Data protection

Your personal data

This is the record we keep under Article 30 of the GDPR. It is checked on every release: a processing activity without a legal basis or a retention period blocks publication.

Controller: Adama Diallo, for Adama OS (SASU registered with the Paris Trade Registry, SIREN 934 512 872)
To exercise your rights or ask a question: contact@conhama.com

Current processing

Current
Field interviews
Purpose
Understand how sustainability actors find each other and work together, before building anything.
Legal basis
Legitimate interest
Why this basis
Legitimate interest in studying a need with professionals who agreed to an interview; recording only happens with explicit agreement.
Data subjects
Interviewed professionals (companies, sustainability departments, consultancies, clusters, funders, researchers).
Data
Name, job title, organisation, contact details, interview notes about professional activity.
Recipients
The project founder only. Summaries are pseudonymised (codes E01 to E30).
Retention
Contact details kept three years after the last exchange, then deleted; pseudonymised summaries kept for the duration of the project.
Security
Single-user workspace, two-factor authentication, no copy outside that workspace.
Your rights
Access
Rectification
Erasure
Restriction
Objection
Current
Institutional letters of interest
Purpose
Collect and archive institutions' written interest in the demonstrator, and attach it to funding applications.
Legal basis
Legitimate interest
Why this basis
Legitimate interest in proving institutional interest to funders; the letter is signed voluntarily by its author.
Data subjects
Letter signatories, on behalf of their institution.
Data
Name, job title, institution, signature, professional contact details.
Recipients
The founder and, letter by letter, the funders to whom an application is submitted.
Retention
Five years after the last funding file citing the letter is closed.
Security
Single-user archive, signed versions kept read-only.
Your rights
Access
Rectification
Restriction
Objection
Current
First volunteer testers and contributors
Purpose
Contact again the people who offered to test the demonstrator, suggest a source or make it a study topic.
Legal basis
Consent
Why this basis
People volunteer themselves by replying to a message; they can withdraw their agreement at any time.
Data subjects
Students and alumni of the master's programme who volunteered.
Data
Name, contact details, chosen form of participation.
Recipients
The founder only.
Retention
Until the end of the demonstrator, or until consent is withdrawn if earlier.
Security
Single-user list, never shared nor passed to another activity of the founder.
Your rights
Access
Rectification
Erasure
Withdrawal of consent
Current
Handling data protection requests
Purpose
Answer requests for access, rectification, erasure, objection, restriction and portability.
Legal basis
Legal obligation
Why this basis
Obligation under Articles 12 to 22 of the GDPR.
Data subjects
Anyone exercising a right.
Data
Identity, contact details, subject of the request, answer given.
Recipients
The founder.
Retention
Proof of identity deleted as soon as it is checked; record of the request and answer kept five years.
Security
Dedicated single-user mailbox, two-factor authentication.
Your rights
Access
Rectification

Planned processing

These activities do not exist yet. They are written before they are built, so that their legal basis and retention are set in advance.

PlannedNo personal data
Map of organisations
Purpose
Map the organisations of a territory and an industry from licensed open data, with the source, date and level of evidence of every item.
Legal basis
No personal data
Why this basis
No personal data by design: sole proprietorships, directors, names, emails and phone numbers of individuals are excluded at ingestion.
Data subjects
None.
Data
Establishment identifiers, activity, location, derived capabilities, membership of a public community.
Recipients
Public, as open data.
Retention
As long as the source publishes it; a closed establishment stays in history without being displayed.
Security
Ingestion refused for any source without a verified and recorded licence.
Planned
Requests to correct an entry
Purpose
Allow an organisation to report inaccurate information on its entry and have it corrected.
Legal basis
Legitimate interest
Why this basis
Legitimate interest in keeping information accurate; the request is sent voluntarily.
Data subjects
Representatives of organisations writing to the dedicated address.
Data
Name, email address, organisation, content of the request.
Recipients
The founder.
Retention
One year after the request is handled.
Security
Dedicated single-user mailbox, two-factor authentication.
Your rights
Access
Rectification
Erasure
Restriction
Objection
Planned
Notices and point of contact
Purpose
Receive and handle notices of illegal content and messages from authorities.
Legal basis
Legal obligation
Why this basis
Obligation under Articles 11, 12 and 16 of the Digital Services Act.
Data subjects
Authors of notices, people concerned by reported content.
Data
Author's name and email, address of the content, reason, decision and its statement of reasons.
Recipients
The founder and, on legal request, the competent authority.
Retention
While the notice is handled, then one year.
Security
Dedicated single-user queue, tamper-evident decision log.
Your rights
Access
Rectification
Restriction
Objection
PlannedImpact assessment written, run again before opening
Individual member profiles
Purpose
Allow a registered person to present their skills and needs, under their control.
Legal basis
Performance of a contract
Why this basis
Performance of the terms accepted at registration. The profile is born from registration, never from a public source.
Data subjects
Registered members.
Data
Name, job title, organisation, declared skills and needs, uploaded evidence.
Recipients
Members, according to the visibility chosen by the person.
Retention
Lifetime of the account; deletion after three years of inactivity, after a warning; export and deletion at any time.
Security
Row-level access policies on every table, encryption at rest, access log.
Your rights
Access
Rectification
Erasure
Restriction
Portability
Objection
PlannedImpact assessment written, run again before opening
Introductions
Purpose
Suggest introductions between actors, each one explained, and share contact details only after both parties agree.
Legal basis
Consent
Why this basis
Double opt-in: each party accepts the introduction before any contact details are shared. The engine suggests, the person decides.
Data subjects
Registered members.
Data
Declared skills and needs, reasons for the suggestion, both parties' answers.
Recipients
Both parties, after their agreement.
Retention
Declined suggestion deleted after six months; confirmed collaboration kept while both accounts exist.
Security
No contact details shared before both agreements, non-purchasable quotas, log of suggestions.
Your rights
Access
Rectification
Erasure
Restriction
Portability
Objection
Withdrawal of consent

Exercising your rights

Write to the address below and state the right you are exercising. The law gives us one month to answer. If the answer does not satisfy you, you can lodge a complaint with the CNIL.

contact@conhama.com Lodge a complaint with the CNIL

Where the data lives

No processing activity transfers personal data outside the European Union.

No cookies, no trackers, no audience measurement script.

Your personal data

This is the record we keep under Article 30 of the GDPR. It is checked on every release: a processing activity without a legal basis or a retention period blocks publication.

Controller

Adama Diallo, for Adama OS (SASU registered with the Paris Trade Registry, SIREN 934 512 872)

To exercise your rights or ask a question

contact@conhama.com

Current processing

Field interviews

Institutional letters of interest

First volunteer testers and contributors

Handling data protection requests

Planned processing

Map of organisations

Requests to correct an entry

Notices and point of contact

Individual member profiles

Introductions

Exercising your rights

Current processing

Field interviews

Institutional letters of interest

First volunteer testers and contributors

Handling data protection requests

Planned processing

Map of organisations

Requests to correct an entry

Notices and point of contact

Individual member profiles

Introductions

Exercising your rights