Privacy Policy

In accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR)

1. Data Controller

Complyo
23 rue de Richelieu - 75001 Paris
Email: contact@civicwatcheurope.com

2. Data We Collect

Data	Purpose	Legal basis	Retention
Email address	Newsletter subscription, subscription management	Consent / Contract performance	Until unsubscription + 3 years
Payment data	Subscription processing	Contract performance	Processed by Stripe — 5 years (legal obligation)
Server logs	Security, fraud prevention	Legitimate interest	12 months
Subscription status	Access management	Contract performance	Duration of subscription + 3 years

3. Data Sharing

We share your data only with the following trusted processors, strictly for service delivery:

Stripe Inc. — payment processing (USA, Privacy Shield / SCCs). Stripe Privacy Policy
Brevo (Sendinblue SAS) — email delivery, France/EU. Brevo Privacy Policy
OVH SAS — web hosting, France/EU
Anthropic PBC — AI content generation (USA, SCCs). Content generation uses no personal data.

We never sell, rent or share your personal data with third parties for commercial or advertising purposes.

4. Your Rights

Under GDPR, you have the following rights regarding your personal data:

Right of access — obtain a copy of your data
Right of rectification — correct inaccurate data
Right of erasure — request deletion of your data
Right to portability — receive your data in a structured format
Right to object — object to processing based on legitimate interest
Right to withdraw consent — unsubscribe at any time

To exercise your rights, contact us at: contact@civicwatcheurope.com

We will respond within 30 days. You also have the right to lodge a complaint with the CNIL (French data protection authority).

5. Cookies

Civic Watch Europe uses no advertising or tracking cookies. We use only:

Session cookies — necessary for authentication and subscription access
Google Translate — translation widget (third-party service, subject to Google Privacy Policy)

6. Data Security

We implement appropriate technical and organisational measures to protect your data:

HTTPS encryption on all pages
Payment data processed exclusively by Stripe (PCI DSS compliant)
Access to personal data restricted to authorised personnel only
Server hosted in France (OVH)

7. International Transfers

Some data processors (Stripe, Anthropic) are based in the United States. All transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection.

8. Changes to This Policy

We may update this privacy policy from time to time. Any significant changes will be communicated by email to subscribers. The date of the last update is indicated below.

Last updated: October 2026