Privacy Policy & Data Protection

Ethical Data Governance

As a non-profit association serving the public interest, we never sell, rent, monetize, or commercialize your personal information. Every byte of data collected is processed strictly to fulfill voluntary correspondence and civic heritage missions.

Identity & Contact of the Data Controller

The entity responsible for the processing of personal data collected through this website is:

• Data Controller (Responsable du Traitement): ASSOCIATION POUR LA RESTAURATION ET L'ANIMATION CULTURELLE DE L'ABBAYE
• Statutory Structure: Association régie par la Loi du 1er Juillet 1901 (Non-Profit Association)
• RNA Identifier: W284000839 • SIREN Identifier: 494 079 718
• Postal Headquarters: PRESBYTERE, 14 RUE DE L'ABBAYE, 28480 THIRON-GARDAIS, FRANCE
• Data Protection Officer Liaison: Secrétariat Général & Délégué à la Protection des Données
• Electronic Mail for Privacy Requests: thykeksihwo@gmail.com
• Official Inquiries Telephone Line: +33 3 27 48 50 20

The Data Controller guarantees that all processing operations strictly adhere to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation - GDPR) and French Law No. 78-17 of 6 January 1978 as amended (Loi Informatique et Libertés).

Categories of Personal Data Collected

In accordance with the principle of data minimization (Article 5.1.c of the GDPR), the association collects only the minimum information strictly necessary to process inquiries and manage voluntary engagement:

• General Contact Inquiries: Full name, email address, optional telephone number, subject matter, and freeform message contents voluntarily entered into the public contact form.
• Volunteer Applications: Full name, email address, phone number, preferred volunteering domain (masonry, gardens, docent tours, archives, events), weekly availability, and optional motivation statements.
• Membership & Statutory Administration: Full name, postal address, email, telephone, date of admission, and annual dues payment confirmation records (excluding banking or payment card data, which is never stored on our servers).
• Technical Server Logs: IP address (anonymized after 24 hours), timestamp, requested URL, user-agent browser string, and HTTP status code generated automatically for system security and diagnostic defense against cyber threats.

The association collects zero sensitive data as defined under Article 9 of the GDPR (such as political affiliations, biometric data, genetic information, religious beliefs, or medical histories).

Purposes & Legal Bases of Data Processing

Personal data entrusted to the association is processed solely for clearly defined, lawful non-profit purposes under the following statutory grounds:

• Responding to Public Inquiries: Legal basis is the explicit consent of the user (Article 6.1.a GDPR) granted when voluntarily checking the acknowledgment box before form submission.
• Volunteer Coordination & Safety: Legal basis is the performance of pre-contractual and voluntary engagement steps and the legitimate interest of the association (Article 6.1.f GDPR) in organizing safe, insured restoration workshops.
• Statutory Association Governance: Legal basis is compliance with statutory legal obligations (Article 6.1.c GDPR) under the French Law of 1 July 1901 governing the maintenance of official member registries and general assembly convocations.
• Issuing Fiscal Deduction Receipts: Legal basis is compliance with French tax regulations (Articles 200 and 238 bis CGI) requiring the issuance and archival preservation of Cerfa receipts.

The association guarantees that your personal information is never cross-referenced with third-party databases, commercial profiling algorithms, or automated decision-making engines.

Data Retention Periods (Conservation des Données)

The association retains personal records only for the duration strictly necessary to accomplish the purpose for which they were gathered, in compliance with CNIL recommendations:

• General Public Inquiries: Retained for a maximum duration of two (2) years following the last electronic exchange, after which records are permanently purged.
• Volunteer Application Files: Retained for three (3) years from the date of application for active volunteers, or deleted within six (6) months if the candidate withdraws their candidacy.
• Member Registers: Retained throughout the duration of statutory membership, and archived for five (5) years following resignation or cessation of membership to comply with association legal prescription rules.
• Accounting & Tax Records (Fiscal Receipts): Retained for ten (10) years in accordance with Article L. 123-22 of the French Commercial Code and tax audit regulations.
• Technical Connection Logs: Retained for a maximum of twelve (12) months pursuant to Article R. 10-13 of the French Postal and Electronic Communications Code.

Upon expiration of these retention periods, all digital records are securely shredded and overwritten using irreversible cryptographic deletion protocols.

Your Rights Under the GDPR & How to Exercise Them

Under Articles 15 through 22 of the General Data Protection Regulation, every citizen maintains comprehensive sovereignty over their personal data:

• Right of Access (Article 15 GDPR): Obtain confirmation as to whether personal data concerning you is being processed, and receive a free digital copy of all held records.
• Right to Rectification (Article 16 GDPR): Demand the prompt correction of inaccurate, outdated, or incomplete personal information.
• Right to Erasure ("Right to be Forgotten", Article 17 GDPR): Request the permanent deletion of your data when it is no longer needed for non-profit processing.
• Right to Restriction of Processing (Article 18 GDPR): Request the temporary freezing of data processing during verification of accuracy.
• Right to Data Portability (Article 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format (e.g. CSV or JSON).
• Right to Object (Article 21 GDPR): Object at any moment to processing based on legitimate non-profit interest.
• Right to Withdraw Consent: Withdraw your consent at any time for processing grounded on consent, without affecting prior lawful processing.

To exercise any of these rights, simply transmit a written request accompanied by proof of identity to our Data Protection Liaison:

Our secretariat will respond within thirty (30) calendar days from receipt of your request. If you consider, after having contacted our association, that your data rights have not been respected, you have the right to lodge a formal complaint with the French supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr).

Cookie Architecture & Zero Tracking Policy

Unlike commercial web platforms that deploy behavioral tracking pixels, third-party advertising networks, and cross-site telemetry beacons, this website operates on an ethical, zero-tracking philosophy.

We utilize zero advertising cookies, zero marketing trackers, and zero commercial analytics beacons. The only cookies that may be stored are strictly functional session cookies (such as remembering an active font-size preference or anti-CSRF form tokens) exempt from consent requirements under Article 82 of the French Data Protection Act and CNIL guidelines.

You may configure your web browser (Chrome, Firefox, Safari, Edge) to reject all cookies without experiencing any degradation in your ability to browse our historical texts, research archives, or event programs.