Legal information
Privacy policy
What we collect, why, for how long, with whom, and how to exercise your rights. One block per processing operation, drawn from our article 30 GDPR register.
AubeActu is a free local newspaper. Its model rests neither on targeted advertising, nor on selling data, nor on profiling readers. The practical consequence is simple: we collect little, and we tell you exactly what.
Data controller
Adnan TOURAK EI (Tourak Digital), 5 rue Michelet, 10000 Troyes, SIREN 890 591 175.
Data controller: Adnan TOURAK EI — to exercise your rights: donnees@aubeactu.fr.
No data protection officer has been appointed: the criteria of article 37 GDPR are not met for a county-wide audience with no large-scale systematic monitoring. An internal contact is named, the address above is monitored, and the need for a formal officer is reviewed every year.
What we do not do
- No Google Analytics, and no measurement tool hosted outside our own servers.
- No sale, rental or commercial sharing of your data.
- No behavioural advertising, no profiling, no automated decision-making.
- No tracking share buttons: our share links are plain links.
- No non-essential tracker is set before your explicit agreement.
Register of processing operations
Each processing operation is described separately below: its purpose, the data involved, its legal basis, its retention period, its recipients and any processors. This list is generated directly from the register kept under article 30 GDPR; it cannot diverge from it.
Reader accounts
- Purpose
- Allowing readers to comment, follow a municipality and receive the alerts they choose.
- Data collected
- e-mail address, pen name, hashed password, municipality followed
- Legal basis
- Performance of a contract
- Data subjects
- Registered readers
- Retention period
- Civil identity kept 5 years after account closure (art. 6, V, A of the LCEN, decree no. 2021-1362); other sign-up data 1 year.
- Recipients
- AubeActu newsroom; Cloudflare, Inc. (Turnstile anti-bot check)
- Processors
- O2Switch, Cloudflare, Inc. (Turnstile: IP address, TLS fingerprint and browser User-Agent, which Cloudflare also processes on its own account to improve its bot detection)
- Transfers outside the European Union
- United States: Cloudflare, Inc. (Turnstile anti-bot check), certified under the EU-U.S. Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023; failing that, standard contractual clauses.
Entry reviewed on 22 September 2026
Comments
- Purpose
- Publishing readers' contributions under articles and being able to answer a judicial requisition.
- Data collected
- pen name, e-mail address, message text, IP address
- Legal basis
- Performance of a contract
- Data subjects
- Readers who comment
- Retention period
- Text kept while the article is published; IP address anonymised after 30 days in the comments table and kept 1 year in a separate log under article 6, V, A of the LCEN.
- Recipients
- Public for the text, newsroom for the rest
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 18 September 2026
Connection logs and identification data
- Purpose
- Answering a judicial requisition, under article 6, V, A of the LCEN and decree no. 2021-1362.
- Data collected
- IP address, source port, user agent, timestamp
- Legal basis
- Legal obligation
- Data subjects
- Visitors and contributors
- Retention period
- 1 year from the connection, automatically purged. No other use is made of it.
- Recipients
- Publication director, judicial authority on requisition
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 18 September 2026
Newsletter
- Purpose
- Sending the daily or weekly selection to people who asked for it.
- Data collected
- e-mail address, chosen municipality, opening history
- Legal basis
- Consent
- Data subjects
- Newsletter subscribers
- Retention period
- Until unsubscription, then 3 years on a suppression list to avoid re-subscribing by mistake. Unconfirmed addresses purged after 7 days.
- Recipients
- AubeActu newsroom; Cloudflare, Inc. (Turnstile anti-bot check)
- Processors
- O2Switch, Cloudflare, Inc. (Turnstile: IP address, TLS fingerprint and browser User-Agent, which Cloudflare also processes on its own account to improve its bot detection)
- Transfers outside the European Union
- United States: Cloudflare, Inc. (Turnstile anti-bot check), certified under the EU-U.S. Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023; failing that, standard contractual clauses.
Entry reviewed on 22 September 2026
Contact form and news tips
- Purpose
- Receiving and handling messages, story tips and correspondent applications.
- Data collected
- name, e-mail address, telephone, message, municipality
- Legal basis
- Legitimate interest
- Data subjects
- People writing to the newsroom
- Retention period
- 12 months after the last exchange, then deletion.
- Recipients
- AubeActu newsroom; Cloudflare, Inc. (Turnstile anti-bot check)
- Processors
- O2Switch, Cloudflare, Inc. (Turnstile: IP address, TLS fingerprint and browser User-Agent, which Cloudflare also processes on its own account to improve its bot detection)
- Transfers outside the European Union
- United States: Cloudflare, Inc. (Turnstile anti-bot check), certified under the EU-U.S. Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023; failing that, standard contractual clauses.
Entry reviewed on 22 September 2026
Secure tip box
- Purpose
- Receiving sensitive information while minimising anything that could identify the source.
- Data collected
- message only
- Legal basis
- Legitimate interest
- Data subjects
- Sources
- Retention period
- 3 months, with immediate manual deletion possible. No IP address, no user agent and no session identifier is recorded. Network-level anonymity cannot be guaranteed and the page says so.
- Recipients
- Publication director or head of the newsroom, never a volunteer
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 4 September 2026
Contributors and correspondents
- Purpose
- Managing editorial collaboration, bylines, charter acceptances and expense reimbursement.
- Data collected
- full identity, identity document seen but not stored, bank details where expenses are paid
- Legal basis
- Performance of a contract
- Data subjects
- Volunteer contributors and freelances
- Retention period
- Identity 5 years after the collaboration ends; charter acceptances and licences 6 years after the last publication; accounting records 10 years.
- Recipients
- Publication management, accountant for accounting records; Cloudflare, Inc. (Turnstile anti-bot check)
- Processors
- O2Switch, Cloudflare, Inc. (Turnstile: IP address, TLS fingerprint and browser User-Agent, which Cloudflare also processes on its own account to improve its bot detection)
- Transfers outside the European Union
- United States: Cloudflare, Inc. (Turnstile anti-bot check), certified under the EU-U.S. Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023; failing that, standard contractual clauses.
Entry reviewed on 22 September 2026
Death notice submission
- Purpose
- Verifying the family's agreement before publication and keeping proof of that agreement.
- Data collected
- submitter name, relationship to the deceased, telephone, e-mail address, proof of agreement
- Legal basis
- Performance of a contract
- Data subjects
- Families and funeral directors
- Retention period
- 3 years, the retention period for proof of the family agreement.
- Recipients
- AubeActu newsroom
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 4 September 2026
Event and listing submission
- Purpose
- Publishing the events and flea market calendar, and being able to contact the organiser again.
- Data collected
- organiser, contact details
- Legal basis
- Legitimate interest
- Data subjects
- Organisers, associations, municipalities
- Retention period
- 24 months after the date of the event.
- Recipients
- AubeActu newsroom; Cloudflare, Inc. (Turnstile anti-bot check)
- Processors
- O2Switch, Cloudflare, Inc. (Turnstile: IP address, TLS fingerprint and browser User-Agent, which Cloudflare also processes on its own account to improve its bot detection)
- Transfers outside the European Union
- United States: Cloudflare, Inc. (Turnstile anti-bot check), certified under the EU-U.S. Data Privacy Framework, adequacy decision (EU) 2023/1795 of 10 July 2023; failing that, standard contractual clauses.
Entry reviewed on 22 September 2026
Right of reply and removal requests
- Purpose
- Examining requests, meeting the statutory deadlines and being able to prove they were met.
- Data collected
- identity, supporting document, correspondence, reasoned decision
- Legal basis
- Legal obligation
- Data subjects
- People named or identified in content
- Retention period
- 5 years after the file is closed. The identity document is encrypted, stored outside the web root and destroyed at the same term.
- Recipients
- Publication director
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 4 September 2026
Content reports
- Purpose
- Handling notices of unlawful content under article 16 of Regulation (EU) 2022/2065, and evidencing prompt removal.
- Data collected
- reporter identity, e-mail address, legal grounds, IP address
- Legal basis
- Legal obligation
- Data subjects
- People reporting content
- Retention period
- 5 years after the decision, the period needed to evidence how it was handled.
- Recipients
- Publication management
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 4 September 2026
Audience measurement
- Purpose
- Counting pages read, day by day, to guide editorial coverage, with no profiling and no cross-referencing. The counting is done by the newspaper's own server: no cookie, no measurement script, no analytics provider (the only processor is the website host), no IP address kept, not even truncated. The IP address only feeds a daily fingerprint, salted with a seed drawn at random each day and destroyed by the purge once it is more than two days old: nobody, us included, can link two days together. These are the conditions of the CNIL consent exemption (deliberation no. 2020-091).
- Data collected
- date and time of the visit, domain (aubeactu.fr or aubeactu.com), page address, item concerned, response code, referring site domain, device category, daily fingerprint
- Legal basis
- Legitimate interest
- Data subjects
- Visitors
- Retention period
- Page-level detail 180 days, daily totals 25 months. The fingerprint seed is destroyed after two days; no IP address is kept.
- Recipients
- AubeActu newsroom, no third party
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 18 September 2026
Proof of consent for external content
- Purpose
- Keeping proof of the visitor's choice, as required by article 82 of the French law of 6 January 1978.
- Data collected
- consent identifier, choice, policy version, irreversible fingerprint of the IP address
- Legal basis
- Legal obligation
- Data subjects
- Visitors
- Retention period
- 6 rolling months after the last choice, automatically purged. The IP address is never kept in clear.
- Recipients
- None
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 4 September 2026
Directory of associations — recherche-entreprises.api.gouv.fr
- Purpose
- Publishing the directory of associations based in the municipalities of the Aube (name, public RNA, SIREN and SIRET identifiers, declared activity, municipality, premises address) from the French business search API (Insee Sirene database and national register of associations).
- Data collected
- registered address of an association at a private home: only the street is published, without name, house number or flat number, coordinates reduced to the centre of the municipality for an association registered at a private home, name of a person when it appears in the declared name of the association
- Legal basis
- Legitimate interest
- Data subjects
- Private individuals at whose home an association is registered; persons named in an association name
- Retention period
- As long as the association is listed in the register, updated weekly; an entry removed on request is never put back online. Backups holding the original addresses are kept off the website and destroyed on request.
- Recipients
- AubeActu readers (publication); AubeActu newsroom
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 22 September 2026
Participatory ledger — points, levels and badges
- Purpose
- Keeping track of what the newsroom has kept from a reader's submissions (published information, diary date, photo or video used), deriving a level and factual badges from it, capping what can be earned in a single day, and letting the management decide the fate of points attached to content that is no longer online.
- Data collected
- point total, level, date the level was reached, line by line: reason, number of points, content and municipality concerned, date, member of the newsroom who took the decision, written reason for a points withdrawal, readable by the person, badges earned and the date they were earned, municipality declared by the person
- Legal basis
- Legitimate interest
- Data subjects
- Registered readers whose submission has been kept by the newsroom
- Retention period
- Lifetime of the account. Deleting the account from 'My data' erases the points, the level, the badges and the profile: the module's three tables follow the account on cascade. No line is ever deleted while the account exists: a points withdrawal adds a negative line naming the one it cancels, so the person can read why their total went down.
- Recipients
- AubeActu newsroom and publication management; the person themselves, in their account
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 23 September 2026
Public participation profile and monthly ranking
- Purpose
- Showing, on /contributeurs and at the person's own request, a participation profile: the name they chose to display, their municipality, their level and their place in the monthly ranking for that municipality.
- Data collected
- chosen pseudonym, or first name and initial of the surname at the person's choice, declared municipality, level, number of points and number of contributions for the month, date on which the person opened their profile, kept as proof of consent
- Legal basis
- Consent
- Data subjects
- Registered readers who opened their profile themselves
- Retention period
- As long as the person leaves their profile open. Closing it with one checkbox erases the consent date and removes the profile from every ranking, immediately, on the website as in the app. Deleting the account erases the profile.
- Recipients
- Public (/contributeurs page); newsroom
- Processors
- O2Switch
- Transfers outside the European Union
- No transfer outside the European Union.
Entry reviewed on 23 September 2026
Your rights
You have the right to access, rectify, erase, restrict, object to and port the data concerning you. Write to donnees@aubeactu.fr: we answer within one month, extendable once by two months where the request is complex, with reasoned notice within the first month.
Where the request concerns the content of an article, the adjustment provided by article 85 GDPR for journalistic processing may apply: the procedure is then the one described on the Removal request page.
You may at any time lodge a complaint with the French data protection authority, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Last updated on 22 September 2026 · Version 2 · Legal references last reviewed on 18 September 2026 · Machine-readable version (JSON)