Information on the Processing of Your Personal Data
We are committed to protecting the personal data of the individuals with whom we interact. In this document, we explain what personal data we collect, for what purposes, and how we use it. We also explain what your rights are regarding your personal data and how you can exercise them.
Who is the data controller for your personal data?
The data controller for your personal data is RespUp SAS, operating the Dift Platform (hereinafter "Dift"), whose contact details are provided at the bottom of the page. Depending on how you use the Platform, Dift may act alone or jointly with a third party as joint data controller within the meaning of Article 26 of the GDPR:
- If you participate in a Campaign organized by a Patron (vote, consultation): Dift and the organizing Patron are joint data controllers for the processing of your data for the duration and purposes of the Campaign.
- If you make a direct donation on the Platform: Dift and the Beneficiary Organization receiving your donation are joint data controllers for the processing of your data.
What personal data do we collect?
We collect directly from you the personal data requested via the form used. This data is as follows:
Donation on the Platform
- Categories of personal data:
- Identification data: First name, last name.
- Contact data: Email address, postal address (if a tax receipt is requested).
- Payment data: Credit card or other payment method.
- Miscellaneous data: Data entered in the comment field.
- Connection data: IP address.
Participation in a Campaign organized by a Patron or distribution of a dift
- Categories of personal data:
- Contact data: Email address.
- Miscellaneous data: Data entered in the comment field.
- Connection data: IP address.
We may obtain your identification data in certain cases when the dift issuer provides it to us. We collect the other data directly from you when you use your dift.
Mandatory fields are identified by an asterisk on the dift usage form. Without this data, we are unable to process your request.
Ordering a dift for a loved one
- Categories of personal data:
- Identification data: First name, last name.
- Contact data: Email address, postal address (if a tax receipt is requested).
- Payment data: Credit card or other payment method.
- Miscellaneous data: Data relating to the sender and recipient of the Dift, data entered in the message.
- Connection data: IP address.
Contact form
- Categories of personal data:
- Identification data: First name, last name.
- Contact data: Professional email address, phone number.
- Professional data: Company name.
- Miscellaneous data: Data entered in your message.
Newsletter subscription form (No Bullshit)
- Categories of personal data:
- Contact data: Professional email address.
Customer case study request form
- Categories of personal data:
- Contact data: Professional email address, phone number.
- Professional data: Company name.
Mandatory fields are identified by an asterisk on the form used. Without this data, we are unable to process your request. We also collect your IP address.
Why do we collect your personal data? (Purposes of processing)
Direct donation on the Platform
We process your personal data for the following purposes:
| Purposes | Data categories |
|---|---|
| Processing and tracking donations: | |
| - Allocation of the donation to the chosen cause | Identification data |
| - Communication with you to inform you of updates on the supported cause | Contact data |
| - Communication to the association | Identification data, Contact data, Miscellaneous data |
| Sending our newsletter | Contact data |
| Managing an opt-out list | Identification data, Contact data |
| Issuing the tax receipt | Identification data, Contact data |
| Data analysis | Connection data |
Participation in a Campaign organized by a Patron or distribution of a dift
We process your personal data for the following purposes:
| Purposes | Data categories |
|---|---|
| Processing and tracking donations: | |
| - Allocation of the donation to the chosen cause | Identification data |
| - Communication with you to inform you of updates on the supported cause | Contact data |
| - Communication to the company (comment and email) | Contact data, Miscellaneous data |
| Sending our newsletter | Contact data |
| Managing an opt-out list | Identification data, Contact data |
| Data analysis | Connection data |
Ordering a dift for a loved one
| Purposes | Data categories |
|---|---|
| Establishing and performing the contract: | |
| - Conclusion of the contract (order) | Identification data |
| - Performance of the contract (issuance of the Dift and usage notification) | Contact data, Miscellaneous data |
| Dispute management | Identification data, Contact data, Miscellaneous data |
| Data analysis | Connection data |
Website forms
We process your personal data for the following purposes:
- Responding to your request:
- Identification data.
- Contact data.
- Professional data and miscellaneous data additionally for the contact form.
- Sending our newsletter:
- Contact data.
- Commercial outreach (prospecting):
- Contact data.
- Identification data and/or professional data additionally depending on the form used.
- Managing an opt-out list:
- Contact data.
- Identification data additionally depending on the form used.
- Data analysis:
- Connection data.
What authorizes us to process your personal data? (Legal basis for processing)
Direct donation on the Platform
| Purposes | Legal basis |
|---|---|
| Performance of the contract | Processing and securing of payment |
| Issuance and sending of the tax receipt | Legal obligation (Art. 200, 238 bis and 978 of the French General Tax Code) |
| Transmission of your tax data to the Beneficiary Organization | Legal obligation |
| Transmission of your email address to the Beneficiary Organization | The Beneficiary Organization's legitimate interest in maintaining a relationship with its donors. You are informed of this transmission at the time of validating your donation and may object at any time by contacting the Beneficiary Organization. |
| Analysis of your browsing data | Our legitimate interest in improving our services |
Participation in a Campaign organized by a Patron or distribution of a dift
| Purposes | Legal basis |
|---|---|
| Organization of the vote or allocation of the donation | Our legitimate interest and that of the Patron in ensuring the proper execution of the Campaign |
| Communication of Campaign results to the Patron | Our legitimate interest in ensuring the proper performance of the contract concluded with our corporate clients |
| Sending our newsletter | Your consent (NB: you may withdraw your consent at any time as indicated below) |
| Managing an opt-out list | Compliance with our legal obligation |
| Data analysis | Our legitimate interest in improving our services |
Ordering a dift for a loved one
| Purposes | Legal basis |
|---|---|
| Establishing and performing the contract | The processing is necessary for the performance of the contract |
| Dispute management | Our legitimate interest in defending our interests |
| Data analysis | Our legitimate interest in improving our services |
Website forms
- Responding to your request:
- The performance of the pre-contractual measure you request from us, or our legitimate interest in responding to your request where it does not constitute a pre-contractual measure or where you are acting on behalf of your company.
- Sending our newsletter:
- Your consent if you are an individual, or our legitimate interest in promoting ourselves and our offers if you are a professional. NB: you may withdraw your consent at any time as indicated below.
- Commercial outreach (prospecting):
- Our legitimate interest in promoting our offers, given that we only contact professionals.
- Managing an opt-out list:
- Compliance with our legal obligation.
- Data analysis:
- Our legitimate interest in analyzing the traffic data of our website.
Who are the recipients of your personal data?
Your personal data is accessible to the internal recipients of the data controller listed below and, in a limited and strictly necessary manner, to the external recipients listed below.
Internal recipients
- Sales, Customer Success, Operations, Product & Tech teams.
External recipients
- Service providers:
- Lawyers, court bailiffs, courts, partner associations.
- IT providers (personal data processors):
- Brevo, Forest Admin.
- Payment service providers (independent data controllers for payment operations):
- Stripe Payments Europe Ltd: used for direct donations - Stripe Privacy Policy
- Mangopay SA: used in the context of Patron Campaigns or the purchase of difts between individuals - Mangopay Privacy Policy
- Stripe Payments Europe Ltd: used for direct donations -
Are your personal data transferred outside the European Union?
Your personal data may be transferred to servers operated by Notion, HubSpot, and Stripe in the United States. This transfer is made possible under the European Commission's adequacy decision of July 10, 2023, in relation to entities that are members of the Data Privacy Framework, which thereby offer a level of personal data protection equivalent to that of the European Union.
How long do we retain your personal data?
- We retain your personal data for as long as necessary to process your request.
- We then retain the personal data necessary for prospecting purposes for 3 years from that date or from the last contact initiated by you.
- At the end of these periods, we retain in intermediate archives the personal data necessary to exercise and demonstrate our rights, for the duration of the applicable statute of limitations, i.e. 5 years.
- We retain the personal data necessary for our opt-out list for 10 years from the date of your objection.
- Your IP address used for the purpose of analyzing website traffic is retained for 1 year.
What are your rights regarding your personal data?
In accordance with the applicable French regulations on the protection of personal data, namely the French Data Protection Act of January 6, 1978 as amended by subsequent legislation, and the Regulation of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, you may exercise the following rights:
- Right of access to your personal data and to information on the characteristics of its processing.
- Right of rectification of your personal data that may be inaccurate.
- Right to erasure of your personal data in certain cases.
- Right to withdraw your consent, where processing is based on consent.
- Right to restriction of the processing of your personal data.
- Right to object to processing where it is based on our legitimate interest.
- Right to data portability of your personal data in a structured and commonly used format where processing is based on your consent or the performance of a contract.
- Right not to be subject to a fully automated decision.
- Right to provide instructions on the use of your data after your death.
You may exercise any of the rights listed above by contacting our personal data protection officer at our postal address above or at the following email address:
[email protected]
.We reserve the right to charge fees related to producing any copy of your personal data beyond the first copy, or in connection with the exercise of your rights in the event of an unjustified or excessive request.
You also have the right to lodge a complaint with the CNIL (French Data Protection Authority) in the event of a dispute regarding the processing of your personal data as described above. You may contact the CNIL at the following address: 3 place de Fontenoy, 75007 Paris, or via the following form:
https://www.cnil.fr/fr/adresser-une-plainte
.