1 Scope and related documents
This policy covers processing carried out by France-USA-Net through the public website, online forms, and communications tied to the nonprofit mission (information, networking, events, outreach). It complements the legal notice and any contractual or regulatory terms governing institutional partners.
Third-party integrated services (hosting, email, analytics if enabled) are described in dedicated sections. France-USA-Net does not control third-party privacy policies linked from our pages — please review them at the source.
2 Data controller and mission
The controller for processing through this site is the France-USA-Net association, acting within its informational mission and U.S.–France civic outreach. Processing stays proportionate to those purposes; the association does not sell personal information as a business practice.
Dedicated privacy and compliance contact: legal@france-usa-net.com
3 Visual design and site evolution
Visual design and UX iterations were led voluntarily by Roger-Pierre LE GRASSE (RPLG) (notably in 2023 and 2026). Interface choices affect how privacy information is presented; the association alone remains responsible for the legal substance of this policy.
4 Hosting and technical subprocessors
Core infrastructure is provided by LWS (Ligne Web Services) — EU hosting unless specifically configured otherwise. Data processed there supports availability and backup. Vendor maintenance may occur under the provider's standards; it does not change France-USA-Net's stated purposes.
5 Partners and operational support
HLG has long supported communications, events, and receptions aligned with France-USA-Net's mission. Where personal data is shared in that context (e.g., logistics coordination), sharing is limited to what is necessary and remains under the association's accountability.
6 Data sources and categories processed
France-USA-Net primarily collects data you voluntarily submit through forms (identity, contact details, message, professional or organizational context where relevant). Limited technical data may be generated automatically: IP address, timestamps, browser type, pages viewed, secure session identifiers, and security/diagnostic logs.
We do not aim to profile visitors for advertising; any analytics, if enabled, supports understanding usage and improving informational content.
- Identity and professional context: name, organization if provided.
- Contact data: email, phone, postal address if collected.
- Free-text content: messages, motivations, attachments if the service supports them.
- Management data: administrative role assignments, registration or request dates.
7 Purposes, legal bases, and legitimate interests
7.1 Primary purposes
- Respond to contact form messages and manage follow-up.
- Process membership requests and manage authorized user accounts.
- Secure the website (abuse prevention, anti-spam, incident investigation).
- Meet applicable legal obligations (limited technical retention where required).
7.2 Legal bases (GDPR-oriented view)
Where the GDPR applies: processing necessary for pre-contractual steps or performance at your request (handling your inquiry or membership request); legitimate interests of the association (security, proportionate service improvements); legal obligations where applicable; and consent where that is the appropriate basis (e.g., optional communications or non-essential cookies).
7.3 U.S. transparency alignment
Even where EU law does not fully apply, France-USA-Net applies minimization, fairness, and clarity principles aligned with FTC guidance on privacy practices and consumer protection online.
8 Cookies, similar technologies, and preferences
The site uses strictly necessary cookies for technical operation (sessions, security, storing your consent choice). Audience-measurement cookies (visited pages, anonymized statistics) are only placed after your explicit consent via the cookie banner shown on your first visit.
Limited retention: it is not in France-USA-Net.Com's interest to keep data collected through audience cookies long term. Your consent automatically expires after one month; associated trackers are then disabled and audience cookies deleted. You may reopen your preferences anytime via the « Manage cookies » link in the footer.
Under the GDPR, the ePrivacy Directive, and CNIL guidance, refusing non-essential cookies does not affect navigation. For U.S. visitors, we do not sell your personal information (CPRA / FTC best practices).
9 Recipients and disclosures
Data is accessible only to authorized representatives of France-USA-Net (legitimate administration), technical vendors bound by confidentiality (hosting, professional email, backups), and competent public authorities when required by law.
We do not sell your personal information. If you follow outbound links to external services, those providers handle data under their own policies.
10 International transfers
Because of the association's Franco-American mission and use of infrastructure or services that may be located in the United States or elsewhere, some data may be transferred outside the European Economic Area. Where the GDPR applies, France-USA-Net implements appropriate safeguards (standard contractual clauses, supplementary measures, or other recognized mechanisms) consistent with EDPB and supervisory authority guidance.
11 Retention periods
Data from contact or membership forms is retained as long as necessary to handle the request, then kept only for limited evidentiary, anonymized statistical, or legal compliance purposes. After retention deadlines, data is deleted or anonymized where feasible.
Indicative retention periods
| Data type | Indicative period | Rationale |
|---|
| Contact messages | 3 years after last exchange | Follow-up and evidence |
| Membership requests | Duration of relationship + 3 years | Association management |
| Security logs | 6 to 12 months | Abuse prevention and diagnostics |
| Technical cookies | Session or minimum duration | Site operation |
| Audience cookies (with consent) | 1 month maximum | Page visit statistics — automatic deletion |
12 Security measures
France-USA-Net implements appropriate technical and organizational measures: TLS encryption, admin access controls, strong passwords, security updates, logging of sensitive operations where relevant, and training for authorized volunteers.
No measures guarantee absolute security; if a breach affecting personal data occurs, the association will document its response per applicable law and notify individuals when required.
13 Data subject rights and procedures
Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, portability where conditions are met, and withdrawal of consent when consent is the basis of processing.
Access
Obtain confirmation and a copy of your processed data.
Correction
Fix inaccurate or incomplete data.
Deletion
Request erasure when legal conditions are met.
Restriction
Temporarily limit certain processing.
Objection
Object to processing based on legitimate interest.
Portability
Receive your data in a structured format.
You may lodge a complaint with CNIL or another EU supervisory authority where applicable. U.S. privacy laws vary by state; the FTC provides educational resources on consumer privacy at ftc.gov.
To exercise rights with France-USA-Net, email legal@france-usa-net.com with a clear description of your request and, where necessary, proportionate proof of identity; we will respond within statutory timelines where they apply.
14 Children and youth audience
France-USA-Net's online services are not directed at collecting data from children under 13 without appropriate parental consent where U.S. law (Children's Online Privacy Protection Act — COPPA, enforced by the FTC) or other rules require it. If you believe a minor submitted information improperly, contact us so we can take appropriate steps.
FTC — COPPA compliance resources (informational)
15 Policy updates
France-USA-Net may update this policy to reflect legal, technical, or organizational changes. Substantive updates will be highlighted on the site when reasonably practicable. Continued use after publication constitutes notice of the current terms, without prejudice to your rights regarding ongoing processing.
16 Contact
EU framework (GDPR)
U.S. best practices (FTC)
