Updated November 10 , 2024

1. Who is responsible for processing my personal data?

The data controller is the company GRANT Solutions SAS (hereinafter referred to as “ GRANT ”), whose head office is located at 8 Rue de l'Est 92100 Boulogne-Billancourt.

It determines for what purpose and how the personal data (hereinafter “personal data”) of users of the Grant application (hereinafter referred to as “you” / “your”) are processed.

Personal data means any information relating to an identified or identifiable natural person, such as for example your email address, your first and last name or your telephone number.

2. Why does GRANT collect my personal data?

2.1 General purposes of processing

We process your personal data as part of the services offered on our application and to ensure their management.

The purposes of the information collected via our cookies and trackers are detailed in our Cookie Management Policy .

2.2 Details of the purposes and legal bases applicable to the processing

The details of the purposes of processing your personal data and the legal bases on which the pursuit of each of these purposes is based are as follows:

The processing is necessary for the performance of the contract between us:

• Management of the execution of the services offered on the application,
• Support management,
• User account management,
• Management of donations and transfer of funds.

The processing is necessary to comply with a legal obligation:

• Combating fraud, money laundering and the financing of terrorism,
• Manage claims, pre-litigation and litigation,
• Retention of data relating to the creation of user accounts, connections to the application, payments made, with a view to possible legal requisitions,
• Manage user rights.

The processing is carried out if we have a legitimate interest in doing so:

• organize marketing operations (audience statistics, performance measurements, commercial prospecting, training, etc.

3. Processing carried out by STRIPE

The collection of payments and the payment of funds are managed by our payment service provider STRIPE. It carries out processing of personal data for which it is responsible, as described in its privacy policy accessible at the following link: https://www.STRIPE.com/conditions-generales-dutilisation/

4. What personal data is collected about me?

4.1 Categories of data processed

We are required to collect and process the following personal data:

• Identification data, name, first name, postal address, country of residence and telephone number;
• Data required for payment of tips: bank details (bank card code, visual cryptogram – only to ensure the transaction –, first and last name of the card holder
• Data required to receive tips: IBAN, document proving your identity (Identity card and/or Passport and/or driving license and/or Proof of employment. This list is not exhaustive.)
• Data relating to navigation on the website (timestamp, IP address of users, technical data relating to the equipment and browser used by users, cookies).

4.2 Mandatory nature of the collection of personal data

In all cases, the mandatory nature of the information is indicated by an asterisk (*) next to the relevant fields when they are collected. In this case, only the personal data strictly necessary for the purposes described above are collected. In the absence of an asterisk when they are collected, the information requested is optional.

‍4.3 Rules for using free fields

When a form (reviews, contacts) offers a free field, we ask that you do not provide any personal information and that you limit yourself to the information strictly necessary to process your request.

We reserve the right to remove any unnecessary information at your initial request.

We do not collect sensitive data about you.

We remind you that sensitive data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

If you voluntarily provide us with sensitive data, particularly in the context of your special requests, we will assume that you consider this transmission of additional information useful. By transmitting this information, you therefore explicitly consent to us processing these special categories of personal data. However, if we consider that this information is not relevant to your request, we reserve the right to delete it immediately.

4.4 Accuracy of the data communicated

You declare, as a user of the application, that you are informed of the importance of the accuracy of the personal data concerning you and that you provide through the application and/or in the context of your exchanges with us.

You also undertake to provide only accurate personal data during your exchanges with us, your requests and registrations, and for the entire duration of use of the application and to update them immediately if one or more of these personal data changes during the said duration of use of the application.

In this respect, you may in particular make a request for access and rectification, as well as opposition or erasure as provided for (among others) in article 8 “ What are my rights with regard to the use of personal data? ” of this Personal Data Protection Policy.

5. Who are the recipients of my data?

5.1 Categories of recipients

Depending on their respective needs, the following are recipients of all or part of the data:

• personnel responsible for publishing content, technical administration of the application or processing requests received via contact forms;
• personnel responsible for information systems security;
• said data may be transmitted to technical service providers participating in the achievement of these purposes, for information purposes, the data concerning our applications are hosted by Google servers in Frankfurt, Germany (Europe-West3 zone).
• to our online payment service provider (STRIPE) to ensure the effective completion of fund transfers and enable them to fulfil their own due diligence and obligations in the fight against fraud, money laundering and the financing of terrorism.
• to public bodies and authorities, legal assistants, persons responsible for financial control (auditors, accountants), entities responsible for the fight against fraud, money laundering and the financing of terrorism, and this exclusively to meet our legal obligations.

5.2 Transfer of personal data outside the European Union

As part of the use of the application, no transfer of personal data to countries that do not have an adequate level of protection within the meaning of the applicable regulations is planned.

6. How long will my data be kept?

The personal data collected is only kept for the period strictly necessary to achieve the purposes for which it is collected and processed:

• User account : data relating to the user account will be retained for the duration of the user's account activity and until its closure. In the event of inactivity of the account for an uninterrupted period of three (3) years, a notification will be sent to the user and, in the absence of a new connection within the month following the notification, the account will be closed and the personal data attached to it deleted.
• Data relating to user accounts and the sending or receiving of donations: for the duration of the user's account activity, then 5 years from the request to close the account (to comply with the legal requirement). In the event of inactivity of the account for 5 years without connection, we will ask you if you wish to keep your account. If you wish to close it, your data will be deleted within 3 months from your request.
• Cookies : the data required to produce audience statistics and usage of online services are stored in a format that does not allow individuals to be identified by their IP address, and include an identifier (relating to the cookie) stored for a maximum period of thirteen months unless the person concerned withdraws their consent. To find out more about cookies
• Complaint and request to exercise rights : your data is archived according to the legal limitation periods so as to enable us to establish and exercise our rights in court.
• Data relating to our obligations to combat fraud , money laundering and the financing of terrorism: 5 years from the termination of the contractual relationship or the closure of your account in the case of identity data and documents. 5 years from the execution of the financial transaction in question in the case of documents and information relating to the transactions carried out

7. How does GRANT protect my data?

All useful measures are taken to preserve the security and confidentiality of data and in particular to prevent them from being damaged or accessed by unauthorized third parties. To this end, we implement technical and organizational measures to guarantee an adequate level of security adapted to the risks.

8. What are my rights regarding the use of personal data?

With regard to your personal data, you have the following rights, within the limits of legal provisions:

• right of access;
• right of rectification;
• right to erasure;
• right to the limitation of one or more processing of personal data;
• rights to modify and/or withdraw, at any time, consents concerning the processing of his/her personal data based on his/her consent;
• right to object to the processing of his/her personal data;
• right to the portability of your personal data.
• right to define general and/or specific guidelines relating to the fate of his personal data and the manner in which he wishes his rights to be exercised after his death.

Depending on the type of right you are exercising and the information you request/wish to delete, GRANT may ask you to prove your identity.

You can make any request to exercise your rights relating to your personal data by contacting us:

• by email: contact@grantsolutions.fr 
• by mail to the following address: Grant Solutions, 8 rue de l'Est 92100 Boulogne-Billancourt, France

In the event of no response or no satisfactory response within two months of your request, contact the National Commission for Information Technology and Civil Liberties (CNIL) at 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 France – Tel: 01 53 73 22 22

Or via this form: https://www.cnil.fr/fr/webform/adresse-une-plainte

For your convenience, you will find below additional information regarding your rights: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles

9. Changes to this policy

This policy is intended to evolve and is therefore subject to change. In the event of minor changes, the new policy will be posted online on the application in the dedicated section. In the event of substantial changes, for example concerning the purposes or recipients, you may be informed directly.