1. In brief
GTPO collects the data needed for its activities: your email address, first name and surname for the newsletter, your organisation if you choose to provide it, information you send by email or in an application, and technical data associated with use of the website. No data is resold. The technical services used may process data within or outside the European Union, as explained below. No automated decision is made about you. You have extensive rights, which may be exercised at any time by writing to contact@gtpo.eu.
2. Data controller
The Global Trade Policy Observatory (GTPO), whose registered office is located at 4 rue Nicolas Roret, 75013 Paris, France (SIRET 990 702 631 00013, RNA W751279881), is the controller of the personal data collected via the gtpo.eu website.
GTPO has not appointed a Data Protection Officer (DPO) at this stage, as the association does not fall within the cases of mandatory appointment provided for in Article 37 of the GDPR.
For any question relating to the processing of your data, you may write to: contact@gtpo.eu.
3. Data collected
| Processing | Data collected | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Newsletter subscription | Email address, first name, surname; optional organisation | Sending monthly newsletter | Consent (GDPR art. 6.1.a) | Until unsubscription, then purged within 30 days |
| Contact by email | Email address, message and information voluntarily provided | Responding to requests and follow-up | Legitimate interest (GDPR art. 6.1.f) | 3 years from last exchange |
| Unsolicited application or recruitment | Last name, first name, email, CV, cover letter, background | Reviewing applications and building talent pool | Legitimate interest (GDPR art. 6.1.f) | 2 years from last contact, unless objected |
| Technical logging (server logs) | IP address, timestamp, request, return code | Website operation and security, abuse prevention | Legitimate interest (GDPR art. 6.1.f) | Depends on the service; Firebase Hosting retains IP addresses for a few months, according to its documentation |
In the newsletter form, email address, first name and surname are required; organisation is optional. Information sent by email depends on the content of your enquiry.
These data come from information you provide and technical data generated during use of the website, processed by the service providers needed for its operation.
4. Recipients
Your data is accessible to the GTPO teams responsible for the relevant activities (editorial, communication, operations, events), strictly to the extent needed for their tasks.
GTPO uses the following services:
| Provider | Role | Data location | Documentation |
|---|---|---|---|
| Brevo (formerly Sendinblue) | Newsletter delivery, subscription management | European Union, according to Brevo's documentation | Data storage locations |
| Google Ireland Limited (Firebase) | Website hosting, technical operation and administration authentication | Within or outside the European Union, depending on the service | Firebase privacy and security |
Firebase Hosting uses global infrastructure. Firebase Authentication, used here only for administration accounts, processes authentication data in the United States. Data may therefore be processed within or outside the European Union. Google's published provisions on data protection and transfers are set out in the Firebase service terms and, for the relevant services, the Google Cloud Data Processing Addendum.
No data is transmitted to third parties for commercial or advertising purposes.
5. Security
GTPO implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR:
- Encryption of exchanges via HTTPS (TLS) protocol
- Data access restricted to authorised persons under least privilege principles
- Enhanced authentication of administrator accounts
- Regular database backups
- Regular security updates for software components
- Internal data breach notification procedures
In the event of a data breach presenting a risk to your rights and freedoms, GTPO will notify the CNIL (the French data protection authority) within 72 hours and, if the risk is high, will inform you directly, in accordance with Articles 33 and 34 of the GDPR.
6. Your rights
In accordance with Articles 15 to 22 of the GDPR and the loi Informatique et Libertés (French Data Protection Act), you have the following rights over the data concerning you:
- Right of access: obtain confirmation of processing and receive copies
- Right to rectification: correct or complete inaccurate or incomplete data
- Right to erasure: delete data under GDPR-specified conditions
- Right to restriction of processing: temporarily suspend processing
- Right to object: object to processing based on particular circumstances or unconditionally for direct marketing
- Right to portability: receive data in structured, machine-readable format and transmit to another controller
- Right to withdraw consent: revoke consent at any time without affecting prior lawful processing
- Right to set post-mortem directives: per Article 85 of loi Informatique et Libertés, set directives concerning data fate after death with GTPO or certified trusted third parties
7. Right to lodge a complaint with the CNIL
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL):
CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. Telephone: 01 53 73 22 22. Website: https://www.cnil.fr
8. Cookies
The gtpo.eu website does not use advertising cookies or third-party trackers. The site uses no third-party audience-measurement tool. For details of the cookies used and how to configure them, see the Cookie policy.
9. Changes
This policy may be updated to reflect legal, technical or organisational developments. The applicable version is the one published on the site as at the date of consultation.
Last updated: 6 October 2026.