Data Privacy Policy & Protection of Personal Rights

1. Data Controller Identification (Responsable de Traitement)

The data controller responsible for the processing of personal data collected through this website and during our cultural activities is:

2. Lawful Bases & Specific Purposes of Data Processing

Association 1381 processes personal data strictly for legitimate non-profit institutional and educational purposes. We never engage in commercial profiling, behavioral ad retargeting, or automated credit scoring. The specific lawful bases and purposes comprise:

• Workshop Enrollment & Attendance (Performance of Contract / Consent): Processing participant names, contact details, and emergency contacts to manage course rosters, guarantee studio safety, and notify participants of scheduling updates.
• Statutory Membership Registry (Legal Obligation): Maintaining an accurate register of active voting members pursuant to the French Law of 1901 and prefectural administrative requirements.
• General Inquiries & Public Communication (Legitimate Interest): Responding to questions, document requests, or partnership proposals transmitted via our institutional contact forms.
• Tax Receipt Issuance (Legal Obligation): Processing taxpayer donor coordinates required to generate official CERFA n° 11580*05 tax deduction certificates under Article 200 of the French General Tax Code.

3. Absolute Non-Commercial Commitment

Association 1381 provides an absolute institutional guarantee that personal information collected is never sold, rented, monetized, exchanged, or transferred to third-party commercial marketing entities or advertising brokers under any circumstances.

Data access is strictly restricted to designated volunteer officers, workshop facilitators, and accredited administrative staff bound by confidentiality obligations, acting solely in the execution of their non-profit duties.

4. Retention Periods (Durée de Conservation)

In accordance with the principle of storage limitation (Article 5(1)(e) of the GDPR), personal data is retained only for the duration strictly necessary to fulfill the purpose for which it was gathered:

• Contact Inquiries: Retained for a maximum of twelve (12) months following the final exchange, then permanently deleted.
• Workshop Enrollment Records: Retained for the duration of the educational term plus one academic year for statistical impact reporting.
• Statutory Membership Records: Retained for the duration of active membership plus five (5) years in historical association archives per legal mandates.
• Financial & Tax Receipt Records: Retained for ten (10) years in compliance with statutory French accounting obligations (Code de Commerce Article L123-22).

5. Your Individual Rights Under the GDPR

Under Chapter III of Regulation (EU) 2016/679, you possess the following enforceable rights concerning your personal information:

To exercise any of these rights, please submit a written request accompanied by proof of identity to our Privacy Secretariat at donnees@association1381.org or by registered postal mail addressed to: Association 1381 - Délégué aux Données, 38 Rue des Rouliers, 28000 Chartres, France. We will reply within thirty (30) calendar days.

6. Cookie Policy & Web Tracking Architecture

Association 1381 operates this website on privacy-by-design principles. We do not use third-party advertising cookies, behavioral tracker scripts, or invasive social media pixel beacons.

The only cookies utilized are strictly necessary technical session cookies required for core platform navigation, CSRF security verification, and accessibility settings. These essential cookies do not require prior consent under CNIL guidelines and cannot be used to track your browsing activity across other websites.

7. Data Security Measures (Article 32 GDPR)

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

• End-to-end transport layer encryption using modern TLS 1.3 cryptographic protocols.
• Access control restrictions enforcing least-privilege administrative access policies.
• Daily automated encrypted backups deposited in secure French data center facilities.
• Periodic vulnerability audits and static code reviews of form submission scripts.

8. Right to Lodge a Complaint with the Supervisory Authority (CNIL)

If, after contacting our privacy secretariat, you believe that your data protection rights have not been respected, you have the statutory right to lodge an official regulatory complaint with the French data protection supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Telephone: +33 (0)1 53 73 22 22 • Online Complaint Portal: https://www.cnil.fr/en/plaintes