Legal
Records of processing activities
Last updated: 11/10/2026
In the event of any discrepancy between the French and English versions of this document, the French version shall prevail.
Switch Compagnie acts both as a controller (for its own processing) and as a processor (for data hosted for its clients). As recommended by the CNIL, it keeps two separate records, based on the CNIL template. This page presents a summary version; the full record is kept internally and can be provided to the CNIL on request.
Controller: Switch Compagnie, French non-profit association, 313A Rue de la Forêt, 17700 Saint-Georges-du-Bois, France. Data protection contact person, in charge of keeping the records and handling data subject requests: Sulivan MICHEL, president. Contact: contact@switchcompagnie.eu.
Record 1: Switch Compagnie as controller
Article 30(1) GDPR. Common recipients: authorised members of the association; hosting provided by the association itself on its T-Tron infrastructure, in France. Common security measures: TLS encryption of communications, access restricted to authorised members, authentication and access logging.
1.1 User accounts and client area
- Purpose
- Creating and managing accounts, sign-in (including through a third-party provider), preferences.
- Legal basis
- Performance of a contract (Art. 6(1)(b)).
- Data subjects and data
- Users: identity, e-mail, phone, hashed password, photo, social login identifiers, Discord ID.
- Transfers outside the EU
- Only when signing in via GitHub, Discord, X or Google (see the privacy policy).
- Retention
- Deactivation after 2 years of inactivity, then retention limited to legal obligations.
1.2 Orders, invoicing and payments
- Purpose
- Quotes, orders, subscriptions, invoices, wallet, card payment.
- Legal basis
- Performance of a contract; legal obligation (accounting).
- Recipients
- CAWL (Worldline) for card payments.
- Retention
- Accounting documents and invoices: 10 years (Article L123-22 of the French Commercial Code).
1.3 Support, tickets and appointments
- Purpose
- Handling support requests, tickets, attachments and appointments.
- Legal basis
- Pre-contractual measures or performance of a contract.
- Retention
- For the time needed to handle the request, then restricted archiving if necessary.
1.4 Internship applications
- Purpose
- Reviewing applications and replying to applicants.
- Legal basis
- Pre-contractual measures at the person's request.
- Retention
- Until the end of selection; local attachments deleted no later than 90 days after submission.
1.5 Newsletter
- Purpose
- Sending the association's newsletter.
- Legal basis
- Consent (Art. 6(1)(a)).
- Retention
- Until unsubscription, then suppression list.
1.6 Site security and logs
- Purpose
- Protecting accounts, preventing abuse, logging.
- Legal basis
- Legitimate interest (Art. 6(1)(f)).
- Recipients
- Cloudflare (Turnstile, on authentication forms).
- Retention
- Login history: 90 days; activity logs: 180 days.
1.7 Reviews
- Purpose
- Collection, verification, manual moderation and publication of reviews, notification of the reason in case of rejection.
- Legal basis
- Consent (Art. 6(1)(a)); legitimate interest for anti-fraud checks (Art. 6(1)(f)).
- Data subjects and data
- Clients, tool users and interns with an account: display name, type of author, optional role or organisation, rating, text, date of experience, link to the account.
- Retention
- Published review: maximum 3 years or until consent is withdrawn; rejected review: 90 days after moderation.
1.8 Management of the association's members
- Purpose
- Keeping the list of members and officers, notices and minutes of general meetings, filings with the prefecture.
- Legal basis
- Performance of the association contract (articles of association); legal obligation for filings (Law of 1 July 1901).
- Data subjects and data
- Members and officers: identity, contact details, capacity, membership and term dates.
- Retention
- For the duration of membership or office, then for the period set in the internal version of the record.
1.9 Management of interns
- Purpose
- Conclusion and follow-up of internship agreements, supervision, internship certificates.
- Legal basis
- Performance of the internship agreement; legal obligations (French Education Code).
- Data subjects and data
- Interns: identity, contact details, educational institution, agreement, period, assessment.
- Recipients
- Educational institution party to the agreement.
- Retention
- Duration of the internship, then for the period set in the internal version of the record.
1.10 Notices of illegal content
- Purpose
- Receiving and handling notices, informing the notifier and the user concerned (Regulation (EU) 2022/2065).
- Legal basis
- Legal obligation (Art. 6(1)(c)).
- Data subjects and data
- Notifiers and users concerned: name, e-mail, reported content, decision and reasons.
- Recipients
- Competent authorities, upon request.
- Retention
- For the time needed to handle the notice, then restricted archiving for the period set in the internal version of the record.
1.11 Complaints, withdrawals and mediation
- Purpose
- Handling complaints, withdrawal and termination requests, and any consumer mediation proceedings.
- Legal basis
- Legal obligation (French Consumer Code); performance of the contract.
- Data subjects and data
- Clients: identity, contact details, order reference, subject of the request, correspondence.
- Recipients
- Consumer mediator, where applicable.
- Retention
- Duration of the contractual relationship, then restricted archiving for the applicable limitation periods.
1.12 Administration accounts and infrastructure access
- Purpose
- Managing authorised members' access to administration tools and the T-Tron infrastructure, traceability of operations.
- Legal basis
- Legitimate interest (security, Art. 6(1)(f)); security obligation (Art. 32).
- Data subjects and data
- Authorised members and interns: identifiers, roles, access and operation logs.
- Retention
- For the duration of the authorisation; activity logs: 180 days.
Record 2: Switch Compagnie as processor
Article 30(2) GDPR. This record covers processing carried out on behalf of clients of the hosting and e-mail services.
- Processor
- Switch Compagnie, French non-profit association, 313A Rue de la Forêt, 17700 Saint-Georges-du-Bois (T-Tron infrastructure, a sub-project of the association). Contact person: Sulivan MICHEL.
- Controllers
- Clients of the hosting, cloud, colocation and e-mail services; name and contact details of each client kept in the internal version of the record (Article 30(2)(a) GDPR), with the reference of their signed data processing agreement.
- Categories of processing
- Website and file hosting, cloud and colocation, e-mail, backup, maintenance.
- Sub-processors
- Cloudflare, Inc. (DNS, United States). Up-to-date list kept in the internal version of the record and annexed to each data processing agreement.
- Transfers outside the EU
- DNS resolution by Cloudflare, Inc. (United States); data hosted in France.
- Security measures
- TLS, restricted and logged access, servers in France; see the data processing agreement.