Public reading
This policy is written to make processing principles, security measures, and data-subject rights understandable without requiring prior legal expertise.
PUBLIC DOCUMENT
Privacy policy
Data-processing framework and protection safeguards at CSAEAI.
Updated: September 9, 2026
Preparatory document · identity, hosting, retention periods, and providers require legal validation
Why this policy matters
Respect for privacy directly extends our principles of governance, minimisation and evidence-based accountability.
Controller and scope
- This policy covers CSAEAI’s public website, its publications and enquiries initiated by visitors.
- The controller’s complete legal identity, professional address and contact details must be confirmed before formal adoption of this document.
- Any new public service will be accompanied by dedicated information before it is opened.
Information you provide
- When you send an email, we may receive your address, stated identity, organisation, subject, message and any attachment you choose to include.
- CSAEAI does not ask for passwords, access credentials, confidential audit material or unnecessary personal data during an initial exchange.
- Editorial contributions and requests for a right of reply may include the material required for their review.
Technical information
- The server and hosting provider may process an IP address, date, time, requested page, browser information, response status and security events.
- Language and display preferences are retained on the device as described in the Cookies policy.
- No advertising-profiling mechanism is declared active in this edition.
Purposes
- Deliver the website, retain reading choices and support its security, availability and technical diagnosis.
- Respond to enquiries concerning research, media, editorial contributions, partnerships or individual rights.
- Document necessary exchanges, prevent abuse and protect the rights of CSAEAI or third parties.
Legal grounds
- Legitimate interests may support publication and security of the website, abuse prevention and the management of expected professional exchanges.
- Pre-contractual steps may apply when someone asks CSAEAI to consider a future collaboration or service.
- Consent applies where required for an optional feature; a legal obligation applies where retention or disclosure is required by law.
Recipients and processors
- Access is limited to authorised persons who need the information for the relevant purpose.
- Hosting, email and technical service providers may act as processors according to the services ultimately selected.
- The definitive list of providers, their roles and safeguards will be published after the operating arrangements are validated.
International transfers
- Some providers may process data outside the EEA.
- Where applicable, CSAEAI will document the destination, transfer mechanism, and safeguards.
- No specific transfer is asserted until the final providers are selected.
Retention
- Messages are kept as needed to respond, meet legal duties, or defend rights.
- Technical logs should follow short documented periods unless an incident or legal duty requires longer retention.
- A quantified retention schedule must be approved before official publication; indefinite retention is not the default.
Security and minimisation
- Proportionate access control, segregation, updates, backups, logging, and incident management measures are intended.
- Do not email passwords, keys, secrets, sensitive data, or confidential audit datasets without an agreed secure channel.
- Suspected incidents should be reported promptly through Contact.
Complaints and exercise of rights
- Use Contact with subject ‘Privacy request’; proportionate identity evidence may be requested when reasonably necessary.
- You may complain to the French CNIL or the competent authority where you live.
- Withdrawing consent does not affect processing already lawfully carried out.
Children, external links, and changes
- The public website is not specifically directed to children and does not knowingly solicit their data.
- External websites apply their own policies.
- Material changes will be dated and previous versions should remain traceable.