Privacy Policy & Data Protection Charter

Section 01

1. Identity and Contact Details of the Data Controller

The data controller responsible for the processing of personal data collected via this website and our civic engagement services is:

Section 02

2. Fundamental Principles of Data Minimization

Demeure Historique applies the principle of data minimization codified in Article 5(1)(c) of the GDPR. We only collect personal information that is strictly necessary, adequate, and relevant to fulfilling our non-profit statutory missions.

We do not collect sensitive data as defined under Article 9 of the GDPR (such as philosophical beliefs, political opinions, trade union membership, genetic data, or health data). Visitors can browse our public technical manuals, annual audited reports, and historical garden guidelines entirely anonymously without creating a user account or submitting personal credentials.

Section 03

3. Legal Bases and Purposes of Processing

Personal information collected through our contact forms, volunteer applications, and membership enrollments is processed under specific lawful grounds recognized by Article 6 of the GDPR:

• Processing Based on Legitimate Public Interest (Article 6(1)(e)): Organizing on-site architectural diagnosis, dispatching emergency salvage tarpaulins following extreme weather events, and responding to technical preservation inquiries from property custodians.
• Processing Based on Statutory Membership Agreement (Article 6(1)(b)): Maintaining the legal register of association members, delivering quarterly preservation journals, issuing tax deduction certificates under Article 200 of the French General Tax Code, and coordinating General Assembly voting.
• Processing Based on Explicit Consent (Article 6(1)(a)): Enrolling civic volunteers in our regional docent, garden stewardship, and archival transcription networks. Consent may be withdrawn at any time without retroactive penalty.
• Processing Based on Legal Obligation (Article 6(1)(c)): Depositing certified accounting records and membership lists with the Prefecture of Eure-et-Loir in accordance with statutory non-profit legislation.

Section 04

4. Categories of Personal Data Collected

When you interact with our association through our digital forms or written correspondence, we may process the following categories of data:

• Identification Data: Full name, title, institutional affiliation, postal address, email address, and telephone number.
• Heritage Property Data: Historical monument name, location, classification status (Inscrit or Classé), cadastral references, architectural pathologies observed, and dates of construction for diagnostic evaluations.
• Volunteer Profile Data: Historical interests, craft skills (e.g., masonry, carpentry, horticulture), language proficiencies, and general availability windows.
• Financial Donation & Dues Data: Contribution amounts, payment timestamps, and tax residency declarations necessary for delivering official tax-deductible receipts (CERFA n° 11580*05). Credit card and banking transactions are processed through authorized banking gateways; Demeure Historique does not store complete banking credentials.

Section 05

5. Strict Data Retention Schedules

In accordance with guidance from the Commission Nationale de l'Informatique et des Libertés (CNIL), personal data is retained only for the duration required to achieve the purposes for which it was gathered:

• Technical Diagnostic Dossiers: Retained for ten (10) years following site inspection to ensure longitudinal monitoring of structural masonry settlements, timber decay, and moisture migration.
• Statutory Membership & Tax Receipts: Retained for ten (10) years in compliance with Article L. 123-22 of the French Commercial Code and tax administration audit standards.
• Volunteer Applications: Retained for three (3) years from the date of submission or until the volunteer formally requests removal from our active roster.
• General Contact Inquiries: Retained for twenty-four (24) months following the resolution of the inquiry, after which records are purged or anonymized.

Section 06

6. Data Security, Confidentially & European Hosting

Demeure Historique implements robust administrative, technical, and physical security measures to safeguard your personal data against accidental loss, unauthorized access, alteration, or disclosure.

All digital transmissions on this website are secured with 256-bit TLS (Transport Layer Security) encryption. Our servers and database repositories are hosted exclusively within the European Economic Area (EEA) in compliant data centers adhering to ISO/IEC 27001 and SOC 2 certifications. We do not transfer personal data to third countries outside the European Union.

Section 07

7. Your Statutory Rights Under the GDPR

Under Articles 15 through 22 of the GDPR and the French Loi Informatique et Libertés, you hold comprehensive rights regarding your personal data:

• Right of Access (Article 15): Obtain confirmation as to whether your personal data is processed and receive an intelligible copy of the data.
• Right to Rectification (Article 16): Require the prompt correction of inaccurate or incomplete personal records.
• Right to Erasure / Right to Be Forgotten (Article 17): Request the permanent deletion of your data when it is no longer necessary for statutory or fiscal compliance.
• Right to Restriction of Processing (Article 18): Temporarily restrict processing during the verification of data accuracy or lawful grounds.
• Right to Data Portability (Article 20): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): Object at any time, on grounds relating to your particular situation, to data processing conducted under legitimate interests.

To exercise any of these statutory rights, please send your request along with proof of identity to our DPO Desk by email at ihyippuiuhoppy@gmail.com or by post to: DPO Desk, Demeure Historique, Château de Reverseaux, 28150 Les Villages Vovéens, France. We will respond within thirty (30) days of receipt.

If you believe that your rights have not been respected after contacting us, you have the statutory right to lodge a formal complaint with the French supervisory authority: CNIL (Commission Nationale de l'Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr).

Section 08

8. Cookies and Digital Tracker Policy

In keeping with our non-commercial ethos, this website adheres to an uncompromising, tracker-free digital standard:

• Zero Advertising Cookies: We do not deploy third-party advertising cookies, retargeting pixels, or behavioural marketing beacons.
• Zero Cross-Site Tracking: We do not participate in cross-site browsing tracking networks or social media surveillance widgets.
• Essential Technical Session Cookies: We utilize only strictly necessary session cookies required for network routing, anti-CSRF form security, and user session management. In accordance with CNIL guidelines, these essential technical cookies do not require prior consent because they do not track personal habits.