1. Data Controller
Access Center for Human Rights (ACHR), a French non-profit association governed by the law of 1 July 1901, registered under RNA n° W931023779, with its registered office at 7 Rue Puteaux, 75017 Paris, France, represented by its President. For any question relating to personal data, please contact: info@achrights.org.
2. No Cookies or Trackers
The website does not deposit any cookies, does not use any audience measurement tool, and does not embed any third-party content likely to collect browsing data. No consent banner is therefore required.
3. Data Processed and Purposes
| Data | Identity and role, professional contact details, content of correspondence and any documents or testimonies voluntarily submitted (including, where relevant, information relating to human rights violations). |
| Purposes | Responding to inquiries received; documenting and analysing human rights situations; providing advocacy, legal referral or support assistance; managing relationships with partners, members, volunteers and donors; sending the periodic newsletter to subscribers who requested it; complying with legal and accounting obligations; and ensuring the security and confidentiality of the organisation’s work, including the protection of victims, witnesses and human rights defenders. |
No data is used for commercial prospecting and the organisation does not conduct any commercial canvassing. The newsletter is sent only to persons who have subscribed and may be unsubscribed from at any time via a link in each email or by writing to info@achrights.org OR newsletter@achrights.org
4. Legal Bases
• Legitimate interest (Art. 6(1)(f) GDPR): responding to inquiries, documentation and analysis of human rights situations, and protection of the organisation’s work and its sources.
• Consent (Art. 6(1)(a), and Art. 9(2)(a) where special category data is concerned): collection of personal testimonies and accounts, in particular where they reveal sensitive information (e.g. health, ethnic origin, political opinions, sexual orientation, or data relating to alleged offences).
• Consent (Art. 6(1)(a)): sending the newsletter to subscribers, withdrawable at any time.
• Legal obligation (Art. 6(1)(c)): accounting and tax record-keeping.
• Substantial public interest (Art. 9(2)(g)), where applicable, for human rights monitoring and reporting to competent national or international bodies.
5. Recipients and Processors
Data is neither sold nor transferred to third parties for commercial purposes. It is accessible to the President and, where relevant, to the following providers acting as processors under an agreement compliant with Article 28 GDPR:
| Website hosting | Infomaniak Network SA — Switzerland |
| Google Workspace | |
| Storage | Microsoft (Microsoft 365 / OneDrive) |
| Accounting software | QuickBooks |
| Chartered accountant | CABINET COGEX — France |
| Legal counsel | Soprogex & 2k |
Independent experts occasionally engaged by the organisation are subject to confidentiality and security obligations at least equivalent to those above, and only access what is strictly necessary for their assignment.
6. Transfers Outside the European Union
Transfers to Switzerland (Infomaniak) take place under the adequacy decision adopted by the European Commission in respect of Switzerland. Transfers to the United States (Google, Microsoft) are governed by the Standard Contractual Clauses adopted by the European Commission and, where applicable, by supplementary safeguards implemented by the provider.
7. Retention Periods
| Unanswered inquiries | 3 years from the last contact. |
| Case and advocacy files | 10 years after the end of the matter or relationship, subject to any longer retention required by law. |
| Testimonies and documentation of human rights violations | Retained for as long as necessary for advocacy, accountability and historical record purposes, under enhanced security and, where possible, pseudonymisation to protect victims and witnesses. |
| Newsletter subscribers | Until unsubscription, or after 3 years of inactivity. |
| Accounting and tax records | 10 years, in accordance with legal obligations. |
| Unsuccessful applications | 3 years after the last contact with the candidate, unless earlier deletion is requested. |
8. Your Rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability and to withdraw consent where processing is based on it. These rights may be exercised by email at info@achrights.org or by post to the registered office; a response will be provided within one month. Certain rights may be limited where retention is required by law or necessary to establish evidence, in particular to protect the safety of victims, witnesses or third parties. You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75334 Paris Cedex 07 — www.cnil.fr.
9. Security
The website is served exclusively over HTTPS. Data is stored on encrypted systems, protected by two-factor authentication and access restricted to what is strictly necessary. The organisation applies an internal information classification and handling policy, uses pseudonymisation where appropriate to protect the identity of victims, witnesses and human rights defenders, and handles any data breach in accordance with its legal obligations.
Last updated: 15 August 2026