Privacy policy

This page describes exactly what we do with the data you give us. It is written to be read, not to be long.

Last updated :

This page is not complete yet

Some legally required details are missing. Fill them in at lib/legal/association.ts and this warning disappears by itself. Missing fields:

  • rnaNumber
  • publicationDirector
  • phone
  • host.name
  • host.address
  • host.phone

In short

  • We never sell or rent your data to anyone.
  • This site uses no analytics and no advertising trackers.
  • If you do not fill in a form and do not sign in, we set no cookies at all.
  • You can ask to see, correct or delete your data at any time.

Data controller

Data collected on this site is processed by the association, whose details appear in the legal notice. Legal notice.

What we collect

We only collect data you send us. There are just two forms on this site.

Contact form

Data
Name, email address, subject and message.
Purpose
To reply to you.
Lawful basis
Legitimate interest: answering someone who writes to us.

Sponsorship request

Data
First name, last name, email address, phone (optional), intended amount, the child concerned if you named one, and your message.
Purpose
To consider your request and contact you to complete it.
Lawful basis
Pre-contractual steps taken at your request.

Technical data attached to a submission

Data
IP address, browser identifier (user agent) and form language.
Purpose
Only to detect automated submissions and abuse. It is not used for analytics or profiling.
Lawful basis
Legitimate interest: keeping the service secure.

Team accounts

Volunteers with access to the admin have an account: email address, name, open sessions, recognised devices and a sign-in log. This concerns the team, not visitors.

How long we keep it

These periods are not aspirational: an automated task applies them every day.

  • IP address and browser identifier: erased after 90 days, whatever became of your message. They exist only to spot automated submissions, which stops being a live question within days.
  • Submissions identified as spam: deleted after 30 days.
  • Messages and requests that have been handled: deleted after 2 years.
  • Requests still awaiting a reply: kept until they are handled. We never automatically delete a request nobody has answered.

You can ask us to delete your data sooner. We do so without asking you to justify the request.

Who can see your data

Your data is read by the association's volunteers handling your request. We also use technical providers, who act only on our instructions:

  • the site's hosting provider, named in the legal notice;
  • our email provider, to deliver internal notifications;
  • Cloudflare R2, for storing images published on the site.

No data is sold, rented, or passed on for advertising purposes.

Third-party services on this site

Some pages load content hosted elsewhere. Those services then receive your IP address, as with any website visit:

  • Google Maps, on the Contact page only, to display the map. Google may set its own cookies there.
  • Images served from an external delivery network.

Cookies

This site uses no analytics, statistics or advertising cookies. If you browse without signing in and without submitting a form, we set no cookies.

Two technical cookies are set only when a team member signs in to the admin; they keep the session for seven days. They are strictly necessary for signing in to work.

Your choice on the cookie banner is saved in your browser's local storage, not in a cookie. It never leaves your device. Clearing the site's data erases it.

Children's photographs and profiles

The sponsorship programme publishes each supported child's first name, age, school level, district and a photograph.

No surname, no address and no information that would precisely locate a child is published. Any removal request from a family is acted on immediately.

Your rights

The GDPR gives you the right:

  • to access the data we hold about you;
  • to have it corrected if it is wrong;
  • to ask for it to be deleted;
  • to receive a copy in a machine-readable format;
  • to object to the processing or ask us to restrict it.

To exercise any of these, write to us. A plain request is enough; we reply within one month.

If our answer does not satisfy you, you may complain to the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or at cnil.fr.

Security

Traffic to this site is encrypted. The forms are protected against automated submissions and rate-limited. Access to the admin is restricted to authorised accounts and logged.

Changes

This policy may change as the site does. The date it was last updated is at the top of this page.

Contact us

For any question about your data, or to exercise your rights: contact@lwnf.org

See also — Terms of use