Deep Blue Foundation
Privacy Policy
This document explains what data this website collects, why it does so, and how you can exercise your rights.
1. Data controller
The data controller for the data described below is ‘Deep Blue Foundation’, a registered association under the 1901 Act, with its registered office at 4 rue Georges Saché, 75014 Paris, France (RNA W751269811).
2. Data collected
This site collects personal data on four specific occasions, only when you choose to fill in one of the following forms or to make a donation. No data is collected simply by browsing the pages.
3. Contact Form
Subject of the enquiry, name, email address, organisation (optional) and message. This information is sent by email to Deep Blue Foundation so that we can respond.
4. Applications (unsolicited or for a voluntary role)
Unsolicited application: name, email address, organisation (optional), desired role and reasons for applying. Application for a voluntary role: name, email address, reasons for applying and CV (PDF), as well as – if provided – telephone number, organisation and a link to a profile. This information is sent by email to the Deep Blue Foundation for the application to be considered; the CV is attached to this email and is never stored by the website. A confirmation email will be sent to you after you have applied for a role.
5. Newsletter
Email address only, recorded once you have explicitly ticked the consent box provided for this purpose. No registration takes place without this voluntary action.
6. Online donation
Frequency (one-off or monthly), amount, email address and means of payment. Payment details (card number, etc.) are entered in a secure form provided by Stripe and processed by Stripe only: Deep Blue Foundation never has access to them. Deep Blue Foundation receives from Stripe the amount, date, email address and status of each donation.
Data from these forms, donations, event bookings and the member area are brought together in Deep Blue Foundation’s internal relationship management tool (CRM), to follow its relationship with each person; only authorised members of the board can access it. It holds: the identity and contact details provided (name, email address, institution, language), the billing address when a payment asked for one, the history of donations (amount, date, status, type of payment method — never the card number), bookings (event, places, rates, attendance), messages sent through the forms, consents to the newsletter (date, source, text accepted) and, for members, the role and status of their account. The names and dates of birth of attendees requested for some events are never included.
7. Purposes and 8. Legal bases
Each form, as well as online donation, has a distinct purpose, with its own legal basis within the meaning of Article 6 of the GDPR.
- Contact — Purpose: to respond to your enquiry. Legal basis: Deep Blue Foundation’s legitimate interest in processing enquiries voluntarily submitted to it (Article 6(1)(f) of the GDPR).
- Application — Purpose: to assess your application for one of the proposed employment roles or for a voluntary position. Legal basis: the Deep Blue Foundation’s legitimate interest in processing applications submitted to it (Article 6(1)(f) of the GDPR).
- Newsletter — Purpose: to keep you informed about Deep Blue Foundation’s publications, events and news. Legal basis: explicit consent, obtained via the tick box on the form (Article 6(1)(a) of the GDPR), which may be freely withdrawn at any time.
- Donation — purpose: to collect your donation and follow it up (confirmation, management of a monthly donation). Legal basis: performance of the donation you initiated (Art. 6.1.b GDPR) and, for keeping the records, compliance with accounting and tax obligations (Art. 6.1.c GDPR).
- Relationship management (CRM) — purpose: knowing and following each person’s exchanges, support and participation with Deep Blue Foundation. Legal basis: Deep Blue Foundation’s legitimate interest in maintaining its relationship with the people who contact or support it (Art. 6(1)(f) GDPR); you may object to it at any time.
9. Recipients and 10. data processors
Data submitted via the ‘Contact’ and ‘Application’ sections is intended for members of staff at Deep Blue Foundation who are authorised to process these enquiries. Email addresses provided for the newsletter are intended for the communications team at Deep Blue Foundation.
The relationship management tool (CRM) runs on the open-source software Twenty, installed and hosted by Deep Blue Foundation itself within the European Union: no service provider has access to the data it holds.
For the forms, a single technical processor is involved: Brevo (Sendinblue SAS), a company governed by French law, used for:
- the sending of transactional emails generated by the ‘Contact’ and ‘Application’ forms;
- the registration and management of the newsletter mailing list.
Brevo processes this data within the European Union. Please refer to its privacy policy for details of its own data protection commitments.
Online donations are processed by Stripe (Stripe Payments Europe, Limited, Ireland), a payment service provider, which receives the donation data and payment details in order to carry out the payment and prevent fraud. Stripe acts partly on its own behalf (fraud prevention, regulatory obligations of payment services), under its own privacy policy.
The editorial content of this website (articles, publications, event listings) is managed via Sanity, our content management system. Sanity is not involved in any way in the processing of data submitted via the Contact, Application or Newsletter forms: it only receives and stores the editorial content published by the Deep Blue Foundation team, never the data you send us.
The editorial content published on the website is automatically translated into English by DeepL (DeepL SE, Germany). Only texts intended for publication are sent to DeepL; no data from forms or visitor data is shared with DeepL.
11. Retention periods
- Contact — 12 months after the last exchange, then deleted.
- Application (including CV) — 2 years after the last contact, so that we can get back to you, unless you object; then deleted.
- Newsletter — until you unsubscribe, or after 3 years without any interaction on your part.
- Donation — donation data and accounting records are kept for 10 years, the legal retention period for accounting documents; payment details are kept by Stripe under its own obligations.
- Relationship management (CRM) — each item follows the period of its category above; a record with no activity for 3 years (no donation, booking, message, subscription or membership) is deleted, except for donations, kept for the legal period.
12. Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, restrict the processing of, and object to the processing of your data, as well as the right to data portability where applicable. You may withdraw your consent to the newsletter at any time. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
13. How to exercise your rights
Please email contact@deepbluefoundation.org, stating the subject of your enquiry. We will reply as soon as possible.
14. Hosting and international transfers
This website is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), on a server located in the European Union (Germany).
When you make a donation, Stripe may transfer data to its parent company Stripe, Inc. (United States), and the anti-bot check built into its payment form, hCaptcha (Intuition Machines, Inc., United States), receives the IP address and technical browser data; this form also loads fonts from Google Fonts. These transfers are covered by the mechanisms provided for by the GDPR (EU–US Data Privacy Framework, standard contractual clauses), described in these providers’ privacy policies.