Privacy policy

Who is responsible for your data

The controller of the personal data described in this policy is MLJ, SASU, publisher of TroopBooth, registered in Paris under SIREN 934 769 837. The publication director, Jimenez Julien, is the person who reads and answers privacy requests. You can reach him at jimenezjulien42@gmail.com. This policy covers the marketing website at troopbooth.com. Data you enter inside the TroopBooth application as a customer is covered by the data processing terms in your subscription agreement, described in the terms of service.

What the contact form collects

The only place this website asks you for personal information is the request form on the home page. When you submit it, the following named fields are transmitted: name (your full name), email (your work email address), company (your troop or service unit name), role (your volunteer role, chosen from a list), size (the number of members or troops you manage, chosen from a list), request (whether you want a demo, early access or a quote), message (your free text answer) and consent (the record that you ticked the consent box).

Three hidden fields travel with the form for routing purposes: form-name, subject and recipient. A honeypot field named bot-field is present to catch automated submissions and is never completed by a human visitor. No other data is gathered from you on this site. We do not ask for a phone number, a home address, a payment card, or any information about a child.

Why we process it, and on what legal basis

Submissions are used for one purpose: to answer your question and, where you asked for one, to arrange a walkthrough or send a quote. Under the EU General Data Protection Regulation the legal basis is your consent, which you give by ticking the consent box, and our legitimate interest in responding to a business enquiry addressed to us. We do not use form submissions for profiling, we do not enrich them with data bought from third parties, and we do not add you to a marketing list. If you later ask to receive product news, that is a separate, explicit opt in you can withdraw at any time.

How long submissions are kept

An enquiry that does not become a customer relationship is deleted twenty four months after the last message exchanged with you, and sooner if you ask. If you become a customer, the enquiry is retained for the life of the subscription and for three years afterwards, which is the period during which a commercial dispute may reasonably arise. Records that must be kept for accounting reasons, such as invoices, are held for ten years as French law requires. Deletion means removal from the live systems and from routine backups within thirty days.

Who processes the data with us

Form submissions are received, processed and stored by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, United States, which hosts this website and operates its forms service. A copy of each submission is emailed to the address published in the legal notice and is then held in that mailbox. These are the only two processors involved in handling website enquiries. Neither is authorized to use your data for its own purposes, and no submission is ever sold, rented or shared with an advertising network.

Cookies and measurement

This site sets no advertising cookies, runs no third party analytics script, and embeds no social media tracking pixel. There is no consent banner because there is nothing to consent to. Netlify keeps standard server logs, including truncated IP addresses, for security and abuse prevention, and those logs are retained for a short operational period. Web fonts are requested from Google Fonts, which means your browser makes a request to that service when the page loads; no cookie is set by that request.

International transfers

MLJ, SASU is established in France and Netlify is established in the United States, so data submitted through this form is transferred to and stored in the United States. Those transfers are covered by the European Commission's standard contractual clauses included in Netlify's data processing agreement, together with the supplementary security measures described in that agreement. If you would prefer not to use the form, you can send the same information by email or ask for a call instead.

Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable machine readable format, and to withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with a supervisory authority, in France the Commission Nationale de l'Informatique et des Libertes.

If you are a resident of California, Colorado, Connecticut, Utah or Virginia, your state privacy law gives you the right to confirm whether we process your personal information, to access it, to obtain a copy of it, to correct inaccuracies, to delete it, and to opt out of sale or of targeted advertising. We do not sell personal information and we do not use it for targeted advertising or for profiling that produces legal effects, so there is nothing to opt out of, but you may still submit the request and receive written confirmation. California residents may also designate an authorized agent to act for them, and you will never be treated differently for exercising any of these rights.

How to exercise your rights

Write to jimenezjulien42@gmail.com with the email address you used on the form and say plainly what you want done. Requests are acknowledged within five business days and completed within thirty days, which can be extended once by a further thirty days for a complex request, in which case we will tell you why. We may ask one clarifying question to confirm that the request comes from you, but we will not demand identity documents for a routine deletion.

Children's privacy

This website is aimed at adult volunteers and staff who run fundraising programs. It is not directed at children and we do not knowingly collect personal information from anyone under sixteen through this site. Inside the product, troops record first names and initials for young members at the discretion of the adult leader who administers the account; last names are never required, and a leader can delete a member record permanently at any time. If you believe a child's information has reached us through this website, write to the address above and it will be removed immediately.

Security

The site is served over HTTPS with strict transport security, a content type sniffing block, a same origin frame policy and a permissions policy that denies camera, microphone and geolocation access. Access to the mailbox that receives form submissions is protected by multi factor authentication and limited to the publication director. If a breach ever affects your data and creates a risk to your rights, you and the competent authority will be notified without undue delay.

Changes to this policy

If this policy changes, the revised version is published on this page with a new update date, and material changes affecting people who have already written to us are announced by email. The date at the top of this page always reflects the version currently in force.