Privacy Policy & GDPR Compliance Standards

1. Commitment to Personal Data Protection & Ethics

The ASSOCIATION COLLEGE ROYAL ET MILITAIRE DE THIRON-GARDAIS is fundamentally committed to the ethical stewardship of all personal information entrusted to us by citizens, volunteers, educators, and scholars. As a non-profit association dedicated to cultural preservation and public education, we hold the privacy rights of our community members in the highest regard.

We apply the core principles of privacy-by-design, data minimization, and absolute purpose limitation across all our digital systems. We strictly reject commercial data monetization: our association has never sold, rented, leased, or traded personal data to advertising brokers or marketing agencies, and will never do so.

2. Identification of the Data Controller (Responsable de Traitement)

The legal entity responsible for the collection and processing of your personal data on this platform is:

3. Categories of Personal Data Collected & Processing Purposes

We only collect personal information when you deliberately provide it through our official online forms or direct electronic communications. The categories of data collected and their precise non-commercial purposes include:

4. Zero Third-Party Commercial Trackers & Cookie Minimization

Unlike commercial websites that embed intrusive cross-site tracking cookies, behavioral profiling scripts, and targeted social media advertising pixels, our portal is designed to respect your browsing autonomy:

• No Commercial Profiling Cookies: We do not deploy third-party advertising cookies, retargeting pixels (such as Meta Pixel or Google Ads tags), or behavioral data brokers.
• Essential Session Functionality: Only purely technical, strictly necessary session tokens required for secure HTTP navigation and AJAX form submission handling are used.
• No Cookie Wall: Visitors enjoy full, unrestricted access to all our educational articles, reports, and public archives without being forced to accept invasive tracking conditions.

5. Strict Data Retention Schedules (Durée de Conservation)

In accordance with the principle of storage limitation under Article 5.1.e of the GDPR, personal data is retained only for the duration strictly necessary to accomplish the specified administrative purpose:

• General Contact Inquiries: Stored for a maximum of twenty-four (24) months following the date of the last communication, after which records are permanently expunged from active mailboxes.
• Volunteer Member Records: Maintained throughout the duration of active civic participation, and preserved for five (5) years following departure to fulfill statutory association liability and insurance verification requirements.
• School Visit Logs: Maintained for three (3) academic years to support regional public grant reporting, after which records are anonymized for aggregate statistical analysis.

6. Security Measures & Technical Safeguards

We implement rigorous technical and organizational measures to protect your personal information against unauthorized access, accidental alteration, disclosure, or destruction. All data transmissions between your web browser and our server are secured via modern Transport Layer Security (TLS 1.3) encryption.

Access to incoming contact dossiers and volunteer profiles is strictly restricted to authorized secretariat officers and curatorial committee leads who are bound by non-disclosure agreements and non-profit ethical guidelines.

7. Your Legal Rights Under GDPR & How to Exercise Them

Under European Regulation (EU) 2016/679 and French Law No. 78-17 of January 6, 1978, as amended, you possess comprehensive rights regarding your personal data:

1. Right of Access (Article 15 GDPR): You may request confirmation as to whether your data is being processed, and obtain a free copy of all personal records held by the association.
2. Right to Rectification (Article 16 GDPR): You have the right to obtain the prompt correction of inaccurate or incomplete personal information.
3. Right to Erasure ("Right to be Forgotten" - Article 17 GDPR): You may request the deletion of your personal data when it is no longer needed for the purposes for which it was collected.
4. Right to Restriction of Processing (Article 18 GDPR): You may demand the temporary freezing of data processing under statutory verification circumstances.
5. Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
6. Right to Object (Article 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your data based on legitimate interest.

To exercise any of these statutory rights, simply submit a written request accompanied by a proof of identity to our Data Protection Officer by email at lkjtre889@gmail.com or by postal mail to:

8. Right to Lodge a Regulatory Complaint with CNIL

If you believe, after having contacted us, that your data protection rights have not been respected in accordance with European and French law, you have the statutory right to lodge an official complaint with the French data protection supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Website: https://www.cnil.fr

9. Special Protections for Minor Students & School Groups

Given our prominent role in delivering subsidized educational programs to elementary and middle schools, the association adheres to heightened safeguards regarding minors under Article 8 of the GDPR and the French Education Code (Code de l'Éducation):

• No Individual Minor Identification: When school teachers reserve educational workshops, we register only the school institution name, teacher contact details, and aggregate headcount. Individual student identities, grades, or personal addresses are never collected by our association.
• Parental Photographic Authorizations: Any photographic documentation of school activities during educational visits requires prior written parental image rights authorization collected through the participating school administration.
• Secure Pedagogical Storage: Educational activity logs are maintained strictly for educational follow-up and public grant audits, never utilized for promotional outreach.

10. Data Security Incident Response & 72-Hour Breach Notification

In accordance with Articles 33 and 34 of the GDPR, the association maintains a formal personal data security incident protocol:

In the unlikely event of a security breach involving unauthorized access, loss, or alteration of personal information, our Data Protection Officer will notify the CNIL within 72 hours of becoming aware of the incident. If the breach poses a high risk to the rights and freedoms of affected individuals, we will communicate the nature of the breach, its anticipated consequences, and the mitigation measures implemented directly to the affected persons without undue delay.

11. Strict European Server Residency & Zero Cross-Border Transfers

All servers, digital database repositories, and archival backups utilized by the association are physically located within data centers situated in the European Union. We do not transfer personal data to jurisdictions outside the European Economic Area (EEA), guaranteeing that your personal information benefits continuously from the strict privacy protections guaranteed by European law.