Privacy policy
Last updated: 18 September 2026. Terms of use · Data processing agreement (in French)
Who is responsible for your data?
Volunteo (volunteo.com) is published by Anthony Lannuzel, 4 rue Choquet de Lindu, 29200 Brest, France. For any question about your data: contact form.
Two situations must be told apart:
- Your Volunteo account (login, password, preferences, sign-ins): the publisher is the data controller.
- Your data as a volunteer on an event (profile, availabilities, assignments, information the organiser asks for): the organiser of the event is the controller, and Volunteo acts as its processor, under the data processing agreement. The organiser informs you about what they do with these data; we never use them for our own purposes.
Which data, for what?
| Data | Purpose | Legal basis |
|---|---|---|
| Identity and contact: first name, last name, email address, phone number(s), postal address, date of birth, sex, picture (as the organiser makes them mandatory) | Create your account, identify you, let the organiser reach you, produce badges and documents | Performance of the contract (account); organiser's instructions (volunteering) |
| Additional information defined by the organiser (skills, T-shirt size, licences, uploaded files: certificates, proofs) | Organise the event as the organiser needs | Organiser's instructions, who is responsible for them |
| Wished teams, availabilities, booked shifts, assignments, comments | Build the schedule, tell you about your assignments | Performance of the contract |
| History of actions on an event (log), emails sent | Traceability for managers, support | Legitimate interest (security, support) |
| Organisers' orders and payments (amount, date, invoice, last payment method at Stripe) | Billing | Legal obligation (accounting) |
| Technical data: IP address and browser in server logs, application errors | Security, diagnosis | Legitimate interest |
| Audience measurement of the public pages (page views, origin), cookieless, truncated IP | Know which pages are read | Legitimate interest; exempt from consent (French CNIL guidance) |
Card numbers never reach our servers: they are entered directly at Stripe.
For how long?
- Files uploaded by volunteers in an organiser's custom fields (proofs, certificates, documents): deleted automatically 12 months after the end of the edition they were collected for, whether the account stays active or not. Profile pictures, event banners, badge and document templates are not concerned: they follow the account or the event.
- Volunteer account: after 3 years without a sign-in or a participation in an event, an email warns you; without a sign-in within the next 30 days, the account is anonymised (name, contact details and picture erased). Accounts that organised an event are never anonymised. You can delete your account at any time from your profile.
- Event data (teams, assignments, log): kept as long as the organiser keeps the event, so that the next edition can be prepared; deleted with the event on the organiser's request.
- Invoices and payments: 10 years, accounting obligation.
- Technical logs and error reports: 90 days at most.
- Backups: encrypted, off-site, a rolling window of 30 days; a deletion is final after that.
Where are your data, and who can access them?
The application and its database are hosted on a server located in France. Sub-processors, all bound by contract:
| Sub-processor | Role | Data | Location |
|---|---|---|---|
| Gandi SAS | Hosting of the application and database server (VPS); encrypted backups on a second space | All | France |
| Stripe | Card payments by organisers | Organiser's email, amount; card entered at Stripe | Ireland / United States, EU standard contractual clauses |
| Sentry | Application error reports | Technical trace, id of the account concerned; no IP address, no cookies | European Union (Germany) |
| Matomo (self-hosted) | Audience measurement | Page views, truncated IP, no cookie | Our own servers |
Emails leave from our own mail server, without a third-party relay. PDF documents (badges, schedules) are produced on the same server. No data is sold or shared for advertising.
Your volunteer data can be accessed by the managers of the event and of your teams, appointed by the organiser, and by the publisher for support and maintenance, under a confidentiality obligation.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection.
- From your profile: read and correct your information, download your schedule, delete your account.
- Through the contact form: any other request; answered within a month.
- For data processed on behalf of an organiser, address the organiser first; we assist them in answering.
- You may lodge a complaint with the French supervisory authority, the CNIL, or the one of your country.
Cookies
Volunteo only uses cookies needed to work: the session cookie, and the "remember me" cookie when you ask for it at sign-in. Audience measurement sets none. No advertising cookie.
Security
Encrypted connections (HTTPS), hashed passwords, restricted and logged administrator access, encrypted backups, server security updates, error monitoring. Should a data breach likely to put you at risk occur, we inform the organiser and, where required, the supervisory authority within 72 hours.
Changes
This policy may change; the date at the top prevails. Significant changes are announced on the site.