Data processing agreement
Article 28 of regulation (EU) 2016/679 (GDPR). Version of 5 November 2026. Privacy policy · Terms of use
This agreement forms part of the Volunteo terms of use for every organiser who manages volunteers on the platform. It applies without a signature. An organiser who needs a signed copy for their own obligations downloads the PDF version, signs it, and sends it back through the contact form; we return it countersigned.
1. Parties and roles
The controller: the organiser, a legal entity or an individual, who creates an event on Volunteo and invites volunteers to it.
The processor: Anthony Lannuzel, publisher of Volunteo (volunteo.com), 4 rue Choquet de Lindu, 29200 Brest, France.
The processor processes volunteers' data solely on the organiser's behalf and according to their documented instructions, that is, the use of the Volunteo features as configured by the organiser. The data of the organiser's own account (credentials, billing) falls under the privacy policy, for which the publisher is the controller.
2. Subject matter, duration, nature and purpose of the processing
Subject matter: managing the volunteers of an event. Registration, information requested by the organiser, teams, availabilities, shifts, assignments, email communication, badges and documents, exports.
Duration: for as long as the organiser keeps their event on Volunteo, then the periods set out in section 7.
Nature: collection, recording, organisation, storage, consultation, disclosure to the managers appointed by the organiser, retrieval (exports), erasure.
Data subjects: the volunteers and the managers of the event.
Categories of data: identity and contact details, date of birth, photograph, additional information defined by the organiser (including uploaded files), availabilities and assignments, activity log. The organiser undertakes not to request special categories of data within the meaning of article 9 of the GDPR (health, opinions, and so on) without a legal basis of their own; if they collect any through a custom field, they alone bear responsibility for its lawfulness.
3. Obligations of the processor
- Process the data only on the organiser's instructions; inform the organiser if an instruction appears to infringe the GDPR.
- Ensure confidentiality: the persons authorised to access the data (the publisher, for support and maintenance) are bound by a duty of confidentiality.
- Implement the security measures set out in section 6.
- Assist the organiser in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection): volunteers can exercise most of these rights themselves from their profile; for the rest, the processor provides the data or carries out the requested operations within a time frame compatible with the one-month legal deadline.
- Notify the organiser of any personal data breach without undue delay after becoming aware of it, and at the latest within 48 hours, with the information needed for the organiser's own notification to the supervisory authority.
- Assist the organiser, on request and as far as possible, with impact assessments and prior consultations of the supervisory authority.
- Keep a record of the categories of processing activities carried out on behalf of organisers.
4. Sub-processors
The organiser gives general authorisation for the use of the following sub-processors, bound by obligations equivalent to those of this agreement:
| Sub-processor | Role | Location |
|---|---|---|
| Gandi SAS | Hosting of the application server (VPS) and of the database; backups on a second storage space (database encrypted, copy of uploaded files not encrypted) | France |
| Stripe Payments Europe Ltd | Card payments by organisers (organiser data only) | Ireland; transfers to Stripe Inc. (United States) covered by the standard contractual clauses |
| Functional Software Inc. (Sentry) | Application error reports, without IP addresses or cookies | European Union (Germany) |
Any change to this list is announced on the privacy policy at least 30 days in advance; the organiser may object in writing, in which case they may terminate their use of the service and export their data before the change takes effect.
5. Location and transfers
The data is hosted and backed up in France. No volunteer data is transferred outside the European Union. The only transfer outside the EU concerns the organiser's payment data at Stripe, covered by the European Commission's standard contractual clauses.
6. Security measures
- Encrypted connections (HTTPS), passwords stored hashed.
- Role-based access rights: each manager sees only the teams the organiser entrusts to them; administrator access is restricted to the publisher and logged.
- An activity log on every event, available to the organiser.
- Daily off-site backups, on a rolling 30-day window: database dumps are encrypted before leaving the server, the copy of uploaded files is not encrypted at rest and access to it is restricted to the backup account; restoration procedure tested.
- Security updates of the system and of the dependencies; monitoring of errors and of email deliverability.
- Automatic deletion of the files uploaded by volunteers in custom fields 12 months after the end of the edition; anonymisation of dormant volunteer accounts after 3 years, preceded by an email warning 30 days in advance; the accounts of organisers, of team or group managers and of payers are never anonymised.
7. Fate of the data at the end of the processing
When the organiser deletes the event, or on termination, the volunteer data attached to that event is deleted from the database; uploaded files are deleted within 30 days at the latest; backups are erased by rotation within 30 days. Before deletion, the organiser can export all of their data from the application (Excel and CSV exports, photographs). The organiser's billing data is kept for 10 years under accounting obligations.
8. Audit
The processor makes available to the organiser the information needed to demonstrate compliance with this agreement: this page, the privacy policy, and the record of processing activities on request. An on-site audit, at the organiser's expense and on reasonable notice of one month, is possible once a year at most, without access to the data of other organisers.
9. Miscellaneous
This agreement is governed by French law. Where it conflicts with the terms of use, this agreement prevails as regards personal data. It is updated as needed; the version in force is the one published at this address, dated at the top.
This English text is a translation provided for convenience. The agreement is written in French and governed by French law: in the event of a discrepancy, the French version prevails.