Privacy policy

Data controller

The data controller is the association Index Investigation (loi 1901), Folie L5 – Parc de la Villette, 211 avenue Jean Jaurès, 75019 Paris, France. For any question regarding your data: contact@index.ngo.

Data we collect and why

We limit ourselves to the data strictly necessary to our activities. We make no commercial use of your data and never sell it.

• Browsing the site: technical data needed to deliver and secure the site (e.g. server logs, IP address), kept for a limited time.
• Newsletter: your email address, to send you our investigations, news and donation appeals.
• Donations: identity, postal and contact details and payment information needed to process your donation and issue your tax receipt.
• Contact and forms: the information you provide when you write to us or answer a questionnaire, used only to reply and to improve our work.

Legal basis

Newsletter subscription is based on your consent (double opt-in). Processing donations is based on the performance of the donation and our legal obligations (accounting, tax receipts). Browsing data is based on our legitimate interest in operating and securing the site.

Recipients and processors

Your data is only accessed by authorised members of Index Investigation and by the following service providers, acting on our instructions:

• Infomaniak (Suisse) — website hosting.
• Brevo — sending newsletters and donation emails.
• Donorbox — managing the donation forms.
• Stripe / PayPal — secure payment processing (card, SEPA direct debit, PayPal).

Some of these providers may process data outside the European Union, under the safeguards provided by the GDPR.

Newsletter

Your subscription is confirmed by a double opt-in email. Your address may also be used for donation campaign emails. Every email contains an unsubscribe link allowing you to opt out at any time. Your address is kept until you unsubscribe, object to processing, or the address becomes invalid.

Donations

Index Investigation does not process donations directly but uses the Donorbox platform, connected to payment providers. When you fill in the form, your email, postal address and identity are transferred to Donorbox; your payment details are transmitted to the chosen provider (Stripe or PayPal). After a donation, your email may be added to Brevo to keep you informed of future campaigns, and your postal address is used to issue your annual tax receipt (mandatory information for deductibility).

Retention periods

Newsletter data is kept until you unsubscribe. Donation and accounting data is kept for the period required by law (notably accounting and tax obligations). Technical browsing data is kept for a limited period and then deleted or anonymised.

Cookies and storage

This site uses no advertising or third-party tracking cookies. It only relies on technical and functional storage necessary for the site to work and to remember your preferences (e.g. light/dark theme, frequency of the newsletter prompt).

To measure site traffic, we use Matomo, an analytics tool that we host on our own servers: your browsing data stays with us and is shared with no third party (no Google Analytics). Matomo is configured to respect your privacy — without any tracking cookie (which is why no cookie banner is required), with anonymisation of your IP address, for aggregate statistical purposes only. This measurement data is kept for a limited period (13 months maximum). This configuration falls under the consent exemption defined by the French data protection authority (CNIL) for audience measurement. You can opt out at any time by enabling the “Do Not Track” setting in your browser, which we honour.

Security

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access or disclosure (secure HTTPS connection, access restrictions, trusted providers).

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability. You can exercise these rights at any time by writing to contact@index.ngo.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL, cnil.fr).