Privacy policy | Mangrove

This English translation is provided for information purposes. In the event of any discrepancy, the French version prevails.

The protection of privacy and personal data is of the utmost importance to Mangrove.

When we process personal data, we make every effort to ensure that such processing complies with this privacy policy and with applicable laws and regulations, in particular the General Data Protection Regulation (GDPR).

1. Purpose and scope

This policy describes the personal data processing carried out by our law practice. It explains which personal data are processed, why, on what legal basis and for how long. It also sets out your rights and how to exercise them.

It applies to:

persons who visit the website mangrove.law (the “Website”) or use its contact form;
clients, their directors, representatives, beneficial owners and staff;
prospective clients;
third parties whose data appear in case files, in particular opposing parties, their counsel, witnesses and experts.

2. Controller and contact

The controller is Maître Mickaël Tome, Avocat à la Cour, 51 Boulevard Grande-Duchesse Charlotte, L-1331 Luxembourg, practising within the law practice operating under the name “Mangrove”.

For any question about your data or to exercise your rights, write to: hello@mangrove.law or by post to the address above.

3. Data collected through the Website

Contact form

Data collected: first name, last name, business email address, organisation, subject and content of the message.

Purposes:

to respond to your request;
to check for any conflict of interest before any discussion on the merits or any acceptance of instructions.

Legal bases:

the performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR);
the legitimate interest of the Mangrove practice in responding to the requests it receives (Article 6(1)(f) GDPR);
for conflict-of-interest checks, compliance with the lawyer’s professional obligations (Article 6(1)(c) GDPR).

Important: sending a message does not create a lawyer-client relationship. Please do not send any sensitive information or information relating to ongoing proceedings through this form. Such information may be exchanged once the engagement has been accepted.

Connection logs

When you visit the Website, the server hosting it automatically records certain technical data: IP address, date and time of connection, pages viewed, browser type.

These data are used solely to ensure the security and proper functioning of the Website. They are not used to identify you or to measure audience.

Legal basis: the legitimate interest in ensuring the security of the Website (Article 6(1)(f) GDPR).

4. Data processed in the context of the client relationship

Case management

To advise, assist and represent its clients, the Mangrove practice processes the data needed for each case. These include identification and contact data, positions held, correspondence, and the information and documents provided by the client.

Legal basis: the performance of the fee agreement or engagement (Article 6(1)(b) GDPR). Where the data subject is not a party to the contract, the legal basis is the legitimate interest of the client and the lawyer in the proper performance of the assignment (Article 6(1)(f) GDPR).

Client identification and anti-money laundering

Pursuant to the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing, the Mangrove practice must, in the cases provided for by that law, identify its clients and their beneficial owners and exercise ongoing due diligence.

For this purpose it collects the following data:

identification data and copies of identity documents;
information on beneficial owners;
any status as a politically exposed person;
information on the source of funds where required by law.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Opposing parties and other third parties

Case files necessarily contain data relating to third parties: opposing parties, counsel, witnesses, experts, contracting parties. These data are generally provided by the client or come from public sources.

Legal basis: the client’s legitimate interest in asserting or defending its rights (Article 6(1)(f) GDPR).

Sensitive data and criminal data

Certain special categories of data may appear in a case file, for example health data or data relating to offences. They are processed only to the extent strictly necessary for the establishment, exercise or defence of legal claims (Articles 9(2)(f) and 10 GDPR).

Invoicing and accounting

The Mangrove practice processes the data needed for invoicing, fee collection and bookkeeping.

Legal basis: the performance of the contract and compliance with accounting and tax obligations (Articles 6(1)(b) and 6(1)(c) GDPR).

5. Recipients of the data

Your data are neither sold nor transferred for commercial purposes. They are disclosed only to the following recipients, to the extent necessary.

Some service providers act on behalf of the Mangrove practice as processors within the meaning of the GDPR:

the Website host (Infomaniak Network SA, Switzerland);
the provider in charge of Website maintenance;
providers of email, office and storage solutions;
the provider of the practice management, invoicing and document delivery software;
the provider of the data protection compliance management tool;
the fiduciary firm, for bookkeeping.

These providers are bound by a contract compliant with Article 28 GDPR. They act only on the instructions of the Mangrove practice and are bound by confidentiality.

In the context of case files, data may also be disclosed, where the assignment so requires, to the following recipients:

courts and administrative authorities;
fellow lawyers, notaries, bailiffs, experts and translators.

Certain disclosures are required by law:

to the Financial Intelligence Unit, in the cases provided for by anti-money laundering legislation;
to the Bâtonnier (President) of the Bar Association;
to authorised authorities.

6. Transfers outside the European Union

Your data are in principle hosted within the European Union or in Switzerland, a country recognised by the European Commission as providing an adequate level of protection. Some providers may, however, occasionally access them from a country outside the European Economic Area, for example for technical support or maintenance purposes.

Such transfers are subject to one of the following safeguards:

an adequacy decision of the European Commission, in particular for Switzerland, Canada and US organisations certified under the EU-U.S. Data Privacy Framework;
failing that, standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

You may obtain information about these safeguards by writing to the address given in section 2.

7. Retention periods

Data are kept only for as long as necessary for the purpose pursued, plus, where applicable, statutory retention or limitation periods. They are then deleted or anonymised.

Data	Retention period
Messages received through the contact form, with no follow-up	12 months from receipt (automatic deletion)
Data kept for conflict-of-interest checks	Retention period of the case file concerned
Connection logs	12 months maximum
Client files	10 years from the closure of the file
Identification and due diligence data (AML/CFT)	5 years after the end of the business relationship or the date of the occasional transaction, extendable by up to 5 years in the cases provided for by law
Accounting records and invoices	10 years from the end of the financial year

These periods may be extended in the event of litigation, until it is finally concluded.

8. Security and confidentiality

The Mangrove practice implements appropriate technical and organisational measures to protect your data against loss, unauthorised access, alteration or disclosure:

encryption of communications with the Website;
access control and strong authentication;
backups;
confidentiality undertakings from service providers.

These measures are part of the lawyer’s professional secrecy, any breach of which is a criminal offence (Article 458 of the Criminal Code).

9. Your rights

Under the conditions laid down by the GDPR, you have the following rights:

right of access to your data;
right to rectification;
right to erasure;
right to restriction of processing;
right to object, for processing based on our legitimate interest;
right to data portability, for data you have provided under a contract or on the basis of consent.

To exercise these rights, write to the address given in section 2. You will receive a reply within one month, which may be extended by two months if the request is complex. Where there is reasonable doubt about your identity, proof of identity may be requested.

Data whose retention is required by law, in particular under anti-money laundering rules, cannot be erased before the statutory period has expired. Anti-money laundering legislation also prohibits disclosing certain information to the data subject.

10. Complaints

If you consider that your rights are not being respected, you may lodge a complaint with the National Commission for Data Protection (CNPD), 15, boulevard du Jazz, L-4370 Belvaux (cnpd.public.lu).

You may also first contact the Mangrove practice directly in order to seek a solution.

11. Cookies and trackers

No cookies are used other than functional cookies that do not require your consent.

Any future addition of a cookie or tracker requiring consent would lead to an update of this policy and the implementation of a consent mechanism.

12. Changes

We reserve the right to amend this privacy policy, in particular to take account of legal, regulatory or technical developments. The version in force is the one published on the Website.

Last updated: 2 October 2026.