Data protection · Version of 9 October 2026
Human Sea Bridge (Pont de Mer Humanitaire) protects the personal data entrusted to it through its humanitarian coordination, educational work and the running of the association. We collect only what is necessary and take particular care with health data.
This policy sets out who is responsible for your data, what we process and on what legal basis, the specific rules for health data and minors, who receives data, transfers outside the European Economic Area, retention periods, payments, audience measurement, security and your rights.
1. Data controller
Pont de Mer Humanitaire, a non-profit association governed by the French Law of 1 July 1901, 3 impasse Deyrolle, 29900 Concarneau, France.
Contact and exercise of your rights: contact@humanseabridge.org.
2. Our principle: collect less, protect more
A first contact should include only the information needed to understand and route the request. Please do not send medical records through a general form: after a first exchange, we will tell you which secure channel to use.
Medical records, identity documents and data about third parties are requested only when they are essential, and access to them is limited to authorised people.
3. Data processed, purposes and legal bases
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact requests | Identity, contact details, message, organisation | Reply to the request and route it | Pre-contractual measures or legitimate interest in handling enquiries |
| Medical, humanitarian or educational support | Strictly necessary data: health, family and administrative situation, academic background, consents | Assess and coordinate the pathway | Explicit consent; pre-contractual measures; legal obligations; exceptionally, vital interests |
| Donations, dues and membership | Identity, contact details, amount, payment status and reference | Process the transaction, send confirmations and receipts, keep accounts, prevent fraud | Performance of the transaction or membership; accounting and tax obligations; legitimate interest |
| Information for members | Members’ contact details | Keep members informed about the association (general meeting, dues) | Legitimate interest |
| Volunteers, partners and applications | Identity, contact details, skills, availability, organisation | Consider the offer and organise the collaboration | Pre-contractual measures; legitimate interest |
| Newsletter | Email address and proof of consent | Send the newsletter, at most once a month | Consent, which can be withdrawn at any time |
| Audience measurement and security | Anonymised IP address, technical data, logs | Measure use of the site, prevent abuse, keep the service running | Legitimate interest |
Emails to members and the newsletter are sent through Hostinger Reach, our web host’s mailing service; every message includes an unsubscribe link. The members’ list does not receive the newsletter.
No personal data is sold, rented or transferred for commercial purposes. No payment, donation or membership data is used for marketing without separate consent.
4. Health data and minors
Processing of health data is based on the person’s explicit consent. Vital interests are relied on only in exceptional circumstances, when the person cannot consent and the law allows it.
Health data is accessible only to authorised people. It is shared with a health professional, hospital or institution only when this is necessary for the pathway, within the appropriate legal framework. A useful request does not always require a complete file: data minimisation applies at every stage.
For a minor, we seek the authorisation of the legal representative and take the best interests of the child into account.
Particularly sensitive data is never made public simply because a pathway has previously been the subject of public communication.
5. Recipients
Only authorised members of the association and the service providers we need receive data, strictly within the limits of their role:
- our hosting, maintenance and email providers;
- Stripe, for online payments made on the site;
- HelloAsso (HelloAsso SAS, France), only for donations and memberships made on that platform before October 2026; the association no longer uses it for new fundraising;
- Hostinger Reach, for emails to members and the newsletter;
- our banking and accounting providers;
- for an individual case, the health professionals, hospitals, universities, humanitarian organisations or relevant authorities needed to assess it.
Every transfer serves an identified purpose.
6. Transfers outside the European Economic Area
Some service providers or partners may be located outside the European Economic Area, in particular in Egypt for exchanges with the people we support and with care providers. We transfer only the information that is strictly necessary, with the explicit consent of the person concerned, and before each transfer we check the applicable legal mechanism: an adequacy decision, standard contractual clauses, a derogation provided for by the GDPR or another appropriate safeguard.
For an international humanitarian or medical pathway, the person is informed of the necessary transfers and of any risks before giving consent, except in a life-threatening emergency as provided for by law. This information never makes the association the authority that decides on the pathway.
7. Retention periods
| Data | Retention period |
|---|---|
| General enquiries | Up to 3 years after the last relevant exchange |
| Volunteer applications | Up to 2 years after the last exchange |
| Support case files | During active follow-up, then restricted archiving for up to 5 years where needed for continuity, evidence or the defence of rights; deleted or anonymised earlier where possible |
| Accounting records, donations and dues | 10 years where accounting or tax rules require it; other payment data only as long as needed to manage the donation, regular support, membership or a dispute |
| Applications, volunteers and partners not taken forward | Up to 3 years after the last contact; contracts and evidence according to applicable legal periods |
| Newsletter | Until consent is withdrawn or 3 years after the last interaction; proof of consent may be kept for the applicable limitation period |
| Raw audience-measurement data (Matomo) | 13 months maximum |
| Technical and security logs | 12 months maximum, unless an incident justifies keeping them longer as evidence |
At the end of these periods, data is deleted or anonymised.
8. Online payments
Card details are entered only on Stripe’s secure pages: Human Sea Bridge never receives or stores them. Stripe applies its own retention policy.
Monthly support can be changed or cancelled at any time from Stripe’s secure customer portal.
9. Audience measurement (Matomo)
Matomo is hosted by the association and is used only to produce anonymous statistics to improve the site. No audience-measurement cookie is set and IP addresses are anonymised. Visitor identification, cross-site tracking and advertising features are disabled.
You can still opt out of audience measurement using the module below; your visits will then no longer be recorded. This choice is stored in a functional cookie: if you clear your cookies or change browser or device, you will need to opt out again.
10. Security and data breaches
We apply access control, data minimisation, back-up and, where appropriate, encryption. Authorised people are trained in confidentiality.
If a breach poses a risk to people’s rights and freedoms, we notify the French data protection authority (CNIL) and, where the level of risk requires it, inform the people concerned.
11. Your rights
You can ask for access to your data, its rectification or erasure, restriction of its processing and, where applicable, its portability. You can object to processing based on legitimate interest and withdraw your consent at any time, without affecting processing carried out before the withdrawal.
Write to contact@humanseabridge.org or to the association’s registered office. Proof of identity is requested only if there is reasonable doubt about the requester’s identity. You may also lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).
12. Updates
This policy changes with the services actually used, legal requirements and the association’s practices. The version date at the top of the page identifies the applicable version. The site publisher, publication director and host are listed in the Legal Notice.
Payments, memberships and recurring donations through Stripe
When you make a donation, set up monthly support or pay a membership fee, we process the identity, contact, transaction and payment-status information needed to complete the payment, issue confirmations, keep our accounting records, manage the donor or member relationship and prevent fraud. Card details are entered only on Stripe’s secure hosted pages and are not stored by Pont de Mer Humanitaire.
The legal bases are performance of the requested transaction or membership agreement, compliance with our accounting and tax obligations, and our legitimate interests in securing payments and managing the relationship. Payment data is transmitted to Stripe and, where necessary, to our authorised accounting, banking, hosting and technical providers. These recipients act only within their respective responsibilities and access rights.
Transaction and accounting records are retained for the statutory periods applicable to the organisation. Operational contact and payment-status data is kept only for as long as needed to manage the donation, recurring support or membership and any related dispute. Stripe applies its own retention periods under its privacy policy. Payment, donation and membership data is not used for marketing without separate consent.
You may exercise your data-protection rights using the contact details shown on this website. You may manage or cancel monthly support through the secure Stripe customer portal.
