Personal data protection policy - Action against Hunger

OUR COMMITMENT TO YOU

Action contre la Faim (hereinafter ‘ACF’ or ‘we’) cares about protecting the privacy of visitors to its website (hereinafter ‘visitors’ or ‘you’) and is committed to complying with French and European regulations regarding the personal data you may provide.

Within the framework of this processing, ACF acts as a data controller under the terms defined by the General Data Protection Regulation 2016/679 of 27 April 2016 (hereinafter ‘GDPR’). The data controller is represented by the president of ACF (currently, Aïcha Koraïchi).

In particular, ACF undertakes never to sell or rent your personal data for any reason, including for commercial purposes, and is committed to making the systems used to process the data you provide secure and protected against potential attacks or leaks.

In its fundraising, ACF works with various partners. In accordance with the information we provide every time your data is collected, your data may be transferred to or exchanged with other associations, and you may be contacted by them.

In accordance with this data protection policy, you may consult a list of these partners at any time and object to the sharing of this information.

In addition, we are regularly audited by certification authorities, including Don en confiance, which monitors and certifies fundraising associations and foundations and has put together a code of ethics for them.

DEFINITION OF TERMS

The capitalised terms in this policy will carry the following meaning, in line with the GDPR. To aid comprehension of this policy, here are some key concepts used in it:

Personal Data: This is any information relating to a natural person who may be identified, either directly or indirectly.

Data Processing: This means any operation performed on Personal Data by any means. For example, it includes the recording, organisation, storage and alteration of Personal Data and alignment of Personal Data with other data.

Legal Basis: The Legal Basis for processing is what allows the processing to take place. In other words, it is what gives an organisation the right to process Personal Data. Synonyms include ‘lawful basis’ and ‘legal grounds’ for processing.

Purpose: The Purpose of the processing is the main objective with which the Personal Data are used. This main Purpose may be divided into sub-purposes (sub-objectives).

Controller: In theory, the Controller is the person, public authority, company or body that decides to create the filing system and determines its Purposes and means. In practice, the Controller is generally a legal person (company, collective, etc.) embodied by its legal representative.

Processor: a Processor is a natural or legal person (company or public body) which processes data on behalf of another body (the Controller) within the framework of a service.

Recipient: A Recipient is a person to whom the data recorded in a file or being processed are disclosed, due to their functions.

Data Transfer: This is any communication, copying or movement of Personal Data to be processed in a country outside the European Union.

APPLICATION OF THIS DATA PROTECTION POLICY

This policy aims to describe the Data Processing carried out by ACF as the Controller on its website (https://www.actioncontrelafaim.org/) and to detail your rights under the GDPR and the amended French data protection law.

This policy therefore covers all Data Processing relating to the creation of your account in the donor area (https://monespace.actioncontrelafaim.org/connexion/) and to the management of your account (including processing relating to your registration, your payments, etc.), as well as Data Processing on the recruitment website (https://recrutement.actioncontrelafaim.org/fr/) relating to the management of your applications for our job vacancies.

Other websites, such as ‘https://jedej-jedonne.org/’ are hosted and managed by our partners and therefore come with their own data protection policies for Data Processing, though all of your data rights will be guaranteed in the same way.

TYPES OF DATA COLLECTED

When you visit our website, you may provide us with the following information:

MANAGEMENT OF YOUR DONOR AND MEMBER AREAS

Identification details: marital status
Contact information: email address, postal address, telephone number
Payment information: payment method, bank card number, IBAN
Identity documents

FUNDRAISING – DONATIONS

Identification details: marital status
Contact information: email address, postal address, telephone number

PROSPECTING, MARKETING AND AWARENESS-RAISING ACTIVITIES

Identification details: marital status
Contact information: email address, postal address, telephone number

MANAGEMENT OF APPLICATIONS AND HUMAN RESOURCES

Identification details: marital status
Contact information: email address, postal address, telephone number
Information about education: level of studies, qualifications
Information about professional life: professional experience, references

MANAGEMENT OF ACCESS REQUESTS

Identification details: marital status
Contact information: email address, postal address, telephone number
Information about your request

STATISTICAL PROCESSING

See section and our Cookies page.

WHY DO WE PROCESS YOUR DATA AND TO WHOM DO WE TRANSFER THEM?

We only process your data for certain Purposes and in accordance with these Purposes.

The Purposes on this website are as follows:

Management of your areas (member area and donor area).
Management of your donations and for fundraising appeals.
Downloading information, such as information brochures.
Management of your applications and human resources.
Management of your requests to exercise rights.
Processing carried out by cookies (see the dedicated cookies page).

WHAT IS THE DIFFERENCE BETWEEN THE DONOR AREA AND THE MEMBER AREA?

Member: When you make occasional or regular donations, you can access your donor area, where you can consult your donation history, inform us of any changes to your contact details (postal address, telephone number, email address, etc.) and print out duplicates of your tax receipts. Meanwhile, you can access your member area only if you are a member of the association who pays the yearly subscription and participates in the association’s activities, such as the general meeting. In accordance with the statutes in effect, the Board of Directors must approve anyone who wishes to become a member, and to do so, this person’s identity must be verified. For this reason, an ID document must be presented alongside any new membership or membership renewal requests.

Donor: If you are an Action contre la Faim donor, you can create your Donor Area. To do so, simply click on the following link: https://monespace.actioncontrelafaim.org/ and register by completing the indicated fields without any special characters (replace hyphens and apostrophes with a space).

You may exercise your rights at any time, in accordance with section of the policy.

MANAGEMENT OF YOUR MEMBER AREA

This section deals with the Data Processing necessary in the member area, ‘My Area’, accessible at the following address: http://www.adherents-acf.org/.

Personal Data area collected so that we may manage your membership requests and subscription fee, as well as your online area.

This Data Processing is based on our precontractual or contractual relationship (article 6.1.b of the GDPR) prior to the creation of your account and for the duration of your account’s existence.

Information gathered relating to members is recorded in a database by ACF and passed on to the Action contre la Faim president’s administration office for internal management purposes, in order to manage our relationship.

MANAGEMENT OF YOUR DONOR AREA

This section deals with the Data Processing necessary in the donor area, ‘My Area’, accessible at the following address: https://monespace.actioncontrelafaim.org/connexion/

Personal Data are collected in order to manage our relationship with you. You can consult your donation history, modify your personal details, download tax receipt duplicates, view your documents, adjust your request settings and change your password.

Information gathered relating to donors and members is recorded in databases by ACF and passed on to the Donor Relations Department in Action contre la Faim’s Communication and Development Section for internal management purposes, in order to respond to your requests or to carry out fundraising appeals.

FUNDRAISING – DONATIONS

This section is about Data Processing carried out when you make a donation on ACF’s donation page.

The Legal Basis for this processing is our contractual relationship (article 6.1.b of the GDPR), as well as the pursuit of ACF’s legitimate interests (article 6.1.f of the GDPR) in the case of subsequent prospecting, based on the ‘charity exception’.

Information gathered relating to prospects is recorded in a database by ACF and passed on to the Marketing Department in Action contre la Faim’s Communication and Development Section in order to carry out fundraising appeals.

As part of the management of your Personal Data, they may be transferred within the European Union or outside it, exclusively to partners who comply with GDPR, data protection and data security requirements.

In accordance with its commitments, ACF will not sell or rent any of your information to a for-profit organisation (even for marketing purposes). However, the details of your donor profile may, on a not-for-profit basis, be communicated to or exchanged with other fundraising bodies or associations. You may exercise your rights or object to these exchanges at any time by sending a request by email to dpo@actioncontrelafaim.org. For more information on your rights, please consult the section on exercising your rights.

PROSPECTING, MARKETING AND AWARENESS-RAISING ACTIVITIES

This section concerns all Data Processing carried out as part of downloads of our information brochures and as part of our newsletter download form.

Personal Data are collected in order to send you institutional marketing materials, carry out marketing and awareness-raising campaigns and provide you with information brochures.

The Legal Basis for this processing is the pursuit of ACF’s legitimate interests, namely managing your relationship with us, processing your requests and communicating information on our activities, in line with article 6.1.f of the GDPR.

Information gathered relating to prospects and donors is recorded in a database by ACF and passed on to the Marketing Department in Action contre la Faim’s Communication and Development Section for internal management purposes, in order to respond to your requests or to carry out fundraising appeals.

When managing your Personal Data, we will not transfer them to our partners or Processors outside the European Union.

In accordance with its commitments, ACF will not sell or rent any of your information to a for-profit organisation (even for marketing purposes). However, the details of your donor profile may, on a not-for-profit basis, be communicated to or exchanged with other fundraising bodies or associations. You may exercise your rights or object to these exchanges at any time by sending a request by email to: dpo@actioncontrelafaim.org.

MANAGEMENT OF APPLICATIONS AND HUMAN RESOURCES

This section deals with the Data Processing necessary in the recruitment area, ‘Career Area’, accessible at the following address: https://recrutement.actioncontrelafaim.org/fr/ .

Personal Data are collected in order to manage your application(s) (internships, block releases, employment contracts). Applications to take part in volunteering initiatives are processed by the Delegations Department.

The Legal Basis for this processing is our precontractual or contractual relationship (article 6.1.b of the GDPR). Information gathered relating to prospects and donors is recorded in a database by ACF and passed on to the Recruitment Department in Action contre la Faim’s Human Resources Section for internal management purposes, in order to respond to your application requests or manage the recruitment process.

As part of the management of your data, they may be transferred within the European Union or outside it, exclusively to partners who comply with GDPR, data protection and data security requirements.

In accordance with its commitments, ACF will not sell or rent any of your information to a for-profit organisation (even for marketing purposes). Nonetheless, the details of your profile may be kept in our databases so that we can call upon you at a later date or as part of the ‘recruiting ground’, which consists of saving your profiles for ACF’s future needs.

MANAGEMENT OF YOUR REQUESTS TO EXERCISE RIGHTS

This section concerns the Data Processing necessary for your Personal Data access requests via the address dpo@actioncontrelafaim.org to be managed.

The Legal Basis for this processing is our legal obligation to respond to your queries regarding the management of your Personal Data, pursuant to article 6.1.b of the GDPR.

Information gathered regarding this process is recorded in a database by ACF and passed on to the Legal Department and the Donor Relations Department in Action contre la Faim’s Communication and Development Section for internal management purposes, in order to respond to your requests.

When managing your Personal Data, we will not transfer them to our partners or Processors outside the European Union.

Please note that the sole purpose of the address dpo@actioncontrelafaim.org is to respond to your requests and queries regarding management of your Personal Data. Therefore, any other requests or queries will not be answered.

STATISTICAL PROCESSING

The website https://www.actioncontrelafaim.org/ may also carry out statistical processing of your data (donation forms, donor area, campaign sites), especially via Google Analytics in order to track the website’s performance, provide a good user experience and analyse profiles.

The Legal Basis for this Data Processing is the pursuit of ACF’s legitimate interests, namely optimising our activities and actions and improving our marketing, in line with article 6.1.f of the GDPR.

Information gathered in this process is recorded in a database by ACF and passed on to the Marketing Department in Action contre la Faim’s Communication and Development Section. This statistical information is mainly collected via Cookies, in accordance with the selection below. You may accept or refuse this use of cookies.

WHO ARE THE RECIPIENTS OF DATA AND DATA TRANSFERS?

Your Personal Data is passed on to the relevant authorised departments and persons within ACF and to the ACF establishments and local structures concerned, where necessary.

Your Personal Data may be communicated to technical and commercial partners and service providers and to Processors in order to fulfil the objectives mentioned above in this policy on our behalf.

Please be assured that these partners and service providers:

have limited access to your Personal Data: only to the extent required for them to provide their services, in accordance with the principle of minimisation
are contractually obliged to use your Personal Data in accordance with our instructions and the legal Personal Data Protection provisions in effect

These partners or Processors may be located outside of the European Union, in countries that do not guarantee a high enough level of data protection. These Data Transfers are covered by the appropriate guarantees, such as the signing of standard data protection clauses adopted by the European Commission.

Furthermore, we may communicate some of your Personal Data when requested to do so by legal, police or administrative authorities legally authorised to see them (for example, in the event of a tax audit, a request from the Court of Auditors or an audit by our statutory auditors).

FOR HOW LONG WILL YOUR DATA BE RETAINED?

Your Personal Data will be retained for the time necessary for the Personal Data Processing Purposes detailed above to be fulfilled.

Your Personal Data will be destroyed once we are no longer using them or when you exercise your right to erasure, subject to certain legal and regulatory provisions that require us to archive some of your data.

CREATION AND MANAGEMENT OF YOUR ONLINE ACCOUNT IN THE DONOR AREA

Prospecting data are retained for 3 years from the last contact.
Donor data are retained until a request for the account to be deleted and for a period of 6 years.
Donation-related data are retained for 3 years then archived for 3 years.
Data relating to payment cards are retained for the time needed for the transaction to go through, then archived for 13 months for evidence purposes in case the transaction is disputed.

MANAGEMENT OF YOUR MEMBER AREA

Membership data are retained for the duration of the membership, then up to 6 years without any financial movements.

PROSPECTING, MARKETING AND AWARENESS-RAISING ACTIVITIES

Data are retained for 3 years starting from the last contact with ACF, then they are deleted.

VOLUNTEER MANAGEMENT

Data are retained for 3 years from the end of the volunteer mission.

MANAGEMENT OF APPLICATIONS AND HUMAN RESOURCES

Application-related data are retained for 2 years.
After this time, an email will be sent asking you if you wish to update your application.
In any case, the data will be archived for the applicable prescriptive periods according to the relevant laws and regulations in effect.

MANAGEMENT OF ACCESS REQUESTS

Data are retained for as long as it takes to respond to the requests, and are then archived for the applicable prescriptive periods according to the relevant laws and regulations in effect.

WHAT DATA PROTECTION MEASURES ARE IN PLACE?

We commit to taking all the physical and electronic measures necessary to guarantee the security and confidentiality of your data and to ensure that they are accurate and up to date, including the following:

Regular maintenance of our IT equipment.
Staff accountability.
Staff training in best IT practices.
Use of tools that protect against IT attacks (such as antivirus software, antispam, firewalls, etc.).
Controls on access to the internet in the organisation.
Controls on access to information in the organisation, especially sensitive information.
Hosting of data in secure, monitored environments (both physical and software-based).
Implementation of adapted, secure, thorough backups.

In addition, Action contre la Faim undertakes to choose service providers and partners who guarantee compliance with French and European Personal Data protection regulations.

PREVENTION AGAINST PHISHING

Phishing is a form of fraudulent communication that can take a variety of forms (SMS, e-mail, messages, calls) and is designed to trick people into disclosing their personal data by pretending to be a company or organization, in our case Action contre la Faim.

The aim of phishing is to steal personal or professional information (accounts, passwords, bank details, etc.) for fraudulent use (identity theft, theft of login details, theft of bank details, etc.). Phishing attempts can be more or less well executed (copy of logo, graphic charter, writing style), but a fraudulent communication often has warning signs that can be detected:

Similar mail domain e.g. acti0nc0ntrelafaim.com
Spelling mistakes
Allusion to an urgent need
Request to click on a link to enter contact details

Here are a few simple rules:

Never communicate important information (credit card number, password) by clicking on a link received by e-mail without checking the domain from which it was sent;
Don’t reply to suspicious e-mail messages requesting sensitive information;
Go back to the home page of a site to log in to a personal space or to modify personal information, rather than through a link inserted in an e-mail.
The domains used for Action Against Hunger e-mail campaigns always end in .org. Our domains can be: example.actioncontrelafaim.org

To find out more, visit the CNIL website: Phishing: detecting a malicious message | CNIL

If in doubt, contact us via the form, selecting “SPAM or Phishing Alert” from the drop-down menu.

If you think you’ve been phished by someone posing as Action contre la Faim, please visit cybermalveillance.gouv.

HOW CAN YOU EXERCISE YOUR RIGHTS?

In accordance with the French data protection law of 6 January 1978 and with the GDPR, you may access data concerning you, rectify them, ask for them to be erased and exercise your right to restrict the processing of your data. You may also withdraw your consent and establish guidelines for the management of your data after your death.

You may exercise your rights without needing to provide any ID documents. However, you may be asked to provide ID if we are unable to identify you or if you are acting on someone else’s behalf through power of attorney.

Exercise your rights with just a click:

If you no longer wish to receive communication from Action contre la Faim or would like to exercise your rights, you may contact us through the following channels:

By post: ACTION CONTRE LA FAIM – For the attention of DPO – 102 rue de Paris– 93100 Montreuil
By email: dpo@actioncontrelafaim.org

This email address is not intended for job applications or related queries.

For information on your applications, please go to the recruitment page: https://recrutement.actioncontrelafaim.org/en/

HOW CAN I MAKE A CLAIM OR LODGE A COMPLAINT?

After contacting ACF, if you deem that your rights have not been respected, you may lodge a complaint with CNIL, the French data protection authority.

You may submit a claim with CNIL, which will guarantee the protection of your rights. This may be done online.

Online: https://www.cnil.fr/fr/plaintes/internet,
By post: 3, place de Fontenoy, TSA 80715-77334.

This policy may be modified at any time.

We invite you to consult it regularly in the dedicated section on our website.
Last modified: 01/06/2021.