Privacy Policy
Dernière mise à jour : 29 June 2026
CommonLink places great importance on the protection of personal data. This Privacy Policy explains what personal data is collected, for what purposes, on what legal bases, for how long it is retained, with whom it may be shared and what rights can be exercised.
1. Data controller
SAS, social and solidarity economy company
Registered office: 1047 Chemin des Impiniers, 06220 Vallauris, France
SIREN: 105 153 928
Email : legal@common-link.org
The personal data referent is: Julian Maiolino
CommonLink has not appointed a Data Protection Officer.
2. Data collected
2.1 Donor data
CommonLink may collect in particular: first name, last name, email address, postal address, country of residence, account information, donation data (date, amount, organisation, campaign, payment method), tax receipt order numbers, donation history, IP address, technical logs, support exchanges.
CommonLink does not directly collect full credit card data.
2.2 Beneficiary organisation data
CommonLink may collect in particular: name, legal form, address, identification number, information about representatives, KYB documents, banking information, campaign data and proof of fund use.
2.3 Technical data
CommonLink may collect: IP address, connection logs, browser and device data, security data, strictly necessary cookie data.
3. Processing purposes
Personal data may be processed for:
- creating and managing user accounts and beneficiary organisations;
- presenting campaigns and processing donations;
- generating and transmitting tax receipts;
- providing transparency information and proof of use;
- KYC, KYB compliance, anti-fraud and applicable obligations;
- managing support and contact requests;
- invoicing beneficiary organisations and accounting;
- compliance with legal and regulatory obligations;
- Site security and fraud prevention;
- B2B prospecting for organisations likely to use CommonLink;
- sending newsletters to those who have given their consent.
4. Legal bases
Processing is based, as applicable, on:
- performance of a contract or pre-contractual measures;
- compliance with legal obligations;
- CommonLink's legitimate interests (security, fraud prevention, B2B prospecting);
- the data subject's consent (newsletter, certain cookies);
- the establishment, exercise or defence of legal claims.
5. Data recipients
Personal data may be shared, as applicable, with:
- authorised internal CommonLink teams;
- beneficiary organisations concerned by the donations;
- payment and electronic money providers;
- KYC or KYB providers;
- hosting providers (Clever Cloud);
- technical, transactional email and support providers;
- administrative, judicial or tax authorities where required by law.
CommonLink may use Monerium's services for certain features related to electronic money and flow transparency.
6. Transfers outside the European Union
CommonLink favours providers located in the European Union. At launch, CommonLink does not intend to transfer personal data outside the European Union.
7. Retention periods
| Data category | Retention period |
|---|---|
| Donor account data | Duration of account existence, then archiving if necessary |
| Donation data, tax receipts and accounting obligations | Up to 10 years from the close of the relevant financial year |
| Beneficiary organisation data | Duration of the contractual relationship, then archiving per legal obligations |
| Technical logs and security data | 6 to 12 months, unless longer retention is necessary in the event of an incident |
| B2B prospecting data | 3 years from the last active contact |
| Newsletter data | Until consent is withdrawn or 3 years after the last contact |
| GDPR rights requests | Time needed for processing, then evidentiary archiving up to 5 years |
8. Newsletter and prospecting
CommonLink may send a newsletter to those who have given their consent (opt-in). Each email contains an unsubscribe link.
CommonLink may carry out B2B prospecting targeting organisations likely to be interested in its services.
9. Cookies and audience measurement
At launch, CommonLink uses only cookies strictly necessary for the Site to function. For more information, users can consult the Cookie Policy. Cookie Policy
10. Security
CommonLink implements reasonable technical and organisational measures to protect personal data: access control, secure hosting, encryption, logging, role separation, restriction of access to authorised persons.
11. Data subject rights
In accordance with applicable regulations, any data subject may exercise:
- right of access;
- right to rectification;
- right to erasure;
- right to object;
- right to restriction of processing;
- right to data portability;
- right to withdraw consent at any time;
- right to define directives regarding the fate of data after death.
These rights may be exercised by writing to: legal@common-link.org
CommonLink aims to respond within 7 business days.
12. Complaint to the CNIL
If a person believes that their rights are not being respected, they may lodge a complaint with the CNIL.
13. Changes to the Privacy Policy
CommonLink may modify this Privacy Policy to reflect changes to the Site, the Platform, the processing carried out, the providers used or applicable regulations. The applicable version is the one published on the Site.