Data Protection Declaration

The European Center for Diabetes Studies (hereinafter referred to as CEED) is a Law 1908 association (Local law of Alsace and Moselle), located at Boulevard René Leriche 67200 Strasbourg, registered with the Strasbourg Judicial Court under SIREN number 385 214 051.

The CEED conducts research and development activities in biotechnology. This website is designed to present our activities, achievements, and news, as well as to allow individuals or companies to make donations via a secure and specialized platform.

Regarding the protection of personal data, CEED is subject to the general obligations imposed by the General Data Protection Regulation (GDPR), whether it concerns the information collected and processed through its website, the events organized, direct contact requests, or the receipt of donations.

Contact

You can contact us directly:

By phone at (+33) 03.90.20.12.12

Via the contact tab on the website

Preamble

Your personal data is collected, processed, and used exclusively in accordance with legal provisions. We ensure that data protection requirements are complied with in accordance with the GDPR.

When collected, we use your personal data for contact purposes, if requested, or to provide information about our news and events. This data is collected via the contact form or through direct contact from visitors or donors, and all requests made through the website or any other means.

Sources and Data Used

We process personal data that we have received directly from visitors and donors via the website and requests made.

We record your data that is necessary for the execution of your information request, questions, or data entered during donations received from the secure platform. Only information necessary for the execution of your request is requested, and no payment information is recorded.

Purpose of Processing and Legal Bases

The processing of your personal data is carried out in compliance with the provisions of the General Data Protection Regulation (GDPR) of the EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, with the French Data Protection Act and, more generally, in compliance with the regulations applicable within our activity.

Regarding the fulfillment of contractual obligations (Art. 6(1)(b) GDPR):

The processing of personal data is carried out in the context of the detailed services on the website or in your specific conditions. You can find more details about the purposes of data processing in the general terms and conditions or inquire with your contact person via email.

In the context of balancing of interests (Art. 6(1)(f) GDPR):

If necessary, we process your data to protect our interests. This includes monitoring our obligations regarding requests and tracing donations, limiting our liability, asserting legal rights, and defending against legal disputes, ensuring the IT security and functionality of CEED, preventing and clarifying crimes due to an order from a public authority, and managing the services offered by CEED.

Based on your consent (Art. 6(1)(a) GDPR):

If we have your consent to process your personal data for specific purposes, the legality of this processing based on your consent is ensured. The given consent can be revoked at any time. The revocation of consent does not affect the legality of the data processing carried out until the revocation.

Due to legal obligations (Art. 6(1)(c) GDPR) or for public interest reasons (Art. 6(1)(e) GDPR):

In principle, no personal data is processed when using the website. No data is recorded, modified, or transmitted to third parties.

Contact

Information collected during calls or phone contact, for information requests, or during your requests may be recorded in a computer file by CEED to respond to your request, for contacting you, or establishing information mailings. The legal basis for processing is detailed in the personal data protection policy declaration.

The collected data will be used and archived in accordance with the GDPR. This personal data will not be transferred to third parties, whether for consideration or free of charge.

The data is retained for a maximum period of 2 years after the completion of the service.

You can access your data, rectify it, request its erasure, or exercise your right to limit the processing of your data. Consult the cnil.fr website for more information about your rights.

To exercise these rights or for any questions regarding the processing of your data within this system, you can contact our services for more information or object to the retention of your personal data.

If you believe, after contacting us, that your "Computer and Freedoms" rights are not respected, you can file a complaint with the CNIL.

Retention Periods

Your data is retained for the duration:

• Necessary for the fulfillment of the aforementioned purposes,

• Defined under legal retention obligations,

• Specified by legal prescription.

The retention periods for personal data are applied based on the following criteria:

Purpose of Processing and Retention Period :

• Management of contact files Maximum 2 years

• Management of donor files Duration necessary for the establishment of proof of a right or contract: civil and commercial prescription period 5 years

• Obligation to retain books and documents created for commercial activities: 10 years from the end of the financial year.

• Retention of contracts concluded electronically: 10 years from delivery or performance

• Exercise of the right of access or rectification 1 year

• Exercise of the right of opposition Maximum 2 years for the retention of identity documents

• Audience measurement statistics 13 months

Regarding your personal data related to payment data, please refer to: https://www.helloasso.com/confidentialite

Your Rights as the Data Subject

Anyone affected by the processing of personal data has the right to:

• Information (§ 34 BDSG, Art. 15 GDPR),

• Correction (Art. 16 GDPR),

• Deletion (§ 35 BDSG, Art. 17 GDPR),

• Restriction of processing (Art. 18 GDPR),

• Data portability (Art. 20 GDPR), and

• Withdrawal of consent (Art. 21 GDPR).

Restrictions (Art. 23 GDPR) apply, however, to the right of information and deletion. There is also a right to appeal to a competent data protection supervisory authority (Art. 77 GDPR).

Obligation to Provide Data

As part of your request made on the website or through direct contact, you must provide the personal data that is requested and necessary for the fulfillment of the related obligations or that we are legally obliged to collect. Without this data, we will not be able to respond to your request, or the exercise of your legal rights will be compromised.

The necessary data includes:

• Name, first name, company name

• Address / contract number

• Phone number, email address

• Payment data

Automated Decision Making and Personal Use of the Website

For the establishment and execution of the service or your request, we do not use fully automated decision-making in accordance with Art. 22 GDPR. If we use such procedures in specific cases, you will be informed separately. We partially process your data automatically in order to evaluate certain aspects of personal website usage.

Collection of Personal Data When Visiting Our Website

When using the website for informational purposes only, without providing information in any other way, we only collect the personal data that your browser transmits to our server. When you visit our website, the following data is collected, which is necessary from a technical point of view to display our website and to ensure its stability and security (the legal basis is Art. 6(1)(f) GDPR):

• IP address

• Date and time of the request

• Time zone difference to Greenwich Mean Time (GMT)

• Content of the request (specific page)

• Access status / HTTP status code

• Data volume transferred

• Website from which the request originates

• Browser

• Operating system and its interface

• Language and version of the browser software

• Pages accessed

In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is sent to the authority that sets the cookie. This device is used, among other things, for performance analysis of the website through cookies, which helps improve our website by providing comprehensive statistics on the number of visitors to a page, the most accessed areas of a site, and the city or location of users. These may be installed by external analysis providers that we engage. These cookies do not personally identify you. Cookies cannot launch programs or transmit viruses to your computer. They are simply used to make the Internet offer more user-friendly and effective overall. CEED uses the following types of cookies: temporary cookies and permanent cookies.

Temporary cookies are automatically deleted when you close the browser. They store a session ID with which different requests from your browser can be assigned to the common session. Your computer can thus be recognized when you visit our website again. Session cookies are deleted when you log out of the website or close the browser.

Permanent cookies are automatically deleted after a predetermined period, which may vary depending on the cookie. You can delete cookies at any time in the security settings of your browser.

You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. Most browsers offer various options for protecting your privacy. For example, you can accept proprietary cookies but block third-party cookies or be informed each time a website wants to install a cookie. Please note that disabling cookies will prevent the installation of new cookies. You can find instructions for managing cookies in the Help function of your browser or in the user manual of your smartphone or the fixed or mobile product with Internet access used.

Information on Your Right of Withdrawal According to Art. 21 of the General Data Protection Regulation (GDPR)

You can revoke your consent to the processing of your personal data given to CEED at any time. Please note that revocation only has effect for the future. The processing carried out before the revocation is not affected.

Right of Revocation on a Case-by-Case Basis

You have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you, which is carried out based on Art. 6(1)(e) GDPR (processing of data in the public interest) or Art. 6(1)(f) GDPR (processing for the purposes of legitimate interests); this also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR. If you object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate reasons for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

If we base the processing of your personal data on a balance of interests, you can object to this processing. If you make use of such a revocation, we ask you to explain the reasons why we should no longer process your personal data as we have done previously. In the event of a justified revocation, we will examine the situation and discontinue the processing of your data, adapt it, or present compelling legitimate reasons why we must continue to process your data.

Data Controller

The European Center for Diabetes Studies (CEED) association

Your Right of Withdrawal (Art. 21 GDPR)

You have the right to object at any time to the processing of your personal data based on Art. 6(1)(e) or Art. 6(1)(f) GDPR, for reasons arising from your particular situation, including profiling based on these provisions. We will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate reasons for the processing that override your interests, rights, and freedoms or if the processing is necessary for the establishment, exercise, or defense of legal claims.

You can notify us of your objection through the contact page on the website.