Legal information

Privacy policy

The data CINUP collects, why, how long it keeps it and how to exercise your rights.

Last updated: November 15, 2026

Data controller

Comité interuniversitaire des Nations Unies de Paris (CINUP), reachable at secretariat@cinup.fr

Contact form

Purpose: Answering the messages sent through the contact form and passing them to the team concerned.
Legal basis: CINUP’s legitimate interest in answering the people who write to it (GDPR, article 6(1)(f)).
Data processed: Name, email address, subject and message. To limit abusive sending, a non-reversible fingerprint of your IP address, never the address itself.
Required or not: Every field is required: without them we cannot answer you.
Recipients: The CINUP team concerned by the subject (secretariat, Diplomatie pôle, PIMUN delegate services or Relations publiques).
Retention: The message: 6 months after receipt, then deleted. The IP address fingerprint: deleted at the end of the hour of sending.
Automated decision: None

Event registrations

When online registration opens

Purpose: Handling applications to CINUP events, the selection of participants and the messages tied to a registration.
Legal basis: Performance of the membership and of the participation terms accepted when registering (GDPR, article 6(1)(b)).
Data processed: First name, last name, email, phone, motivation, association (or external membership, or the CINUP bureau) and confirmation of availability; the answers to the questions the bureau adds to an event, never about sensitive data; for some events, the fields the host requires.
Required or not: The fields marked as required on the form: without them, the application cannot be considered.
Recipients: The CINUP board and the pôle that organizes the event.
Retention: 12 months after the end of the event, then deleted.
Automated decision: None

Register of external members

When online registration opens

Purpose: Knowing who is an external member of CINUP for the academic year, to check access to events open to members.
Legal basis: Performance of the membership (GDPR, article 6(1)(b)).
Data processed: First name, last name, email address, membership date and end of validity, and where the entry came from (HelloAsso, an import or the board).
Required or not: This data comes from your membership on HelloAsso, or from the board if you joined another way.
Recipients: CINUP’s presidency, general secretariat and treasury. Pôle leads only see whether an application matches a membership.
Retention: One year after the membership’s validity ends, then deleted.
Automated decision: None

Participation history

When online registration opens

Purpose: Sharing places fairly between applicants from one event to the next.
Legal basis: CINUP’s legitimate interest in a fair selection (GDPR, article 6(1)(f)). No decision is made automatically.
Data processed: Applications, selections, attendance and withdrawals, computed from the registrations still kept.
Required or not: No additional data is asked for.
Recipients: The board members in charge of the selection, according to their role.
Retention: The same periods as the registrations: the history disappears with them.
Automated decision: None

Identity data for host institutions

When online registration opens

Purpose: Giving the embassy or institution that receives the delegation the list of names it requires for access to its premises.
Legal basis: Your request to take part in the visit; for a foreign diplomatic mission, a transfer needed to carry out that request (GDPR, article 49(1)(b)).
Data processed: Nationality, date of birth, type, number and expiry date of the identity document. These fields are encrypted.
Required or not: Required only for visits whose host demands them: without them, the host refuses entry.
Recipients: The pôle that organizes the visit, then the host institution, for accepted participants only.
Retention: Erased automatically 30 days after the end of the event (90 days at most, depending on the event).
Automated decision: None

Administration accounts

When online registration opens

Purpose: Letting board members sign in to the site’s administration area.
Legal basis: CINUP’s legitimate interest in administering its site (GDPR, article 6(1)(f)).
Data processed: Name, email address, role, password hash (never the password itself), sign-in dates, refused sign-in attempts and the log of actions.
Required or not: The email address is required to receive the sign-in link.
Recipients: The President and the Informatique pôle.
Retention: Deactivated at the handover, deleted 1 year later; audit log kept for 3 years.
Automated decision: None

Rights requests

When online registration opens

Purpose: Answering requests for access to and erasure of data.
Legal basis: Legal obligation (GDPR, article 6(1)(c)).
Data processed: Email address, type of request, dates of the request and of the answer.
Required or not: The email address is needed to verify the request.
Recipients: The President and the secretariat.
Retention: The time needed to handle the request, then 1 year as proof.
Automated decision: None

Server logs

Purpose: Keeping the site secure and running.
Legal basis: CINUP’s legitimate interest in protecting its site (GDPR, article 6(1)(f)).
Data processed: IP address, date, requested page, browser. Errors are recorded without the content of forms.
Required or not: Collected automatically on every visit.
Recipients: The site’s host and the Informatique pôle.
Retention: 30 days.
Automated decision: None

Processors and transfers

CINUP prefers providers that host data in the European Union. The providers and the mechanism of any transfer are listed below.

Service	Role	Region	Transfer mechanism
Railway	Hosts the cinup.fr website and everything it keeps: the application, its Postgres database, its files (photographs, documents, backups) and its scheduled jobs.	European Union: Amsterdam, Netherlands (Railway’s EU West Metal region)	Railway is a US company: the EU-U.S. Data Privacy Framework, or failing that the European Commission’s Standard Contractual Clauses (data processing agreement, section 9.2) Data processing agreement, accepted on November 14, 2026
Google Workspace	The cinup.fr mailboxes, from which the board writes to people: answers to messages, selection results, rights requests. The site itself sends no email.	No guaranteed region: the data may be processed in any country where Google or its subcontractors have facilities (Google Cloud Data Processing Addendum, section 10.1)	Google LLC is a US company certified under the EU-U.S. Data Privacy Framework, or failing that the European Commission’s Standard Contractual Clauses (Google Cloud Data Processing Addendum, appendix 3, section 4.1)
Cloudflare Turnstile	Checks that a form is sent by a person rather than a robot (optional feature).	Cloudflare’s global network: the data may be processed outside the European Union (Cloudflare’s data processing agreement, section 6.1)	Cloudflare, Inc. is a US company certified under the EU-U.S. Data Privacy Framework, or failing that the European Commission’s Standard Contractual Clauses (Cloudflare’s data processing agreement, sections 6.2 and 6.4)

Automated decisions

No decision with legal or similarly significant effects is made solely by automated processing: every selection is made by a member of the board.

Your rights

You can ask for access to your data, its correction, its erasure, a restriction of processing, object to it, ask for its portability, and set instructions for what happens to it after your death. Write to the secretariat; we answer within one month.

Ask for your data or for its erasure

secretariat@cinup.fr

You can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or at cnil.fr.

Backups

Database backups follow a 30-day rotation: erased data disappears from the backups within 30 days.

Cookies and trackers

The site only sets the trackers that are strictly necessary. Cookies and trackers