Legal notice and privacy policy
Last updated: 4 July 2026
1. Website publisher
- Institut du Numérique Responsable (INR)
- Non-profit association governed by the French law of 1 July 1901
- RNA no.: W173009044 — SIREN no.: 848 096 111
- Registered office: Université de La Rochelle, 23 avenue Albert Einstein, BP 33060, 17031 La Rochelle, France
- Email: contact@institutnr.org
- Publication director: Vincent Courboulay
2. Host
The website is hosted by OVH SAS — 2 rue Kellermann, 59100 Roubaix, France. Phone: 1007. Website: ovhcloud.com
3. Intellectual property
All the content of this website (texts, images, logos, trademarks, structure, code) is protected by copyright in accordance with Article L.122-4 of the French Intellectual Property Code and applicable European directives. Any reproduction, representation, modification or adaptation, in whole or in part, without the prior written authorisation of the publisher is prohibited.
The INR nevertheless authorises the reuse and translation of its content for information and debate purposes, provided that its meaning is not distorted and that the INR is expressly cited as the source.
4. Limitation of liability
The INR provides users with information and tools related to responsible digital technology. The INR accepts no liability for errors, omissions, or results obtained from the use of this information or of the hyperlinks present on the website.
To report an error or omission, write to contact@institutnr.org.
5. Protection of personal data (GDPR)
The INR undertakes to ensure that the processing of personal data carried out on this website complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter “GDPR”), with French Act No. 78-17 of 6 January 1978 as amended on information technology, data files and civil liberties, as well as with the applicable national regulations of the member states concerned (Belgium, Switzerland, Germany).
5.1 Data controller
The controller of the data collected via this website is the Institut du Numérique Responsable (INR), whose contact details appear in Article 1 of this legal notice.
5.2 Data Protection Officer (DPO)
For any question regarding the processing of your data or to exercise your rights:
- By email: dpo@institutnr.org
5.3 Processing purposes and legal bases (Article 6 GDPR)
| Purpose | Legal basis (GDPR) | Categories of data |
|---|---|---|
| Signing of the Responsible Digital / Responsible AI Charter | Performance of pre-contractual and contractual commitments (Art. 6.1.b) | Surname, first name, position, email, phone, organisation, logo |
| Newsletter subscription | Explicit consent (Art. 6.1.a) | Email, name, organisation |
| Institutional communication, running the network of signatories | Legitimate interest of the INR (Art. 6.1.f) | Professional contact details, organisation |
| Audience measurement and website improvement | Consent (Art. 6.1.a) | IP address (anonymised), pages visited, user agent |
| Website security (access logs, anti-spam) | Legitimate interest in ensuring security (Art. 6.1.f) | IP address, timestamp, HTTP requests |
5.4 Mandatory or optional nature
Fields marked with an asterisk in the forms are mandatory in order to provide the requested service. Failing this, the INR will not be able to process your request. The other fields are optional.
No processing gives rise to automated decision-making within the meaning of Article 22 of the GDPR, nor to profiling.
5.5 Recipients and processors
Your data is processed by the authorised INR team. It may be transmitted, for the purposes described above only, to the following processors, acting on instructions and under the responsibility of the INR (Art. 28 GDPR):
- OVH SAS (France) — website hosting and data storage
- Yousign SAS (France) — electronic signature service compliant with the eIDAS Regulation (EU No. 910/2014)
- Transactional email provider (EU) — delivery of confirmation messages and of the newsletter
Audience measurement is provided by Matomo, hosted by the INR within the European Union: statistics are not shared with any third party and the IP address is anonymised.
No data is transferred, sold or rented to third parties for commercial purposes.
5.6 International transfers
All the data collected is stored and processed within the European Union. No data is transferred to a third country outside the EU/EEA. Should this change, you would be informed beforehand and an appropriate legal framework (standard contractual clauses of the European Commission or an adequacy decision) would be put in place.
5.7 Data retention period
- Charter signatories: duration of the public commitment + 5 years after withdrawal or the end of the commitment (civil limitation period)
- Newsletter subscribers: until consent is withdrawn (unsubscription). In the absence of interaction, the data is deleted after 3 years
- Technical connection logs: 6 months maximum
- Cookies: see Article 6 below
5.8 Your rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:
- Right of access (Art. 15) — obtain confirmation that data concerning you is being processed and receive a copy of it
- Right to rectification (Art. 16) — have inaccurate or incomplete data corrected
- Right to erasure (Art. 17) — request the deletion of your data under the conditions provided for by the GDPR
- Right to restriction of processing (Art. 18)
- Right to portability (Art. 20) — retrieve your data in a structured, machine-readable format
- Right to object (Art. 21) — object to the processing of your data based on legitimate interest, or to direct marketing
- Right to withdraw your consent at any time where processing is based on it (Art. 7.3)
- Right to give directives regarding the fate of your data after your death (Art. 85 of the French Data Protection Act)
5.9 Exercising your rights
You can exercise your rights by contacting our DPO by email (dpo@institutnr.org). A reply will be provided within one month of receipt of your request (extendable by two months in the event of complexity, in accordance with Art. 12.3 of the GDPR). Proof of identity may be requested in the event of reasonable doubt about your identity.
5.10 Right to lodge a complaint with a supervisory authority
If you consider that the processing of your data does not comply with the GDPR, first send your complaint to our DPO (dpo@institutnr.org). Failing a satisfactory response, you may lodge a complaint with the competent supervisory authority of your place of residence or work:
- France — CNIL: www.cnil.fr
- Belgium — Data Protection Authority (APD/GBA): www.autoriteprotectiondonnees.be
- Germany — Federal Commissioner for Data Protection and Freedom of Information (BfDI): www.bfdi.bund.de
- Switzerland — Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch
5.11 Data security
The INR implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR): TLS/HTTPS encryption, access control, logging, backups, security updates, and awareness-raising among authorised staff.
6. Cookies and trackers
On your first visit, a consent banner lets you accept or refuse, with equal ease, non-essential cookies (audience measurement). No tracker subject to consent is placed before you agree, in accordance with the ePrivacy Directive 2002/58/EC and Article 82 of the French Data Protection Act. Only cookies strictly necessary for the website to function are exempt from consent.
The details of the cookies used (nature, purpose, duration) as well as the means to manage or withdraw your consent at any time are described in our cookie policy.
7. Changes to this legal notice
This legal notice may be amended at any time, in particular to take account of legislative, regulatory or technical developments. Any substantial change will be indicated on the website's home page and, where applicable, communicated to the persons concerned.
8. Applicable law and jurisdiction
This legal notice is governed by European Union law and French law. Any dispute relating to its interpretation or performance shall, failing amicable resolution, fall within the jurisdiction of the courts of La Rochelle (France), subject to the mandatory provisions applicable to consumers.