Privacy policy

This document is the privacy policy of the Association Le Frelon. It describes the personal data collected by the LeFrelon.com platform and by its mobile apps LeFrelon Pro and LeFrelon Pisteur, how it is used, how long it is kept and how to have it deleted.

The terms of use of the service are a separate document: Legal notice and terms of use.

1. Data controller

• Association Le Frelon, a non-profit association under the French law of 1901
• Address: 1005 route de l'ancienne gare, 07190 Saint-Sauveur-de-Montagut, France
• Contact: [email protected]

2. Scope

This policy covers the following three services, which share the same database and the same commitments:

• the LeFrelon.com website and web platform;
• the LeFrelon Pro mobile app, for pest control companies engaged through the platform;
• the LeFrelon Pisteur mobile app, for volunteer trackers who help locate Asian hornet nests in the field.

3. Data collected

3.1. LeFrelon.com platform

When an account is created:

• Surname, first name
• Email address
• Phone (optional)
• Postal address

When reporting:

• Photo(s) (optional)
• Location of the nest or sighting
• Description, type of pest, date
• Information on danger, accessibility, etc. (optional)

The minimum data required for a report is: surname, first name, email address and location. Viewing public pages and creating a report do not require registration.

The platform itself measures the use of its signed-in area, without cookies or third-party services (see section 10). No data is sold or used for advertising.

3.2. LeFrelon Pro mobile app

In addition to the data described in 3.1, the LeFrelon Pro app processes:

• The account identity (surname, first name, email, phone), used to sign in and to pre-fill reports created from the app.
• Photos and videos attached to reports and intervention reports.
• GPS location, only when the user explicitly allows it, to make it easier to create a report and find the way to the nest.
• The technical information needed to send notifications to the user when a report is assigned or a comment is added.
• Anonymised information when the app malfunctions, for the sole purpose of making it more reliable.

3.3. LeFrelon Pisteur mobile app

In addition to the data described in 3.1, the LeFrelon Pisteur app processes:

• The account identity (surname, first name, email, phone), used to sign in and to pre-fill observations and reports created from the app.
• Photos and videos attached to observations, tracking stations and nest reports.
• GPS location, only when the user explicitly allows it, to place tracking stations, record observations in the field and create a report.
• The technical information needed to send notifications to the user, in particular when information is shared within a tracking group.
• Anonymised information when the app malfunctions, for the sole purpose of making it more reliable.

Neither app collects data in the background: location is only read while the app is in use, and only if permission has been granted. It can be revoked at any time in the phone's settings.

4. Purposes and legal bases

• Providing the service (legal basis: legitimate interest and performance of the service requested): receiving and processing reports, putting people in touch with local referents and pest control companies, following up interventions.
• Scientific and statistical monitoring (legitimate interest, task in the public interest): maps, reports, studies on the spread of the Asian hornet.
• Improving the service (legitimate interest): audience measurement and anonymised crash reports.
• Security (legitimate interest): protecting forms against bots, spotting abnormal use of the signed-in area (bots, mass extraction).
• Communication (legitimate interest, consent for messages unrelated to the service): replies to requests and information about the user's reports.
• Monitoring the quality of interventions (legitimate interest): a few days after an intervention, the reporter may be asked whether the company intervened and under what conditions. Answering is optional.

5. Data sharing

Data is never sold, rented or transferred to third parties for commercial or advertising purposes.

It may be shared with:

• the referents and coordinators of the area concerned, and the pest control companies engaged, only to the extent needed to process the report;
• public and voluntary partners involved in the fight against the Asian hornet, in aggregated or anonymised form;
• technical service providers (hosting, sending emails and notifications, protecting forms against bots) bound to the Association by a GDPR-compliant contract, only to the extent needed for the service to work.

In areas where no coordinating body is able to process reports, the company is chosen automatically by the platform, on objective criteria — distance, offers already received, response rate, ratings from previous reporters.

In all cases, disclosure happens in two stages: the company approached first sees only the town and the description of the nest; the exact address and the reporter's contact details are only passed on after it accepts. A company that declines or does not respond never has access to them.

The company that receives these contact details processes them under its own responsibility, solely for the purpose of the intervention. The charter it has signed forbids it from using them for marketing or passing them on to a third party.

The reporter remains free to refuse the company offered. Answers to the satisfaction questionnaire are passed on to the body that coordinates the fight in their area, and are not shared with the company concerned.

Reports are public, but the reporter's contact details never are: an indirect messaging system makes it possible to reply to them by email without revealing their address.

6. Data retention periods

The Association Le Frelon keeps personal data only for as long as needed for the purposes described above, for the following periods:

At the end of these periods, data is deleted or irreversibly anonymised. Anonymised data can no longer identify a person and is therefore no longer personal data.

7. Deleting your account and data

Any user can ask for their account and personal data to be deleted by writing to [email protected] from the email address linked to their account, or by post to the Association's address.

The request is processed within 30 days at most. Deletion means:

• the account and identification data (surname, first name, email, phone, postal address) are deleted;
• photos and videos sent by the user are deleted, on request;
• reports and observations are kept in anonymised form, separated from their author, so as not to distort the scientific monitoring already carried out in the area.

Encrypted database backups are purged by rotation within 90 days at most.

8. Your rights

In accordance with French law no. 78-17 of 6 January 1978 ("Informatique et Libertés") and the General Data Protection Regulation (GDPR) (EU 2016/679), each user has the following rights:

• Right of access: to know what data is held about them.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to object: to object to the processing of their data on legitimate grounds.
• Right to erasure ("right to be forgotten"): to ask for their data to be deleted under the conditions provided by law.
• Right to restriction of processing and right to data portability, in the cases provided for by the GDPR.

These rights can be exercised at [email protected] or by post to: Association Le Frelon – 1005 route de l'ancienne gare, 07190 Saint-Sauveur-de-Montagut, France. Proof of identity may be requested to keep the data secure. The Association replies within 30 days at most.

If a disagreement persists, a complaint can be lodged with the CNIL, the French data protection authority (www.cnil.fr).

9. Security and hosting

Data is hosted on servers located in the European Union. Exchanges between the apps, the website and the servers are encrypted (HTTPS/TLS). Access to personal data is restricted to the roles that need it: members only see reports in their area or those they are associated with, and coordinators access the contact details of reporters in their area.

10. Cookies and audience measurement

LeFrelon.com sets no advertising cookies, uses no third-party audience measurement tool and does not share your browsing with social networks or ad networks. The only trackers used are exempt from consent (article 82 of the French "Informatique et Libertés" law and CNIL guidelines): that is why no banner asks for your consent.

10.1. Trackers needed for the site to work

• Session and form security: a cookie keeps you signed in and protects forms against request forgery. It disappears when you close the browser, unless you choose "Stay signed in".
• Bot check: the sign-in, registration, contact, reporting and QR code request forms are protected by Cloudflare Turnstile, which checks that the submission does not come from a bot. This check is only used to secure these forms and allows no advertising tracking.
• Your display choices: the language you chose, map layers, the last items you opened or the place of your last report are kept in your browser so you do not have to enter them again.
• Testing new versions: to improve its forms, LeFrelon.com sometimes shows two versions of the same page to different visitors (A/B test). The lf_exp cookie remembers which version you were shown; it only contains a random identifier, unrelated to your identity or IP address, is only read by LeFrelon.com and expires after 13 months, like the associated measurements (version seen, step reached, submission). You can opt out of these tests: you will always see the usual version and your visits will not be measured.

10.2. Audience measurement of the signed-in area

To improve the platform and spot abnormal use, LeFrelon.com measures the use of its signed-in area: pages viewed, exports and certain actions. This measurement is carried out by the Association itself, on its own servers, without cookies or third-party services. IP addresses are truncated, the data is neither transferred nor combined with other processing, and it is deleted after 13 months.

You can object at any time from your profile, under "Notifications": "Exclude my account from audience measurement".

10.3. Content from other services

Maps display base layers from IGN (Géoplateforme) and OpenStreetMap, and a report page can display, at your request, weather forecasts from Meteoblue. To provide the requested image, these services receive your IP address, like any website you visit.

11. Minors

The service is not intended for children. Creating an account is reserved for adults or, for a minor, under the responsibility of their legal guardian. No data is knowingly collected from a child under 15.

12. Changes to this policy

This privacy policy may be updated. The date of the last update is shown at the top of the page; in the event of a major change, registered users are informed by email.

13. Contact

For any question about data protection, including about the LeFrelon Pro and LeFrelon Pisteur apps: [email protected].