Information on the Processing of Your Personal Data
We are committed to protecting the personal data of the individuals with whom we interact. Therefore, in this document, we explain what personal data we collect, why we collect it, and what we do with it. We also explain what your rights are regarding your personal data and how you can exercise them.
Who is the controller of your personal data?
The controller of your personal data is RespUp SAS, operating the Dift Platform (hereinafter "Dift"), whose contact details are provided at the bottom of the page. Depending on how you use the Platform, Dift may act alone or jointly with a third party as a joint controller within the meaning of Article 26 of the GDPR:
If you participate in a Campaign organized by a Sponsor (vote, consultation): Dift and the organizing Sponsor are joint controllers of your data for the duration and needs of the Campaign.
If you make a direct donation on the Platform: Dift and the Beneficiary Organization receiving your donation are joint controllers of your data.
What personal data do we collect?
We collect directly from you the personal data requested via the form used. This includes the following data:
Donation on the platform
Category of personal data :
Identification data: First name, last name.
Contact data: Email address, postal address (if a tax receipt is requested)
Payment data: Credit card or other payment method
Miscellaneous data: Data entered in the comment field
Connection data: IP address.
Participation in a Campaign organized by a Sponsor or distribution of a dift
Category of personal data :
Contact data: Email address
Miscellaneous data: Data entered in the comment field
Connection data: IP address.
We may obtain your identification data in certain cases when the sender of the dift provides it to us. We collect the other data directly from you when you use your dift.
Mandatory data is identified by an asterisk on the dift redemption form. Without this data, we cannot process your request.
Ordering a dift for a loved one
Category of personal data :
Identification data: First name, last name.
Contact data: Email address, postal address (if a tax receipt is requested)
Payment data: Credit card or other payment method
Miscellaneous data: Data relating to the sender and recipient of the Dift, data entered in the message
Connection data: IP address.
Contact form
Category of personal data :
Identification data: First name, last name.
Contact data: Professional email address, telephone number.
Professional data: Company name.
Miscellaneous data: Data entered in your message.
Registration form for our No Bullshit newsletter
Category of personal data :
Contact data: Professional email address.
Case study request form
Category of personal data :
Contact data: Professional email address, telephone number.
Professional data: Company name.
Mandatory data is identified by an asterisk on the form used. Without this data, we cannot process your request. We also collect your IP address.
Why do we collect your personal data?
Direct donation on the platform
List of purposes and categories of data:
Execution and tracking of donations
- Allocation of the donation to the chosen cause: Identification data
- Communication with you to inform you of updates regarding the supported cause: Contact data
- Communication to the association: Identification data, Contact data, Miscellaneous dataSending our newsletter: Contact data
Management of an opt-out list: Identification data, Contact data
Issuing the tax receipt: Identification data, Contact data
Data analysis: Connection data
Participation in a Campaign organized by a Sponsor or distribution of a dift
List of purposes and categories of data:
Execution and tracking of donations :
- Allocation of the donation to the chosen cause: Identification data
- Communication with you to inform you of updates regarding the supported cause: Contact data
- Communication to the company (comment and email): Contact data, Miscellaneous dataSending our newsletter: Contact data
Management of an opt-out list: Identification data, Contact data
Data analysis: Connection data
Ordering a dift for a loved one
List of purposes and categories of data:
Establishment and execution of the contract :
- Conclusion of the contract (order): Identification data
- Execution of the contract (issuance of the Dift and notification of use): Contact data, Miscellaneous dataLitigation management: Identification data, Contact data, Miscellaneous data
Data analysis: Connection data
Website forms
We process your personal data for the following purposes.
List of purposes and categories of data:
Responding to your request :
Identification data.
Contact data.
Professional data and miscellaneous data additionally for the contact form.
Sending our newsletter :
Contact data.
Commercial outreach (prospection) :
Contact data.
Identification data and/or professional data additionally depending on the form used.
Management of an opt-out list :
Contact data.
Identification data additionally depending on the form used.
Data analysis :
Connection data.
What authorizes us to process your personal data (legal basis for processing)?
Direct donation on the platform
Purposes and legal bases:
Execution of the contract: Processing and securing the payment
Issuance and sending of the tax receipt: Legal obligation (Art. 200, 238 bis, and 978 CGI)
Transmission of your tax data to the Beneficiary Organization: Legal obligation
Transmission of your email address to the Beneficiary Organization: Legitimate interest of the Beneficiary Organization in maintaining a relationship with its donors. You are informed of this transmission when confirming your donation and can object at any time by contacting the Beneficiary Organization.
Analysis of your browsing data: Our legitimate interest in improving our services
Participation in a Campaign organized by a Sponsor or distribution of a dift
Purposes and legal bases:
Organization of the vote or allocation of the donation: Our legitimate interest and that of the Sponsor in ensuring the proper execution of the Campaign
Communication of Campaign results to the Sponsor: Our legitimate interest in ensuring the proper execution of the contract entered into with our corporate clients
Sending our newsletter: Your consent (Note: you can withdraw your consent at any time as indicated below)
Management of an opt-out list: Compliance with our legal obligation
Data analysis: Our legitimate interest in improving our services
Ordering a dift for a loved one
Purposes and legal bases:
Establishment and execution of the contract: The processing is necessary for the performance of the contract
Litigation management: Our legitimate interest in defending our interests
Data analysis: Our legitimate interest in improving our services
Website forms
Purposes and legal bases:
Responding to your request :
The implementation of pre-contractual measures requested by you, or our legitimate interest in responding to your request when it does not involve pre-contractual measures or when you represent your company.
Sending our newsletter :
Your consent if you are an individual, or our legitimate interest in promoting ourselves and our offerings if you are a professional.Note: you may withdraw your consent at any time as indicated below.
Commercial outreach (prospection) :
Our legitimate interest in promoting our offerings, provided that we only reach out to professionals.
Management of an opt-out list :
Compliance with our legal obligation.
Data analysis :
Our legitimate interest in analyzing our website traffic data.
Who are the recipients of your personal data?
Your personal data is accessible to the internal recipients of the data controller listed below and, strictly limited to what is necessary, to the external recipients listed below.
Internal recipients
Sales – Customer Success – Operations – Product & Tech teams.
External recipients
Service providers :
Lawyers, judicial officers, courts, partner associations
IT providers (personal data processors) :
Brevo, Forest Admin
Payment service providers (independent data controllers for payment operations):
Stripe Payments Europe Ltd : used for direct donations - Stripe Privacy Policy
Mangopay SA : used in the context of Sponsor Campaigns or the purchase of difts between individuals - Mangopay Privacy Policy
Is your personal data transferred outside the European Union?
Your personal data may be transferred to the servers of Notion, Hubspot, and Stripe in the United States. This transfer is permitted under the European Commission's adequacy decision of July 10, 2023, for entities that adhere to the Data Privacy Framework, thereby providing a level of personal data protection equivalent to that of the European Union.
How long do we retain your personal data?
We retain your personal data for the time necessary to process your request.
We then retain personal data required for prospection for 3 years from this point or from the last contact initiated by you.
At the end of these periods, we retain in intermediate archiving the personal data necessary to exercise and prove our rights, for the duration of the applicable statutory limitation period, which is 5 years.
We retain your personal data necessary for our opt-out list for 10 years from your objection.
Your IP address used for site traffic analysis purposes is retained for 1 year.
What are your rights regarding your personal data?
In accordance with the regulations applicable in France regarding the protection of personal data, namely the Act of January 6, 1978 on Information Technology, Files and Civil Liberties as amended by subsequent legislation, and the Regulation of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you may exercise the following rights:
Right of access to your personal data and to information regarding the characteristics of its processing.
Right to rectification of your personal data should it be inaccurate.
Right to erasure of your personal data in certain cases.
Right to withdraw your consent, when processing is based on it.
Right to restriction of processing of your personal data.
Right to object to processing when it is based on our legitimate interest.
Right to data portability of your personal data in a structured, commonly used format when processing is based on your consent or the performance of a contract.
Right not to be subject to a decision based solely on automated processing.
Right to provide instructions regarding the disposition of your data post-mortem.