This is a translation; in case of discrepancy, the French version prevails.
Last updated: 7 November 2026
This policy replaces any previous version. In application of articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and of loi n° 78-17 du 6 janvier 1978 modifiée ("Informatique et Libertés"), it explains which data is collected on https://baiteelayla.com, why, by whom it is processed, how long it is kept and what your rights are.
Data controller: Association BAITE ELAYLA, association loi 1901, RNA W931011477, 3 rue Bernard Palissy, 93300 Aubervilliers, represented by its President.
Contact for any question about your data: [email protected] (subject: "Données personnelles"), or by post to the address of the registered office.
The association is not required to appoint a data protection officer; the person above is your contact.
Main processor: POLENE TECH, SASU, RCS Paris 108 310 178, 138 avenue Victor Hugo, 75116 Paris, which designs, hosts (via OVH) and maintains the platform on behalf of the association, on its instructions and under a contract compliant with article 28 of the GDPR.
| Category | Data | Persons concerned |
|---|---|---|
| Identity | surname, first name, date of birth, photo | members, applicants |
| Contact details | postal address, postcode, city, e-mail, telephone number(s) | members, applicants, donors, hall hirers |
| Membership information | village of origin (optional), membership number and date, membership-fee status, digital membership card | members |
| Member-file documents | the documents that you or the board attach to your member file (PDF or images), for example a supporting document; image metadata (location, device) is removed on upload; | members |
| Payments | amount, date, purpose (membership fee, donation, booking), transaction reference, status, refunds. The association never sees your full card number: the entry and processing of banking data are carried out exclusively by Stripe | members, donors, hirers |
| Donations | amount, cause supported, receipt issued where applicable | donors |
| Bookings | date, time slot, purpose of the event, number of people, payment, cancellation | hall hirers |
| Classes | enrolment, attendance; for a child: surname, first name, date of birth, parent's contact details | members, children enrolled by their parents |
| Published content | announcements, death notices, messages, submitted photos | members, families |
| Google sign-in (optional) | Google identifier, name, e-mail address, Google profile photo | users choosing this sign-in method |
| Technical data | connection logs (IP address, date, time, browser), logs of board members' actions in the administration area | all signed-in users, board members |
Mandatory fields. For online membership, all the form fields are mandatory, including the photo (mandatory since July 2026), with the exception of the village of origin, which is optional. They are necessary to verify your identity, issue your membership card and manage your membership. If you do not provide them, your membership application cannot be processed. The other forms mark mandatory fields with an asterisk.
Photo check. When you submit your photo, a check verifies that a face is present. This check is carried out only in your browser, on your device: no data is sent to a third party for this verification, no biometric template is created or kept, and the photo is not used to recognise you automatically. Only the photo you approve is sent to our servers.
Address entry. When you type your address, the characters entered are sent to the public service of the Base Adresse Nationale (api-adresse.data.gouv.fr) in order to suggest existing addresses. This service receives neither your name nor your other data.
| Purpose | Legal basis (art. 6 RGPD) |
|---|---|
| Processing your membership application, having it approved by the board, managing your account and your membership card | Performance of the membership contract (art. 6.1.b) |
| Collecting the membership fee, sending renewal reminders (30 days and 7 days before the due date, on the due date, 2 days after) and suspending member-only features in the event of non-renewal | Performance of the membership contract (art. 6.1.b) |
| Displaying your profile in the members' directory and allowing other members to contact you | Legitimate interest of the association in fostering ties between its members (art. 6.1.f), with the right to object at any time — see section 7 |
| Receiving and managing donations, publishing donation causes | Performance of the donor's commitment (art. 6.1.b); consent of the beneficiary for the publication of their first name and situation (art. 6.1.a) |
| Issuing tax receipts, where the association is entitled to do so | Legal obligation (art. 6.1.c — art. 200 et 238 bis du Code général des impôts) |
| Managing hall bookings, their payment, cancellations and refunds | Performance of the booking contract (art. 6.1.b) |
| Managing class enrolments | Performance of the contract (art. 6.1.b) |
| Recording your registration for an event of the association and sending you its confirmation (name, telephone, e-mail, number of adults and children, chosen activities); these registrations are deleted 3 months after the event | Performance of your request (art. 6.1.b) |
| Publishing death notices | Consent of the family (art. 6.1.a) for the data of relatives (contact details, photos showing living persons) |
| Publishing and moderating members' announcements | Performance of the terms of use (art. 6.1.b) |
| Informing members about the life of the association (agenda, news, notifications) | Legitimate interest (art. 6.1.f), with the possibility to unsubscribe at any time |
| Soliciting new donations from members and past donors | Legitimate interest (art. 6.1.f), with the right to object at any time |
| Signing in with Google | Your consent, expressed by choosing this sign-in method (art. 6.1.a) |
| Keeping the accounts and retaining supporting documents | Legal obligation (art. 6.1.c) |
| Ensuring the security of the platform, preventing fraud, tracing actions in the administration area | Legitimate interest (art. 6.1.f) and, for connection data, legal obligation (art. 6.1.c) |
| Measuring the Site's audience anonymously | Legitimate interest (art. 6.1.f) — see section 12 |
| Responding to your requests and to the exercise of your rights | Legitimate interest (art. 6.1.f) and legal obligation (art. 6.1.c) |
No decision producing legal effects concerning you is made in a fully automated way: membership is approved by the board. The suspension of member features after the due date is an automatic consequence of non-payment, which you can lift by renewing your membership fee or by contacting the board.
Your data is never sold or used for advertising purposes.
Within the association: the board members, each according to their role (for example, the treasurer for payments). They are bound by confidentiality.
Other members: only the information displayed in the directory (section 7), if you have not objected to it.
The public: only content published voluntarily (death notices, donation causes, public announcements).
Our service providers (processors), who act only on the association's instructions:
| Provider | Role | Location of the data |
|---|---|---|
| Polene Tech (Paris) | design, development, maintenance of the platform | France |
| OVH SAS (Roubaix) | hosting of the servers and data; the Site's e-mails (confirmations, reminders, notifications) are sent from the association's own server, with no third-party platform | France |
| Cloudflare, Inc. | delivery of the Site, DNS, security, encrypted storage of backups, anonymous audience statistics | United States and worldwide network — see section 5 |
Providers acting as separate data controllers, subject to their own privacy policy:
| Provider | Role | Location |
|---|---|---|
| Stripe Payments Europe Ltd (Dublin, Ireland) | card payments (membership fees, donations, bookings), refunds, fraud prevention | European Union, with possible transfers to Stripe, Inc. (United States) |
| Google Ireland Ltd (Dublin, Ireland) | sign-in with a Google account, only if you choose this option | European Union, with possible transfers to Google LLC (United States) |
Authorities: your data may be disclosed to authorised authorities (tax administration, judicial authority) where the law requires it.
Some providers (Cloudflare, and where applicable Stripe and Google) may process data in the United States. These transfers are governed by:
The backups stored with Cloudflare are encrypted before they are sent: Cloudflare has no access to their content.
You can obtain a copy of these safeguards by writing to [email protected].
| Data | Retention period |
|---|---|
| Membership application not completed (form started, not paid) | 90 days, then deletion |
| Membership application refused by the board | deletion within one month of the refusal (payment and refund data is kept for accounting purposes, see below) |
| Member data (including the photo) | for the whole duration of the membership, then 3 years from the end of the last membership fee, in order to invite you to rejoin; then deletion or anonymisation |
| Member-file documents | duration of the membership, then deletion with the file (at the latest 3 years after the end of the membership) |
| Account deleted at your request | deletion within 30 days, except data that the law requires to be kept |
| Accounting records: payments, hire invoices, tax receipts, refunds | 10 years from the closing of the financial year (the period of article L. 123-22 du Code de commerce, applied out of caution; the minimum tax-audit period is 6 years, art. L. 102 B du Livre des procédures fiscales), in restricted-access archiving |
| Non-member donor data | 3 years from the last donation, then deletion (excluding accounting records) |
| Donation-cause page (first name and situation of the beneficiary) | duration of the collection, then removal from the public page within 3 months; immediate deletion at the beneficiary's request |
| Death notices | online for 12 months, then removal; immediate removal at any time at the family's request |
| Hall bookings (excluding accounting records) | 3 years from the date of the event |
| Class enrolments (including children's data) | duration of the activity year, then 1 year |
| Announcements published by members | until their expiry date or their removal, and at the latest at the end of the membership |
| Messages sent to the association | 3 years from the last exchange |
| Connection logs | 1 year |
| Logs of actions in the administration area | 1 year |
| Backups | daily encrypted backup, kept 7 days on the server and 30 days off-site; deleted data therefore disappears permanently from the backups at the latest 30 days after its deletion |
| Audience statistics | anonymous and aggregated data, with no time limit |
The directory is accessible only to signed-in members whose membership fee is up to date. It is never public nor indexed by search engines.
It contains only the information allowing members to recognise one another, in particular your surname and first name. Your profile photo is visible to other logged-in members in the directory; you can hide it at any time from your profile ("Hide my photo from the directory"). Your village of origin, your postal address and your date of birth are never displayed there. Other members can contact you from the directory.
Members undertake to use the directory only for exchanges between members, to the exclusion of any commercial solicitation, extraction or disclosure to third parties (see the Terms of use).
You may opt out of the directory at any time, without justification and without consequence for your membership, by e-mail to [email protected] (subject: "Annuaire"). Your request is processed within 7 days at most.
Data relating to deceased persons does not fall under the GDPR. The association nevertheless handles it with respect and discretion.
A death notice (name, photo, dates, place and time of the funeral, family contact) is published only with the family's agreement and after approval by the board. The person designated as the family contact consents to the publication of their contact details; photos showing living persons are published only with their agreement.
The family may at any time request the modification or removal of the notice at [email protected]; removal takes place as soon as possible and at the latest within 72 hours.
Membership is open under the age conditions laid down by the association's statutes. The data of children enrolled in classes is provided by their parents or legal representatives, who exercise their rights on their behalf. No photo of a child is published without the written authorisation of their legal representatives.
You have the following rights:
How to exercise your rights: by e-mail to [email protected] or by post to the registered office (3 rue Bernard Palissy, 93300 Aubervilliers). In case of reasonable doubt about your identity, proof of identity may be requested. We reply within one month, extendable by two months for complex requests (you will be informed).
Complaint: if you consider that your rights are not respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
We implement appropriate measures to protect your data:
In the event of a data breach presenting a risk to your rights, the association notifies the CNIL within 72 hours and informs you where the law requires it.
This policy may change, in particular when a new feature is added. The update date appears at the top of the page. In the event of a significant change, members are informed by e-mail or by notification.