Politique de confidentialité | La Seigneurie de Coucy

Article 1

Data controller

The controller of the data collected through this site is the AMVCC (Association de Mise en Valeur du Château de Coucy), a non-profit association under the French law of 1901, whose registered office is at 7-9 rue du Pot d'Étain, 02380 Coucy-le-Château-Auffrique, France.

Contact email: seigneuriedecoucy@amvcc.com
Data Protection Officer (DPO): No data protection officer has been appointed: requests are handled directly by the association's board at the address above.

Article 2

Purposes and legal bases of processing

Data is collected for specified, explicit and legitimate purposes. Each processing operation relies on a specific legal basis within the meaning of article 6 of the GDPR, and the data is kept for a limited period.

Contact form

Purpose: responding to requests for information, collaboration, press or services sent through the site's contact form. Legal basis : the person's consent (GDPR article 6.1.a). Data collected : identity, email, phone number and organisation if provided, content of the message. Retention period : 3 years from the last contact. Status: active.

Application form

Purpose: processing volunteer applications and organising the process of joining the troupe. Legal basis : the person's consent (GDPR article 6.1.a). Data collected : identity, email, town or department, skills or areas of interest, availability, motivation. Retention period : 2 years from receipt of the application, then automatic deletion if the applicant has not joined the troupe. Status: active.

Newsletter

Purpose: keeping subscribers informed of the association's events, publications and news. Legal basis : the person's consent, obtained through a double opt-in mechanism (confirmation by email), in accordance with article 6.1.a of the GDPR and the CNIL recommendation. Data collected : email address only. Retention period : until the person unsubscribes (one-click unsubscribe link in every email) or after 3 years of inactivity. Status: active.

Audience measurement (Umami)

Purpose: measuring site traffic and understanding how visitors move through it, in order to improve the content. Legal basis : the association's legitimate interest (GDPR article 6.1.f). Tool: Umami, self-hosted on the association's infrastructure, with no cookies and no personal identifier. No data is passed on to any third party and no individual profile is built. Data collected : pages viewed, referrer, device type and country (derived from an anonymous fingerprint reset every day). Retention period : 13 months maximum, in line with the CNIL recommendations for audience measurement without consent.

Article 3

Recipients and processors

The data collected is intended for the members of the AMVCC board and, where applicable, for the members of the troupe in charge of handling the request (applications, event organisation). It is never transferred, rented or sold to third parties.

The site is self-hosted by the association: no processor is involved in the technical hosting, and no data is entrusted to a third-party provider for that purpose. The servers are located in France.

Article 4

Your rights

In accordance with articles 15 to 22 of the GDPR, anyone whose data is processed has the following rights:

Right of access : obtain confirmation that data concerning you is being processed, and receive a copy of it.
Right to rectification : have inaccurate or incomplete data corrected.
Right to erasure : request the deletion of your data where the legal conditions allow.
Right to data portability : receive the data you have provided in a structured, machine-readable format.
Right to object : object to the processing of your data, in particular when it is based on the association's legitimate interest.
Right to restriction of processing : request that processing be temporarily suspended while a check is carried out.
Right to withdraw your consent : at any time, without affecting the lawfulness of processing carried out before withdrawal.

Article 5

How to exercise your rights

The rights above can be exercised by email to seigneuriedecoucy@amvcc.com or by post to the address of the association's registered office.

Automatic export for newsletter subscribers (GDPR art. 15 and 20) : every newsletter email contains a link, “Exporter mes données personnelles (accès RGPD)” (Export my personal data, GDPR access), which lets you immediately download a copy of your data in JSON format. This link is personal to you and uses the same secure mechanism as the unsubscribe link.

To prevent identity theft, the association may ask you to attach a copy of a valid identity document to your request when it concerns sensitive data. This copy is destroyed as soon as the request has been processed.

The association undertakes to respond to any request within one month at most, which may be extended by two months for complex requests, in accordance with article 12.3 of the GDPR.

Article 6

Right to lodge a complaint

If, after contacting us, you believe that your rights have not been respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French supervisory authority for personal data protection.

www.cnil.fr , 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Article 7

Security and confidentiality

The AMVCC implements appropriate technical and organisational measures to ensure data security: encrypted communications (HTTPS), strong authentication for administrators, logging of sensitive access, access rights limited to what is strictly necessary, encrypted backups.

Article 8

Changes to this policy

The association reserves the right to update this policy to reflect changes to the site, to the processing carried out or to the legal framework. The date of the last update appears at the top of the page. Substantial changes will be specifically notified.