and by entities of its group located in the United States and India, governed by standard contractual clauses of the European Commission, the EU–US Data Privacy Framework and binding corporate rules.
Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapour 049513: possible access from third countries, in particular Singapore and the United States, by Supabase and its sub-processors (including Supabase, Inc. and Amazon Web Services, Inc.), governed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914).

Article 7 — Retention periods

Personal Data are kept for as long as is strictly necessary for the purpose pursued, then deleted or anonymised.

Retention periods and their justification
Processing	Period	Justification
Server technical logs	Twelve months at most.	Time needed to analyse a security incident discovered late.
Audience measurement (Matomo)	Six months for the data of each visit; after that, only aggregated statistics remain, which no longer relate to any person.	Long enough to follow changes in traffic, and shorter than the maximum of twenty-five months accepted by the CNIL.
Error tracking (GlitchTip)	Ninety days.	Time needed to fix an error and check that it does not happen again.
Management of your cookie choices	Six months.	Retention period for choices that the CNIL presents as good practice, after which the choice is asked for again.
Requests sent by email	Three years from the last exchange.	Period allowing a later complaint about the request to be answered.
Relations with the project’s partners, funders and supporters	Three years from the collection of the data or the last contact initiated by the person.	Period set by the CNIL’s reference framework for processing carried out to manage commercial activities, for prospects’ data.
Requests to read a website	Forty-eight hours after the request.	Time needed to count requests over one hour and over one day.
Trial of Recto by volunteer testers	Until the final report of the study is published; after that, only overall results are kept.	Time needed to analyse the trial and publish its results.

Article 8 — Security

In accordance with Article 32 of the GDPR, the Publisher implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in particular encryption of exchanges between the browser and the Site, hosting of the data in France, restriction of access to authorised staff only, as well as backups and logging of technical access.

Article 9 — Rights of data subjects

9.1 Content of the rights

Under the conditions and within the limits laid down in Articles 15 to 22 of the GDPR, every data subject has:

the right of access to their Personal Data and to information about their Processing (Article 15);
the right to rectification of inaccurate or incomplete data (Article 16);
the right to erasure, in particular where the data are no longer necessary or have been unlawfully processed (Article 17);
the right to restriction of Processing, in particular while the accuracy of the data is being verified (Article 18);
the right to the portability of the data they have provided, where the Processing is based on their consent or on a contract and is carried out by automated means (Article 20);
the right to object at any time, on grounds relating to their particular situation, to Processing based on legitimate interest (Article 21);
the right to object at any time, without having to give reasons, to the Processing “Relations with the project’s partners, funders and supporters” (Article 21);
the right to withdraw their consent at any time, where the Processing is based on it, without affecting the lawfulness of the Processing carried out before its withdrawal (Article 7(3));
the right to set guidelines on the retention, erasure and disclosure of their Personal Data after their death (Article 85 of the French Data Protection Act).

The Publisher notifies any rectification, erasure or restriction to the recipients to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19).

9.2 How to exercise the rights

The rights are exercised free of charge, by email at contact@recto-medias.fr or by post to the Publisher’s registered office. The Publisher only asks for proof of identity where it has reasonable doubts about the identity of the person making the request (Article 12(6) of the GDPR).

The Publisher responds within one month of receiving the request. This period may be extended by two months, taking into account the complexity and number of requests; the data subject is then informed within one month, together with the reasons for the delay (Article 12(3) of the GDPR).

Article 10 — Complaint to the CNIL

Any data subject who considers that the Processing of their Personal Data infringes the GDPR may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (Article 77 of the GDPR): Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; telephone: +33 1 53 73 22 22; online: cnil.fr/fr/plaintes.

Article 11 — Cookies

The use of Cookies and the management of consent are described in the cookie policy.

Article 12 — Amendments to the policy

12.1 Amendments

The Publisher may amend this policy, in particular to take account of changes to the Service, to the regulations or to case law. Each amendment gives rise to a new version, numbered and dated, published on the Site. Earlier versions remain available from the version history at the end of the document.

A new version comes into force on the date it states. Where the amendment is substantial, the Publisher informs Users by a notice on the Site and, for Users with an account, by email, before it comes into force.

Version history

Successive versions of the document
Version	Entry into force	Changes
3.0 (in force)	5 November 2026	Launch of the Service: Cards are public, the Local Correspondents’ area opens by invitation, and the dispute, application and contact forms record or forward data. New processing: automated collection of websites’ legal pages, applications. Processing clarified: accounts (forms, recusals, preferences, exercises, panel votes), disputes (without name, open to journalists and readers), requests through the contact form, limit on the number of requests. Supabase is a processor of each processing it hosts; Brevo’s role is extended to notices and to forwarding forms; files sent to the competent authorities are listed among recipients.
2.0	30 October 2026	Audience measurement described according to the Matomo configuration aligned with the CNIL’s exemption from consent: approximate location (country, region, city) derived from the IP address, referring site reduced to its domain name, device, browser and system without detailed version or screen size, statistics only viewed in aggregated form, retention reduced to six months.
1.2	28 October 2026	Audience measurement described according to the Matomo configuration aligned with the CNIL’s exemption from consent: approximate location (country, region, city) derived from the IP address, referring site reduced to its domain name, device, browser and system without detailed version or screen size, statistics only viewed in aggregated form, retention reduced to six months.
1.1	23 October 2026	Brought into line with the co-ownership and operating agreement signed on 22 October 2026: full identification of the controller, details of the persons authorised to access the data (Article 29 of the GDPR), updated list of processors and of transfers outside the European Union, addition of the processing “Relations with the project’s partners, funders and supporters”.
1.0	Never in force	First version.