This Policy governs how personal data are collected, used, disclosed, stored, secured, retained, transferred and disposed of by or for SPAG. As an association established in France, SPAG is bound by the GDPR and by the French Data Protection Act of 6 January 1978 (Loi Informatique et Libertés), and is supervised by the CNIL.
The people whose data SPAG holds are varied: members, applicants, partners, donors, event participants, website users, newsletter subscribers, public officials, experts, research participants — and complainants, whistleblowers, witnesses and subjects of allegations. The safeguards applied reflect the risk each of those situations carries.
Two commitments shape the rest. Data are collected only where adequate, relevant and limited to what the stated purpose reasonably needs — never because they might prove useful later. And they are kept in identifiable form only as long as that purpose requires, because storage being cheap is not a reason to retain anything indefinitely.
This page describes SPAG's institutional rules. It does not replace the specific privacy notice, consent form or contractual clause that a particular activity requires, and a general policy alone never satisfies every transparency obligation.
Access
Obtain confirmation of whether SPAG processes your personal data and, where it does, a copy along with information about the purposes, categories, recipients, retention and the source where the data did not come from you.
Clause 9.2Rectification
Have inaccurate data corrected and incomplete data completed. SPAG separately maintains procedures for correcting material inaccuracies in records used for institutional decisions, publications, research findings and stakeholder management.
Clause 9.2, 10.5Erasure
Ask for data to be deleted where the conditions in law are met. The right is not absolute: retention may continue where it remains necessary and proportionate for legal, safeguarding, evidentiary or accountability reasons, or where the rights of others are engaged.
Clause 9.2, 20.5Restriction
Require SPAG to limit how your data are used while a dispute over accuracy, lawfulness or an objection is resolved, rather than having the data erased outright.
Clause 9.2Portability
Where the conditions apply, receive the personal data you provided in a structured, commonly used and machine-readable form, or have it transmitted to another controller.
Clause 9.2Objection
Object to processing carried out on the basis of legitimate interests or a public-interest task, and to processing for direct marketing. Rights also apply in relation to certain automated decision-making.
Clause 9.2Withdraw consent
Where processing rests on consent, withdraw it at any time and by a means as easy as the one used to give it. Withdrawal does not make earlier processing unlawful, and consent is never bundled with unrelated conditions.
Clause 6.4, 9.2Complain to the CNIL
Lodge a complaint with the Commission nationale de l'informatique et des libertés, the French supervisory authority, at cnil.fr. SPAG respects that right and cooperates with the CNIL where legally required.
Clause 2.3, 9.2To answer a rights request, in principle, from receipt. SPAG will not insist on a particular form where the request can reasonably be identified and authenticated another way.
Clause 9.1, 9.3Further extension where law permits it because of complexity or volume — and only if you are told within the first month.
Clause 9.3For anyone who discovers a suspected breach to report it internally, where practicable, to the Data Protection Lead or other authorised recipient.
Clause 17.1To notify the CNIL where a breach is likely to result in a risk to people's rights and freedoms, unless an exception applies. Where the risk is high, affected individuals are told directly.
Clause 17.3–17.4Discover
A breach is any security failure leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Clause 17.1Report internally
Immediately, and where practicable within twenty-four hours. Nobody makes an external notification on SPAG's behalf unless authorised to do so.
Clause 17.1–17.2Contain
Preserve the evidence, avoid spreading the data further, and take reasonable immediate containment steps within your own authority.
Clause 17.2Assess and record
Every confirmed breach is documented. The assessment establishes whether it is likely to result in a risk, or a high risk, to the rights and freedoms of the people affected.
Clause 17.3Notify
The CNIL without undue delay and, where feasible, within seventy-two hours where a risk is likely. Where the risk is high, affected people are told directly, with information they can act on.
Clause 17.3–17.4Learn
After a significant incident, root causes, corrective measures, access controls, supplier arrangements, training and procedures are reviewed, and the agreed remediation is tracked to completion.
Clause 17.6Anonymous wherever the purpose allows
The research lead must decide whether identifiable data are necessary at all, and prefer anonymised or aggregated information wherever the purpose can be achieved without identification. Datasets shared with external collaborators are anonymised where reasonably possible.
Agreeing to take part is not a legal basis
Consent to participate in research and the GDPR basis for processing are related but distinct. No research team may assume that agreeing to an interview establishes the correct legal basis for every later use of that person's data.
Publishing a quote is a separate decision
Publication of a quotation, case study, photograph, recording or identifiable profile is assessed on its own where it was not clearly covered by what the participant was originally told — with particular care in conflict, displacement and politically exposed contexts.
Sensitive data are never collected by default
Policy research can touch political opinion, ethnic origin, religious belief and health. None of it is gathered as a matter of course: the project owner must show the information is necessary for a defined purpose and that safeguards are in place.
High-risk work is assessed before collection begins
Where research involves special-category or criminal-offence data, or information that could expose participants to retaliation, discrimination, political risk or physical harm, enhanced risk assessment and access controls — and where appropriate a full impact assessment — come first, not afterwards.
Public information is still personal data
Data taken from public sources remain personal data where someone is identifiable. Being publicly available removes none of SPAG's obligations on lawful basis, fairness, transparency, purpose limitation, security or your rights.
Enhanced controls, not ordinary ones
These records can hold allegations, witness information, health and sexual-life data, political opinions, criminal-offence data and information capable of exposing someone to retaliation. They carry enhanced confidentiality and access controls throughout.
Seriousness is not a reason to circulate
Information is shared only with those who need it for safeguarding, assessment, investigation, due process, legal compliance, support or governance. Wider managerial circulation is prohibited precisely because a matter is serious or sensitive.
Facts kept separate from allegations
Case records distinguish, where practicable, verified facts from allegations, opinions, procedural actions and outcomes — and avoid irrelevant personal detail at every stage.
No identity disclosed on an informal request
Access and other rights are assessed against legal restrictions and the rights of others, including whistleblower protection. Nobody discloses a whistleblower's identity or safeguarding information merely because someone has asked for it.
Exercising your rights
Requests reach SPAG through the Secretariat and are forwarded promptly to the designated Data Protection Lead. There is no required form — a request is acted on wherever it can reasonably be identified and you can be authenticated, though SPAG may take proportionate steps to verify who you are before disclosing personal data.
If a concern relates to misconduct rather than to your own data, the Whistleblowing & Complaints mechanism applies instead. You may also complain to the CNIL at any time.
