Privacy policy.

1. Data controller.

The controller of the processing described here is Quadrant CPES, a non-profit association governed by the French law of 1 July 1901, represented by its President.

The association has appointed a data protection officer: Maxence Sylvestre, who can be reached at dpo@quadrantcpes.com. Please use this address for any question about your personal data or to exercise your rights. For anything else: hello@quadrantcpes.com.

2. Data processed and purposes.

We only collect the data needed for each of the following purposes.

Visiting the site

Pages viewed, referring page, date and time, device and browser type, country inferred from the IP address. This data is only used for anonymous traffic statistics (section 7).

Contact form

Name, email address, subject, school or organisation if provided, message. This data is used to answer and follow up on your request. An acknowledgement is sent to the address you give.

Membership request

First name, last name, email address, phone number, LinkedIn profile if provided, profile (student, alumni, external), year group, institution and programme, interests, motivation. This data is used to review and answer your request. The phone number is only used to add you to the Quadrant WhatsApp community, which you can leave at any time.

Running the association

The association keeps a register of its members: identity, contact details, membership category (active, founding, alumni, external, honorary, benefactor), membership seasons, fees, event attendance, attendance at general meetings and, where relevant, role in the team. It is used to manage memberships and fees, organise events, convene members to general meetings and produce attendance sheets. Changes to the register are logged for data security.

Newsletters

First name, email address, chosen lists, confirmation date. This data is used to send you Quadrant news and event invitations (section 6).

Team

For team members, first name, last name, role, photo and LinkedIn profile are published on the Team page, with their agreement.

Management area

For team members who administer the site, email address, access rights and sign-in data (including two-factor authentication) are used to secure access to the management area.

3. Legal bases.

• Performance of the membership contract (Article 6(1)(b) GDPR): membership requests, member register, fees, notices and statutory communications.
• Legal obligation (Article 6(1)(c)): keeping accounting records for fees.
• Consent (Article 6(1)(a)): newsletters for non-members, publication of team members’ details. It can be withdrawn at any time, without affecting processing already carried out.
• The association’s legitimate interest (Article 6(1)(f)): answering messages, informing members about the circle, audience measurement, protecting forms against bots, securing the management area.

4. Recipients.

Your data is only accessible to the Quadrant team members who need it for their role, under access rights defined role by role: for example, contact details and internal notes are only visible to authorised people.

It is also processed by our technical processors (section 9), strictly within the scope of their service.

We never sell or rent any data. Members’ and participants’ contact details are never passed on to a partner company without the explicit consent of the people concerned.

5. Retention periods.

• Contact messages: three years after the last exchange.
• Unsuccessful membership requests: deleted at the latest one year after the reply.
• Member register: for the duration of membership, then three years after the last membership season. Data may then be anonymised for statistics.
• Fees: ten years, with the payer’s name, as required by law for accounting records.
• Attendance sheets and records of notices sent: as long as the general meeting minutes they relate to, as evidence.
• Newsletters: until you unsubscribe. An unconfirmed subscription is erased after thirty days. After you unsubscribe, your address is only kept to respect your choice; you can ask for it to be fully erased.
• Traffic statistics: twenty-five months at most.
• Management area accounts: deleted when the person leaves the team.

6. Emails and newsletters.

Non-members. You subscribe from the sign-up band on the site, choosing your lists. The subscription only becomes active once you confirm it from the link sent to your address.

Members. Your member address is subscribed by default to the association’s lists, to keep you informed about the circle. You can unsubscribe at any time.

Statutory communications. Notices of general meetings and membership-related information are sent to all members, subscribed or not: you cannot opt out of them while you are a member.

Every newsletter contains a link to choose your lists or unsubscribe, and your email client may offer one-click unsubscribe. An unsubscription you make is respected for good: the team cannot add you back to a list you left.

We use no tracking pixel: we measure neither opens nor clicks. The logo in our emails is loaded from our host, like any image; we do not use these loads.

7. Audience measurement and cookies.

This site sets no cookies and stores no identifier in your browser.

We measure traffic with PostHog, hosted in the European Union (Frankfurt, Germany). A short-lived technical fingerprint, computed on the server and renewed every day, only lets us count visits, without following you from one day to the next or across sites. The IP address is not stored. There is no session recording, no profile and no matching with other data, and URL parameters are removed before sending.

This processing meets the consent exemption conditions set by the French data protection authority (CNIL) for audience measurement: strictly limited purpose, anonymous statistics, no reuse. Your browser’s “Do Not Track” signal is respected.

This choice is remembered on this device, in the browser’s local storage, for that sole purpose.

8. Security.

Data is stored in the European Union and only transmitted over encrypted connections. The management area is restricted to team members, with mandatory two-factor authentication and rights limited to what each person needs. Forms are protected against bots and abuse.

9. Processors and transfers.

• Vercel Inc. (United States) hosts the site and the management area. It may process visitors’ IP addresses in its technical logs, for security and service operation.
• Supabase stores, in the European Union, the database (requests, members, subscriptions) and management area accounts.
• Resend delivers emails: forms, replies to requests, newsletters and notices.
• PostHog provides audience measurement, with storage in the European Union.
• Cloudflare Turnstile protects forms against bots. It loads on the Join page and, elsewhere, only when you start filling in the sign-up band. It sets no advertising cookies and processes technical data (IP address, browser characteristics) solely to tell humans from bots.

Where these providers, based in the United States, may access data, transfers are covered by the European Commission’s standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

Fonts are hosted on our own servers. The site embeds no third-party content: no video, no social media, no advertising.

10. Minors.

Some CPES students are under eighteen. They may become members and subscribe to newsletters. A person under fifteen may only subscribe to newsletters with the agreement of a holder of parental authority.

11. Your rights.

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, to withdraw your consent at any time and to give instructions on what happens to your data after your death.

To exercise them, write to the data protection officer at dpo@quadrantcpes.com. We may ask you to prove your identity if in doubt. We reply within one month, which may be extended by two months for a complex request; you will be told if so.

If, after contacting us, you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.

12. Changes.

This policy may change, in particular to reflect a new service or a change in the law. The version in force is the one published on this page; the French version prevails. Members are informed by email of any significant change.