Privacy policy

Last updated: October 31, 2026

Data controller

The association Sauvegarde du Patrimoine Pontique du Bois-des-Fossés (SPPBDF), 2 chemin du Bois des Fossés, 45210 Chevannes, France, represented by its president. Contact: sppbdf@orange.fr.

Data collected, purposes and retention periods

Membership form (Subscription page)

  • Data: email address, first name, last name, postal address, country, your consent given by ticking the checkbox.
  • Purpose: to process your membership application and manage the relationship with members (dues, notices of meetings, news of the association).
  • Legal basis: your consent and the performance of your membership.
  • Retention: for the duration of the membership, then 3 years.

Contact form

  • Data: name (optional), email address and message, forwarded by email to the association.
  • Purpose: to answer your request.
  • Legal basis: the association’s legitimate interest in answering the messages it receives.
  • Retention: 1 year after the last exchange.

Members’ area

  • Data: username, email address, name, date and IP address of logins. Accounts are created by the association; there is no open registration.
  • Purpose: to give access to members-only content and to secure that access.
  • Legal basis: the performance of your membership.
  • Retention: for the duration of the membership; the account is deleted no later than 3 years after it ends, or earlier on request. The login history (date, IP address) is kept for 30 days, failed login attempts for 12 months at most.

Technical logs and security

  • Data: IP address, date and time, requested page and browser, recorded by the server on each visit.
  • Purposes: website security (automatic detection and blocking of intrusion attempts; addresses behind repeated attacks may be blocked permanently) and overall visit statistics, produced on the server without cookies or third-party services.
  • Legal basis: the association’s legitimate interest in securing its website.
  • Retention: 14 days for the server logs; 12 months at most for security and traffic reports, and for addresses blocked after repeated abuse.

The website uses no third-party audience measurement, no advertising and no social media buttons. It does not display comments.

Cookies

The website only sets cookies that are strictly necessary for it to work, which do not require your consent:

  • pll_language: remembers the language you chose (1 year);
  • WordPress login cookies (wordpress_logged_in_…, wordpress_sec_…): for logged-in members only, for the duration of the session.

Recipients and processors

Data is only accessible to authorized members of the board. It is never sold or transferred. The association uses the following service providers:

  • OVH (France): delivery of emails sent by the website;
  • Dropbox (Dropbox International Unlimited Company, Ireland): storage of the website’s backup copies, whose data may be processed in the United States under the EU–US Data Privacy Framework.

The website itself is hosted in France on a server operated for the association.

Backups

The website is backed up regularly; copies are renewed on a rotating basis and kept for a few weeks. Data deleted from the website disappears from backups when they expire.

Security

Exchanges with the website are encrypted (HTTPS). Access to the administration is restricted and protected by two-factor authentication, and intrusion attempts are blocked automatically.

Your rights

You have the right to access, rectify, erase and restrict the processing of your data, to object to it, to data portability, and to withdraw your consent at any time. You may also give instructions regarding the fate of your data after your death.

To exercise these rights, write to sppbdf@orange.fr or to the association’s postal address. If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).