This policy describes what data the site processes, why, for how long, and how to exercise your rights. It mentions only processing that is actually in place.
1. Data controller
- Controller
- Cabinet EAU-GEF
- Address
- Cité de l'émergence ADDOHA, Immeuble 4, Apt 6, 2e étage, Dakar, Senegal
- contact@eaugef.com
- Phone
- +221 78 493 00 00
The firm has not appointed a data protection officer. Requests concerning your data are handled directly by the firm, at the address above.
2. Data collected
The site has no user account, no client area and no authentication. No data is collected from you without your knowledge: you only provide information by deliberately filling in a form.
- Contact form: first name, surname, email address, phone and organisation if you provide them, project type, and the message you write.
- Newsletter sign-up: email address only.
- Technical data: a fingerprint of your IP address, the browsing language, and the delivery status of the notification.
Your IP address is never stored in clear text. Only a salted fingerprint is kept: it allows submissions from the same visitor to be counted in order to limit abuse, but does not allow the original address to be recovered.
3. Purposes and legal bases
- Responding to your enquiry — based on your own initiative and the firm’s legitimate interest in following up.
- Sending you the newsletter — based on your consent, which you may withdraw at any time.
- Protecting forms against automated submissions — legitimate interest in preserving the service and the inbox.
- Measuring site traffic — based on your consent; no tool is enabled without your agreement.
4. Recipients and processors
Your data is never sold, rented or shared for advertising purposes. It is accessible to the firm and to the technical providers strictly necessary for the site to operate:
- Vercel Inc. (United States)
- site hosting and page delivery.
- Supabase Inc. (database in Europe, eu-west-1)
- storage of contact requests and sign-ups.
- Resend (United States)
- delivery of the email notification to the firm.
- Cloudflare (United States)
- protection of forms against automated submissions (Turnstile).
- Sanity AS (Norway)
- editorial content management. No visitor data passes through it.
- Google Ireland Ltd.
- audience measurement, only if you have consented.
As some of these providers are established outside Senegal and the European Union, your data may be processed in the United States. These transfers rely on the contractual safeguards offered by each provider.
5. Retention periods
- Contact requests
- three years from the last exchange.
- Newsletter sign-ups
- until you unsubscribe.
- IP address fingerprint
- kept with the request, for the same period.
- Privacy choices
- kept in your browser until changed or cleared.
7. Security
- Exchanges with the site are encrypted (HTTPS).
- Stored requests are accessible to no one from the browser: the database refuses any direct read.
- Forms are protected by several cumulative controls, including a limit on the number of submissions.
- No personal data is written to technical logs.
8. Your rights
You have the right to access, rectify, erase and object to the data concerning you, as well as the right to restrict processing and to data portability.
To exercise them, write to contact@eaugef.com stating your request. You will receive a reply within a reasonable time. If the request concerns data submitted through a form, please state the email address used so that we can locate it.
You may also lodge a complaint with Senegal’s Commission de protection des données personnelles (CDP).
9. Changes to this policy
This policy may change if new processing is introduced. The date of the last update appears at the top of the page. When a change affects processing subject to your consent, you will be asked again.