Privacy policy

Last updated: 1 November 2026. The German version (Datenschutzerklärung) prevails.

Controller

BleuBlancRose e.V., Baruther Str. 11, 10961 Berlin, Germany, e-mail: contact at bleublancrose.com. Represented by its president Gaël Boudjema. For any question about your data, write to this address.

Visiting the public pages

When you visit the site, our host (o2switch, France, within the EU) processes technical server logs (IP address, time, page requested) to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). A data processing agreement is in place with the host.

The public pages set no cookies, so no cookie banner is needed.

Audience measurement

This site does not measure its audience: no analytics tool, no tracking cookies.

Members area

The members area is for members, board and administrators only. Sign-in is passwordless: you enter your e-mail address and receive a single-use six-digit code, valid for ten minutes. We process:

your e-mail address, your role(s) (member, board, admin) and, if you gave them to us, your first and last name, phone number and paying-member status;
the date you were added and last signed in, and the network of your last sign-in in shortened form (the full IP address is not stored);
sign-in codes only in hashed form and briefly; logs with masked e-mail addresses to detect abuse;
the documents made available for your role.

To run the association, administrators also keep on our server (not with a third party) the list of newsletter subscribers taken from Brevo (address, name, language, sign-up date) and the year-by-year membership fee history of members and former members, with the contact details they gave us. Each member sees their own fee history in the members area.

After signing in, a strictly necessary session cookie (bbr_m, 14 days, sign-in state only) is set. Codes are sent through our provider Brevo (see below). Legal basis: the membership relationship (Art. 6(1)(b) GDPR) and our legitimate interest in security (f). Only administrators can access member data. We delete it when membership ends, unless a legal retention duty applies.

We send the newsletter only with your consent, using double opt-in (Art. 6(1)(a) GDPR). We log your e-mail address, optionally your name, and the time and IP address of sign-up and confirmation as proof. Sending is handled by Brevo (formerly Sendinblue), Brevo SAS, Paris, France, under a data processing agreement. The newsletter contains measurement points (opens, clicks). You can unsubscribe at any time via the link at the end of each issue; opting out of measurement alone is not possible. Unsubscribed addresses may be kept for up to three years to prove past consent.

Contact, membership and photos

If you write to us or join, we process your details to answer you and to manage membership (Art. 6(1)(b) and (f) GDPR). Accounting data is kept for the legal periods (up to ten years). Photos may be taken at our events; if you are recognisable in a published photo and do not want that, write to us and we will remove it.

External links and social media

We have profiles on social networks; their terms and privacy policies apply when you visit them. Our site loads no third-party fonts, maps or videos. The one exception: on the Newsletter page the sign-up form from Brevo (sibforms.com) is embedded, so Brevo receives your IP address. By following a link you leave our site.

Your rights

You have the rights of access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21 GDPR), and you may withdraw consent at any time for the future. Write to the address above. You may also lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.