Privacy policy
Who processes your data
Two associations jointly manage this registration platform and are joint controllers within the meaning of Article 26 of the GDPR:
540, route de la Côte de Jor, lieu-dit La Bicanderie, 24290 Saint-Léon-sur-Vézère, France
Siret 319 149 142 00022 — contact@chanteloube.fr
Both associations use the same participant database and the same tools. An account created on either site is therefore valid for both, and this policy applies the same way no matter which door you came in through. You can exercise your rights with either one, whichever you prefer: your request will be handled whoever you address it to.
The data we collect
| Category | Detail |
|---|---|
| Identity | Last name, first name, dharma name, sex, date of birth, ordination status |
| Contact details | Email address, phone number, postal address |
| Account | Password (never stored in plain text), correspondence language, photo if you upload one |
| Participation | Event registrations and attendance, waiting lists, carpooling, dietary preferences (gluten-free, dairy-free), preferred accommodation |
| Payments | Amounts, payment methods, receipts issued, bank reconciliations |
| Memberships | Year, category (member, benefactor), payment status |
| Login | IP addresses and login dates, recorded by the authentication mechanism |
All this data comes from you, except for information our teams add over the course of your participation (attendance recorded, payment received, organisational notes).
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing your registration for an event and its organisation: accommodation, meals, transport, carpooling | Performance of the service you requested (Art. 6(1)(b)) |
| Collecting payments, issuing receipts, keeping the accounts | Legal obligation (Art. 6(1)(c)) |
| Informing you about our activities and gauging your interest in new offerings | Legitimate interest, within the framework set out in Article L.34-5 of the French Postal and Electronic Communications Code for people who have already taken part in one of our activities (Art. 6(1)(f)). You can object to this at any time, without having to justify yourself. |
| Securing access to the site and preventing automated registrations | Legitimate interest (Art. 6(1)(f)) |
Religious beliefs
We would rather say this plainly: registering for a Buddhist retreat, and even more so providing an ordination status, reveals a religious belief. This is sensitive data within the meaning of Article 9 of the GDPR.
This processing is based on Article 9(2)(d), which allows an association with a religious purpose to process such data as part of its legitimate activities, solely for its own members and people in regular contact with it. The consequence is concrete: this information is never shared with third parties outside this framework, and will not be without your consent.
Who your data is shared with
We do not sell, rent, or transfer any data. It is accessible to the people responsible for organisation within the two associations, and to the following technical service providers, who act solely on our instructions:
- Website hosting: DigitalOcean, server located in Frankfurt (Germany). The documents you upload and the entire database remain stored there.
- Sending emails: Amazon Web Services (SES service), Paris region.
- Monitoring technical errors: Sentry, Germany region.
- Google: the reCAPTCHA service protects the registration form, and address geocoding powers the carpooling feature. Both of these processes involve a transfer to the United States, governed by the EU–US Data Privacy Framework to which Google adheres.
If you pay through HelloAsso, you are then on the HelloAsso website, which becomes the controller for the data you enter there and applies its own policy.
Except for Google, all of this processing takes place within the European Union.
How long we keep it
- Your account and participation data: for as long as your account exists. It is then archived, and the data is deleted three years after your last contact with us.
- Accounting records and receipts: ten years, as required by law (Art. L.123-22 of the French Commercial Code).
- Login data: one year.
You can of course request deletion of your account before these deadlines.
Your rights
You have the right to access, rectify, erase, restrict, and port your data, as well as the right to object to its processing. You can also set directives for what happens to it after your death.
To exercise them, write to either of the two addresses given at the top of this page. We respond within one month. If the response does not satisfy you, you can contact the Commission nationale de l'informatique et des libertés (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.
Unsubscribing from our informational emails
Every informational email includes an unsubscribe link at the bottom of the page, and the corresponding checkbox appears on your profile. Unsubscribing takes effect immediately and has no impact on your registrations.
Messages related to a specific registration — confirmation, practical information, receipt — will still reach you: they are part of the service and are not considered general information.
Changes
This policy may change over time. The date of the last update appears at the top of the page; if a change affects your rights, we will let you know by email.