Privacy Policy

1. Introduction

Switch Compagnie is committed to protecting the privacy of its users. This policy explains how we collect, use, and protect your personal data in accordance with the GDPR and the French Data Protection Act (Loi Informatique et Libertés).

Data controller : Switch Compagnie, association loi 1901, dont le siège est situé au 313A Rue de la Forêt, 17700 Saint-Georges-du-Bois, France.

For questions about your personal data, contact us at contact@switchcompagnie.eu ou au +33 7 69 75 12 61.

Data protection contact person: Sulivan MICHEL, president of the association, reachable at contact@switchcompagnie.eu. Switch Compagnie is not required to appoint a data protection officer (Article 37 GDPR).

Browsing the site does not constitute consent to processing. Where processing relies on your consent, it is requested separately and may be withdrawn at any time.

2. Data Collected

We may collect the following data:

• - Identification information (last name, first name, email address, phone number)
• - Connection data (IP address, browser, operating system)
• - Browsing data on the site
• - Information provided when subscribing to the newsletter
• - If you sign in through a third-party provider (GitHub, Discord, X, Google), the information sent by that provider (name, e-mail, public identifier)
• - Payment data when paying an invoice by credit card, processed directly by our payment provider CAWL (Worldline): we never store your card number
• - Account and profile data: name, email, phone number, profile picture, language and theme preferences, social-login identifiers and linked Discord ID
• - Service-use data: support tickets and messages, attachments, appointments, contracts, orders, subscriptions, invoices, wallet and transactions
• - Internship applications: contact details, requested department, message and submitted documents
• - Security data: IP address, estimated country, browser, login date and outcome, and security events

3. Use of Data

The data collected is used for the following purposes, with the corresponding legal basis (GDPR Art. 6):

• - Providing and managing your account and our services (performance of the contract)
• - Processing your payments and invoices via our provider CAWL (Worldline) (performance of the contract)
• - Let you sign in through a third-party provider (GitHub, Discord, X, Google) (performance of contract / consent)
• - Handle support requests, appointments and service-related communications (pre-contractual steps or performance of a contract)
• - Review internship applications and respond to applicants (pre-contractual steps at their request)
• - Communicating with you about our services (legitimate interest)
• - Sending newsletters (consent)
• - Protect accounts, prevent abuse and secure the site (legitimate interest)
• - Complying with our legal and accounting obligations (legal obligation)

4. Data Retention

Retention periods:

• - Inactive accounts: after 2 years without authenticated activity, the account is disabled and its sessions and access tokens are revoked. This does not automatically delete the user record or linked data; they are retained as long as necessary for contractual or accounting obligations or legal claims, then deleted or anonymised when no longer needed.
• - Unsuccessful applications: until the selection process ends; local copies of attachments are automatically deleted no later than 90 days after upload. Copies in the recruitment mailbox are deleted when the selection process ends
• - Prospecting data for people who have not entered into a contract: up to 3 years from collection or the person's last contact
• - Newsletter data: until unsubscribed; the unsubscribed address is kept on an opposition list to prevent further mailings
• - Login history: 90 days; activity logs: 180 days, subject to scheduled deletion
• - Invoices and accounting documents: 10 years from the end of the financial year (Article L123-22 of the French Commercial Code)
• - Contact requests and tickets: for as long as needed to handle them, then in restricted archives if needed for a legal obligation or the defence of legal claims

5. Data Sharing

We do not sell or rent your personal data. It may be shared with the following recipients, only to the extent necessary to provide our services:

• - CAWL (Worldline), our payment provider, for processing card payments
• - GitHub, Discord, X and Google, if you choose to sign in through one of these services
• - Cloudflare Turnstile, loaded only on the sign-in, registration and forgotten-password pages to prevent abuse
• - Font Awesome (Fonticons, Inc.), loaded to display the site's icons; fonts are hosted on our own servers
• - Cloudflare, Inc., which provides the domain's DNS servers and in that capacity processes the IP address of resolvers querying it
• - Switch Compagnie itself, through its T-Tron infrastructure (a sub-project of the association, not a separate entity), for hosting and sending e-mails from its servers located in France, at the registered office address
• - Authorised Switch Compagnie staff, to handle requests, tickets and applications
• - The competent authorities, in the event of a legal obligation

6. Your Rights

In accordance with the GDPR, you have the following rights:

• - Right of access to your personal data
• - Right to rectification
• - Right to erasure
• - Right to restriction of processing
• - Right to data portability
• - Right to object
• - Right to lodge a complaint with the CNIL (the French data protection authority) (www.cnil.fr)

To exercise these rights: contact@switchcompagnie.eu

7. Security

Our security measures include:

• - Encryption of data in transit (TLS)
• - Restricted access to personal data
• - Access monitoring and logging
• - Infrastructure self-hosted by Switch Compagnie (T-Tron), in France

8. Cookie Policy

The site currently does not use any audience measurement or advertising tools. It only sets strictly necessary cookies, which are exempt from consent (Article 82 of the French Data Protection Act): the session cookie "switch_compagnie_session" (account operation and language preference) and the "XSRF-TOKEN" cookie (protecting forms against request forgery), both deleted when the session expires. The browser's local storage remembers that the information notice was dismissed. Fonts are hosted on our servers. Font Awesome (icons, all pages) and Cloudflare Turnstile (authentication pages only) may receive technical data, including the IP address and browser information, when loaded; they are detailed in sections 5 and 10.

9. Mandatory or optional data

Fields marked as mandatory in our forms (registration, ticket, application, newsletter) are required to process your request: without them, we cannot create the account, handle the ticket or review the application. Other information (optional attachments, profile photo, sign-in through a third-party provider) is optional.

10. Transfers outside the European Union

Our servers are located in France. Some providers are established in the United States and may receive data (IP address, browser information, or profile data when using social sign-in):

• - Cloudflare, Inc. (Turnstile, DNS)
• - Fonticons, Inc. (Font Awesome)
• - GitHub, Inc., Discord Inc., X Corp. and Google LLC, only if you choose to sign in through one of these services

10a. Safeguards for transfers

These transfers are governed by the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework where the provider is certified, or otherwise by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). The list of certified companies can be consulted at dataprivacyframework.gov.

11. Response time to your requests

We respond to your rights requests within one month of receipt. This period may be extended by two months, given the complexity or number of requests; in that case you are informed within the first month (Article 12(3) GDPR). We may ask you to prove your identity if there is reasonable doubt.

12. Instructions regarding your data after death

You can set instructions regarding the retention, erasure and communication of your personal data after your death (Article 85 of the French Data Protection Act). These specific instructions can be sent to us at contact@switchcompagnie.eu; you may amend or revoke them at any time.

13. Automated decision-making

Switch Compagnie does not take any decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). The Cloudflare Turnstile bot check is only used to block abusive submissions, and the deactivation of inactive accounts is a retention measure described in section 4.

14. Hosting and status of T-Tron

The website, e-mails and data are hosted by Switch Compagnie itself, on its T-Tron infrastructure. T-Tron is a sub-project of the association (hosting, cloud, colocation) and not a separate entity: Switch Compagnie is therefore the host. The servers are located in France, at the registered office address. The domain name uses Cloudflare, Inc.'s DNS servers.

14a. Reviews

When you submit a review from your account (as a client, user of our tools or intern), we process the display name, the type of author, the optional role or organisation, the rating, the text, the date of the experience, the project or service concerned and the link to your account, in order to verify the stated experience, manually moderate and then publish the review (legal basis: consent, Article 6(1)(a) GDPR; legitimate interest for anti-fraud checks). Any supporting documents remain internal. A published review stays online for a maximum of 3 years or until you withdraw your consent, which you can request at any time at contact@switchcompagnie.eu; a rejected review, the reason for which is notified to you, is automatically deleted 90 days after the moderation decision.

15. Changes

We reserve the right to modify this privacy policy at any time. Changes will be published on this page.

16. Contact

For any questions: contact@switchcompagnie.eu