Personal data protection policy - Action against Hunger

OUR COMMITMENT TO YOU

Action contre la Faim (hereinafter ‘ACF’ or ‘we’) cares about protecting the privacy of visitors to its website (hereinafter ‘visitors’ or ‘you’) and is committed to complying with French and European regulations regarding the personal data you may provide.

Within the framework of this processing, ACF acts as a data controller under the terms defined by the General Data Protection Regulation 2016/679 of 27 April 2016 (hereinafter ‘GDPR’). The data controller is represented by the president of ACF (currently, Aïcha Koraïchi).

In particular, ACF undertakes never to sell or rent your personal data for any reason, including for commercial purposes, and is committed to making the systems used to process the data you provide secure and protected against potential attacks or leaks.

In its fundraising, ACF works with various partners. In accordance with the information we provide every time your data is collected, your data may be transferred to or exchanged with other associations, and you may be contacted by them.

In accordance with this data protection policy, you may consult a list of these partners at any time and object to the sharing of this information.

In addition, we are regularly audited by certification authorities, including Don en confiance, which monitors and certifies fundraising associations and foundations and has put together a code of ethics for them.

DEFINITION OF TERMS

The capitalised terms in this policy will carry the following meaning, in line with the GDPR. To aid comprehension of this policy, here are some key concepts used in it:

Personal Data: This is any information relating to a natural person who may be identified, either directly or indirectly.

Data Processing: This means any operation performed on Personal Data by any means. For example, it includes the recording, organisation, storage and alteration of Personal Data and alignment of Personal Data with other data.

Legal Basis: The Legal Basis for processing is what allows the processing to take place. In other words, it is what gives an organisation the right to process Personal Data. Synonyms include ‘lawful basis’ and ‘legal grounds’ for processing.

Purpose: The Purpose of the processing is the main objective with which the Personal Data are used. This main Purpose may be divided into sub-purposes (sub-objectives).

Controller: In theory, the Controller is the person, public authority, company or body that decides to create the filing system and determines its Purposes and means. In practice, the Controller is generally a legal person (company, collective, etc.) embodied by its legal representative.

Processor: a Processor is a natural or legal person (company or public body) which processes data on behalf of another body (the Controller) within the framework of a service.

Recipient: A Recipient is a person to whom the data recorded in a file or being processed are disclosed, due to their functions.

Data Transfer: This is any communication, copying or movement of Personal Data to be processed in a country outside the European Union.

APPLICATION OF THIS DATA PROTECTION POLICY

This policy aims to describe the Data Processing carried out by ACF as the Controller on its website (https://www.actioncontrelafaim.org/) and to detail your rights under the GDPR and the amended French data protection law.

This policy therefore covers all Data Processing relating to the creation of your account in the donor area (https://monespace.actioncontrelafaim.org/connexion/) and to the management of your account (including processing relating to your registration, your payments, etc.), as well as Data Processing on the recruitment website (https://recrutement.actioncontrelafaim.org/fr/) relating to the management of your applications for our job vacancies.

Other websites, such as ‘https://jedej-jedonne.org/’ are hosted and managed by our partners and therefore come with their own data protection policies for Data Processing, though all of your data rights will be guaranteed in the same way.

TYPES OF DATA COLLECTED

When you visit our website, you may provide us with the following information:

WHY DO WE PROCESS YOUR DATA AND TO WHOM DO WE TRANSFER THEM?

We only process your data for certain Purposes and in accordance with these Purposes.

The Purposes on this website are as follows:

Management of your areas (member area and donor area).
Management of your donations and for fundraising appeals.
Downloading information, such as information brochures.
Management of your applications and human resources.
Management of your requests to exercise rights.
Processing carried out by cookies (see the dedicated cookies page).

WHO ARE THE RECIPIENTS OF DATA AND DATA TRANSFERS?

Your Personal Data is passed on to the relevant authorised departments and persons within ACF and to the ACF establishments and local structures concerned, where necessary.

Your Personal Data may be communicated to technical and commercial partners and service providers and to Processors in order to fulfil the objectives mentioned above in this policy on our behalf.

Please be assured that these partners and service providers:

have limited access to your Personal Data: only to the extent required for them to provide their services, in accordance with the principle of minimisation
are contractually obliged to use your Personal Data in accordance with our instructions and the legal Personal Data Protection provisions in effect

These partners or Processors may be located outside of the European Union, in countries that do not guarantee a high enough level of data protection. These Data Transfers are covered by the appropriate guarantees, such as the signing of standard data protection clauses adopted by the European Commission.

Furthermore, we may communicate some of your Personal Data when requested to do so by legal, police or administrative authorities legally authorised to see them (for example, in the event of a tax audit, a request from the Court of Auditors or an audit by our statutory auditors).

FOR HOW LONG WILL YOUR DATA BE RETAINED?

Your Personal Data will be retained for the time necessary for the Personal Data Processing Purposes detailed above to be fulfilled.

Your Personal Data will be destroyed once we are no longer using them or when you exercise your right to erasure, subject to certain legal and regulatory provisions that require us to archive some of your data.

WHAT DATA PROTECTION MEASURES ARE IN PLACE?

We commit to taking all the physical and electronic measures necessary to guarantee the security and confidentiality of your data and to ensure that they are accurate and up to date, including the following:

Regular maintenance of our IT equipment.
Staff accountability.
Staff training in best IT practices.
Use of tools that protect against IT attacks (such as antivirus software, antispam, firewalls, etc.).
Controls on access to the internet in the organisation.
Controls on access to information in the organisation, especially sensitive information.
Hosting of data in secure, monitored environments (both physical and software-based).
Implementation of adapted, secure, thorough backups.

In addition, Action contre la Faim undertakes to choose service providers and partners who guarantee compliance with French and European Personal Data protection regulations.

PREVENTION AGAINST PHISHING

Phishing is a form of fraudulent communication that can take a variety of forms (SMS, e-mail, messages, calls) and is designed to trick people into disclosing their personal data by pretending to be a company or organization, in our case Action contre la Faim.

The aim of phishing is to steal personal or professional information (accounts, passwords, bank details, etc.) for fraudulent use (identity theft, theft of login details, theft of bank details, etc.). Phishing attempts can be more or less well executed (copy of logo, graphic charter, writing style), but a fraudulent communication often has warning signs that can be detected:

Similar mail domain e.g. acti0nc0ntrelafaim.com
Spelling mistakes
Allusion to an urgent need
Request to click on a link to enter contact details

Here are a few simple rules:

Never communicate important information (credit card number, password) by clicking on a link received by e-mail without checking the domain from which it was sent;
Don’t reply to suspicious e-mail messages requesting sensitive information;
Go back to the home page of a site to log in to a personal space or to modify personal information, rather than through a link inserted in an e-mail.
The domains used for Action Against Hunger e-mail campaigns always end in .org. Our domains can be: example.actioncontrelafaim.org

To find out more, visit the CNIL website: Phishing: detecting a malicious message | CNIL

If in doubt, contact us via the form, selecting “SPAM or Phishing Alert” from the drop-down menu.

If you think you’ve been phished by someone posing as Action contre la Faim, please visit cybermalveillance.gouv.

HOW CAN YOU EXERCISE YOUR RIGHTS?

In accordance with the French data protection law of 6 January 1978 and with the GDPR, you may access data concerning you, rectify them, ask for them to be erased and exercise your right to restrict the processing of your data. You may also withdraw your consent and establish guidelines for the management of your data after your death.

You may exercise your rights without needing to provide any ID documents. However, you may be asked to provide ID if we are unable to identify you or if you are acting on someone else’s behalf through power of attorney.

Exercise your rights with just a click:

If you no longer wish to receive communication from Action contre la Faim or would like to exercise your rights, you may contact us through the following channels:

By post: ACTION CONTRE LA FAIM – For the attention of DPO – 102 rue de Paris– 93100 Montreuil
By email: dpo@actioncontrelafaim.org

This email address is not intended for job applications or related queries.

For information on your applications, please go to the recruitment page: https://recrutement.actioncontrelafaim.org/en/

HOW CAN I MAKE A CLAIM OR LODGE A COMPLAINT?

After contacting ACF, if you deem that your rights have not been respected, you may lodge a complaint with CNIL, the French data protection authority.

You may submit a claim with CNIL, which will guarantee the protection of your rights. This may be done online.

Online: https://www.cnil.fr/fr/plaintes/internet,
By post: 3, place de Fontenoy, TSA 80715-77334.

This policy may be modified at any time.

We invite you to consult it regularly in the dedicated section on our website.
Last modified: 01/06/2021.