Who is responsible
One-to-Many, Inc., a US 501(c)(3) nonprofit (EIN 84-3362301), 143 Exchange Blvd, Ste 300 #2155, Hutto, TX 78634, USA. One-to-Many France (association loi 1901, RNA W691103545, 21 rue de la Métallurgie, 69003 Lyon) acts on behalf of One-to-Many for people in France.
For any question or request about your data, use the contact form, choose the subject "Other" and mention "personal data".
What we collect, and why
| When | What | Why | Legal basis |
|---|---|---|---|
| Contact form | Name, email, organization (optional), subject, message | To answer your request | Your consent; our legitimate interest in replying |
| Volunteer form | Last name, first name, email, phone (optional), profession, country, city (optional), LinkedIn (optional), motivations, areas, availability, message | To review your application and contact you about volunteering | Your consent |
| Donations | Processed by Stripe on its own pages; we receive your name, email and amount, never your card number | To issue a receipt and keep our accounts | Performance of your donation; legal obligations |
| Browsing | One cookie, "otm-lang", which remembers your chosen language (1 year, no personal data). A visit count hosted on our own server, without cookies: page viewed, language, referring site, and a daily non-reversible identifier — the IP address is never stored. Visitors with "Do Not Track" or "Global Privacy Control" enabled are not counted. The server keeps technical logs for security. | Remembering your language; measuring audience; security | Strictly necessary cookie; legitimate interest |
We never ask for more than needed. Fields marked optional can be left empty.
Where your data goes
Forms are processed directly on our server and sent by email to our team. We do not sell, rent or share your data with third parties for commercial purposes. Our technical providers are: our host (GoDaddy, USA) for the site and forms, Stripe for donations, and our email service. Each accesses data only to provide its service.
As our headquarters are in the United States, your data is processed there. For people in the European Union or Canada, we apply the safeguards required by applicable law (GDPR, French Data Protection Act, PIPEDA).
How long
- Contact messages: 24 months after our last reply, then deleted.
- Volunteer applications not taken forward: 12 months after receipt, then deleted.
- Active volunteers: for the duration of the engagement, then 24 months.
- Donation records: the legal accounting retention period (7 years in the US, 10 years in France).
- Technical logs: 90 days.
Your rights
You can at any time ask to access your data, correct it, delete it, restrict its processing, receive a copy, or withdraw your consent. We reply within 30 days. If you live in France you may also contact the CNIL (cnil.fr); in Canada, the Office of the Privacy Commissioner (priv.gc.ca).
Security
The site is served over HTTPS. Form data is stored outside the web-accessible area with restricted access. Forms are protected against automated submissions. No system is infallible; if an incident affects your data we will inform you as the law requires.
Minors
Our forms are for adults. We do not knowingly collect personal data online from anyone under 16. Photographs of students published on this site are used with the permission of the schools and families concerned; any removal request will be handled as a priority through the contact form.
Changes
We may update this policy. The date at the top of the page shows the version in force.