Okpal Privacy Policy

Essential information on the processing of your personal data by Okpal

Ulule SAS develops and operates the Okpal crowdfunding platform. It puts fundraisers in contact with people wishing to support projects by making a financial contribution ("contributors"). Within the framework of these activities, we process personal data concerning you, whether you are a visitor to the website Okpal.com or a user (registered member, contributor or fundraiser).

  • The data processing manager is Ulule, a simplified joint-stock company with an authorised capital of €253,061, registered under number 794 710 830 in the Paris trade and companies register, having its head office at 10 rue de Penthièvre, 75008, Paris, France.
  • We collect and process your data in order to: manage our contractual and pre-contractual relations with users and future users, manage user accounts, enable the hosting and administration of fundraising events, commercial management and user relations, provide our services, including the user support service, promote our services and products and propose new services and products to you, carry out training and events linked with our services and products, manage the Okpal.com websites, host and manage comments, compile commercial performance statistics, analyse and follow the audiences of our sites and facilitate their browsing as well as those of our dedicated pages on the social media (Facebook, Instagram, LinkedIn, Twitter and YouTube), combat fraud, money laundering and the financing of terrorism, manage any outstanding payments, pre-litigation and litigation cases, manage the exercise of your rights, and manage any reports and notifications linked with content published on our websites or forum.
  • Certain data concerning you may be combined. This may consist of data you communicate when using our Okpal.com website and data gathered through cookies on the Internet (we invite you to read our Politique de Cookies). Data combined in this way are then used for some of the above-mentioned purposes.
  • Some data is processed to make decisions as to the acceptance/refusal of a fundraising campaign. In connection with their legal obligation to combat fraud, money laundering and financing of terrorism, Okpal and its payment service providers (MANGOPAY and STRIPE) process data, including data combinations, to help their staff establish fraud risk levels concerning payments and fundraising events. This processing may be used to justify a decision taken by Okpal or MANGOPAY or STRIPE to refuse a fundraising event, but no decision is made without human intervention.
  • It can happen that you communicate so-called sensitive data on our sites: when you publish a fundraising campaign, fill in your user profile, participate in a fundraising campaign, or publish a comment, you can publicly reveal highly personal information (religious or philosophical convictions, sexual preference, political opinions, state of health, etc.). We thus recommend extreme caution when you describe your fundraising campaign or user profile, post comments or participate in a fundraising campaign, in order to protect your privacy. It is possible to make "private" or "anonymous" contributions. In this case, only the Okpal team and the fundraiser will have access to information concerning you (see our online aid concerning this point).
  • As a fundraiser, in particular, you may communicate information concerning third parties (people participating in the fundraising project, a person your fundraising campaign is designed to help, etc.). The processing of these data must comply with regulations. You should check that you have the right to communicate these data to Okpal and to the public (for example, by obtaining the written agreement of these third parties) and communicate information to these parties on Okpal's processing of the data as indicated in this Privacy Policy.
  • It is obligatory to collect certain data. We need certain information to provide you with our services. Whenever we collect data through forms, the obligatory or optional nature of your answers is made clear in each form. The consequences of not providing an answer for an obligatory response depend on the situation. It will mainly mean that you cannot create an account, submit or contribute to a fundraising campaign, or benefit from some of our services (the requirement to provide information is contractual or regulatory in this case if the information required is connected with our legal obligations as a crowdfunding platform), and that we cannot meet requests from you concerning the exercise of your rights (the requirement to provide information in this case is regulatory).
  • The parties who may receive data from Okpal are mainly our subcontractors, fundraisers, Okpal partners, if your fundraising campaign is participating in a partner operation, and the judicial and administrative authorities.
  • You have rights. These consist of the right to access, correct, delete and restrict processing, the right to object to the processing of your data, the right to define, modify and revoke instructions governing what happens to your data after your death, and the right to lodge a complaint with the CNIL (French data protection authority). Subject to providing proof of your identity and complying with the conditions imposed by current legislation, you can exercise these rights by writing to us at the following email address: onto this postal address: ULULE SAS, 10 rue de Penthièvre, 75008, Paris, France.
  • The periods for which we store your data vary according to the nature of the data concerned, the purposes for which they were collected and the legal limitation period (generally five years from the time when persons wishing to exercise a right have had or should have had knowledge of the facts enabling them to exercise the right), except in the case of pre-litigation or litigation.
  • Your data may be transferred outside the European Union.. We will transfer certain data to our subcontractors, partners or service providers, such as our hosters, email dispatch management tools, etc. If they are transferred outside the European Union, we make every effort to ensure that they are transferred to countries where the personal data protection level has been recognised as adequate by the European Commission, or that the European Commission's standard contractual clauses apply to our service providers or partners.
  • We have appointed a data protection officer, who can be contacted at or at the following postal address: Ulule SAS, Data Protection Officer, 10 rue de Penthièvre, 75008, Paris, France.

For further information, we invite you to read the Privacy Policy below.

This Privacy Policy (the "Privacy Policy") defines the conditions in which Ulule, the processing manager of data from the Okpal.com website, collects and processes personal data concerning you as visitors or users of the Okpal platform, accessible at the address Okpal.com.

Ulule is a simplified joint-stock company with an authorised capital of €253,061, registered under number 794 710 830 in the Paris trade and companies register, having its head office at 10 rue de Penthièvre, 75008, Paris, France.

In a concern to respect your private life and protect data concerning you, we comply with current legislation in terms of personal data protection, particularly French Data Protection Act no. 78-17 of 6 January 1978 (hereinafter the "French Data Protection Act") and European regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, known as the General Data Protection Regulation or GDPR (hereinafter the "GDPR").

We may update this Privacy Policy. You will be informed of any significant updates in advance, and if necessary, we will obtain your consent.

1. Which data do we collect and process?

As processing manager, we collect and process personal data concerning you.

In this respect, we collect data from you as a user of our Okpal platform to identify and contact you (full name, email address, postal address, telephone number), validate the posting online of your fundraising campaigns and organise the collection of contributions (information on your profile, information on your fundraising campaigns, bank information, etc.).

We also collect data concerning your use of our services, as well as data when you browse our websites and our dedicated pages on the social media. To this end, we collect the data needed to compile audience statistics, performance measurements and commercial prospecting.

We collect data on your exchanges with us concerning our services and the requests you send us, including the management of your rights and your instructions in the event of death.

Lastly, we collect data enabling us to meet our obligations in terms of combatting fraud, money laundering and the financing of terrorism, and managing your rights and pre-litigation and litigation cases. In this respect, we notably collect documents proving your identity.

All these data can be communicated by you when you complete our forms or during our exchanges. They can also be collected through computer tools such as cookies. For more information on our use of these tools, we recommend that you read the cookies policy available here: Cookies Policy.

All the data concerning you that we collect can be combined for the purposes below.

IMPORTANT – SENSITIVE DATA

Sensitive data and user profile: The following fields are optional and designed so that you can personalise your public user profile on Okpal: public name, description and your website address. Via these fields, you can publicly reveal information about you that is sometimes sensitive or highly personal (religious or philosophical convictions, sexual preference, political opinions, state of health, etc.). Once the form is validated this information becomes public and available to everyone. We thus recommend caution in describing your user profile, to protect your privacy.

Sensitive data and fundraising campaign pages/publication of news about your fundraising campaign: When you describe a fundraising campaign or publish news on your fundraising campaign page, you can reveal information about you that is sometimes sensitive or highly personal (religious or philosophical convictions, sexual preference, political opinions, state of health, etc.). If your fundraising campaign is posted online or your news is published, this sensitive information becomes public and available to everyone. Okpal thus recommends caution in describing your fundraising campaign and drafting your news, to protect your privacy..

Sensitive data and contributions to a fundraising campaign: If you wish your contribution to be public, your username (which can reveal your identity if it includes your full name) can be seen in the list of contributors to a fundraising campaign. This can thus sometimes reveal sensitive or highly personal information (religious or philosophical convictions, sexual preference, political opinions, state of health, etc.). For example, by contributing publicly to a fundraising campaign with a political dimension, you indirectly reveal your political opinions. If you do not wish your donation to be public, select the "private "or "anonymous" option.

Sensitive data and comments on fundraising campaigns: When you write a comment on a fundraising campaign or a news item published on a fundraising campaign, you can reveal information about yourself that is sometimes sensitive or highly personal (religious or philosophical convictions, sexual preference, political opinions, state of health, etc.). Once the comment form is validated, this sensitive information becomes public and available to everyone. Okpal thus recommends caution when writing your comments, to protect your privacy.

IMPORTANT – THIRD-PARTY DATA

When you write a fundraising campaign presentation or a news item, you can communicate to us and publicly communicate information concerning third parties (people participating in the fundraising campaign project, a person your fundraising campaign is designed to aid, etc.).

These data must be processed in compliance with the regulations.

You should check that you have the right to communicate this data to Okpal and the public (for example, by obtaining written consent from these third parties) and provide them with information on how Okpal processes their data, as indicated in this Privacy Policy.

2. What are the purposes and legal bases for our data processing?

In application of the regulations, in order to be legitimate, the processing of personal data must be founded on one of the legal bases indicated in article 6 of the GDPR, or article 9.2 of the GDPR if sensitive data are involved.

The table below describes the different purposes involved when we process your data and the legal bases underlying them.

Particular purpose Legal basis
Managing visitors to the Okpal.com site Pre-contractual measures
Legitimate interests of visitors and users as regards posting items on the Okpal.com website in good conditions
Managing users registered on the Okpal.com site Execution of contracts concluded with users (managing creations, modifying or closing user accounts, monitoring relations with and assistance to users)
Managing the user support of the Okpal.com site Okpal's legitimate interests (improving services and offers, monitoring relations with and assistance to users)
Managing fundraising campaigns on the Okpal.com site Execution of contracts concluded with fundraisers
Okpal's legitimate interests (managing fundraising campaigns) and compliance with the legal obligations incumbent upon it (reporting projects)
With sensitive data communicated by fundraisers or contributors, processing is justified because these data have been manifestly made public by the persons concerned (article 9.2 e) of the GDPR)
Managing contributions and fund transfers relating to Okpal fundraising campaigns Execution of contracts concluded with contributors and fundraisers
Okpal's legitimate interests (managing fundraising campaigns) and compliance with the legal obligations incumbent upon it (reporting contributions)
With sensitive data communicated by contributors or revealed by the simple fact of contributing to a fundraising campaign, processing is justified because these data have been manifestly made public by the persons concerned (article 9.2 e) of the GDPR)
Combatting fraud, money-laundering and the financing of terrorism Compliance with legal obligations arising from the operation of the Okpal.com website
Organising our marketing operations (audience statistics, performance measurements, commercial prospecting, training, etc.) Okpal's legitimate interests (compiling performance statistics, measuring website audiences, administrating Okpal pages on Facebook, Twitter, Instagram, LinkedIn and YouTube, sending newsletters, developing clientele)
Newsletters are not sent to users who are not contributors or fundraisers.
Managing claims and prelitigation and litigation cases Okpal's legitimate interests or legal obligations, depending on the case
Storage of data linked with creations of accounts, connections to the Okpal platform, content creation and payments made, in view of any legal requisitions Compliance with Okpal's legal obligations
Managing your rights, as indicated in point 5. Compliance with Okpal's legal obligations

The collection of payments made directly on the Okpal site is managed by our payment service providers (MANGOPAY and STRIPE), accredited by the ACPR (authority for prudential control and resolution). MANGOPAY and STRIPE process personal data, an operation for which they are responsible, described in the MANGOPAY Privacy Policy and Stripe Privacy Policy.

As regards their legal obligations in terms of combatting fraud, money laundering and the financing of terrorism, Okpal and MANGOPAY carry out processing, including on combined data, to help their staff determine the level of fraud associated with a payment or fundraising campaign. The data processed in this way may be used to justify the decision of Okpal, MANGOPAY or STRIPE to refuse a payment.

3. Are the collection and processing of your data obligatory?

When you browse on our website Okpal.com, access to certain functions requires the creation of an account and thus the communication of certain data. In creating an account, you become a Okpal platform user, which means that you can subsequently become a fundraiser or contributor.

To create an account on the Okpal.com website, you are required to provide your electronic address and a password. Otherwise you cannot register, unless you log on using your Facebook account by means of the Facebook Connect function. In this case, the login data of your Facebook account will be transmitted to us.

As a visitor to the Okpal.com website, you can view certain sections but you cannot create a fundraising campaign or contribute to existing fundraising operations.

To create a fundraising campaign on the Okpal.com website, in addition to data that must be provided when you create your account, you must provide your full name, the name and description of your fundraising campaign, your country of residence, your physical address, your bank information, and any proof of identity required to identify you as an individual or a legal entity.

To make a contribution on the Okpal.com website, in addition to data that must be provided when you create your account, you must provide your bank card payment information and in certain cases any proof of identity required to identify you as an individual or a legal entity.

If you fail to communicate this information, you will be unable to publish your fundraising campaign or contribute to fundraising campaigns featured on the Okpal.com website.

These requirements to provide data have a contractual and/or regulatory character (particularly as regards proof of identity).

To exercise your rights, as indicated in point 5 of this Privacy Policy, you will need to communicate proof of your identity. Failure to do so may prevent us from meeting your request.

This requirement to provide data is regulatory.

The collection of other data may be obligatory. All data collection that is obligatory, the contractual or regulatory nature of this obligation to provide them and the consequences of failure to provide the data concerned are then made known to you directly when the data are collected.

4. To whom are we likely to transmit your data?

We may communicate data:

  • To our subcontractors (hosters, email dispatch tools, site security tools, form managers, audience measurement tools, document sharing tools are tools for tracing browsing on our sites, customer service and assistance tools, tools for targeting advertisements on the social media and the Internet). Our subcontractors are bound by an obligation to confidentiality and security and to other obligations listed in the GDPR. We choose our subcontractors very carefully, and remain in any event responsible for the processing of your personal data by our subcontractors;
  • To the fundraiser when you contribute to an Okpal fundraising operation non-anonymously, to enable it to communicate with you, provide information or send you a tax receipt if your donation is eligible. The minimum data consist of your email, the amount paid, the currency and the date of payment. We will also supply them with your full name and address if you have communicated these;
  • To our partners if you have indicated your willingness to participate in a specific partner operation. For example, as a fundraiser, if you are applying for a prize or a partner offer directly managed by Okpal, we must communicate your contact details to the partner so that it can send you the promised prize if you win, or provide you with the promised offer if you are eligible;
  • To our online payment service providers (MANGOPAY or STRIPE) to ensure that the funds have actually been raised, enable the opening of a payment account or an electronic purse, enable the management of contributions to a fundraising campaign, and enable them to carry out their own diligence procedures and obligations in terms of combatting fraud, money-laundering and the financing of terrorism;
  • To public bodies and authorities, court officers, financial control entities (auditors and accountants), entities involved in combatting fraud, money laundering and the financing of terrorism; this is done exclusively to meet our legal obligations.

Subject to the above, we undertake never to disclose your data to any third parties except with your express consent or in extremely specific circumstances, including:

  • If we are required to disclose your data in the context of a judicial procedure, dispute and/or a request from the public authorities;
  • If we consider that disclosure is necessary or appropriate for national security, in application of the law or for other reasons of national interest.

5. What are your rights?

According to the conditions defined in articles 15 and thereafter of the GDPR, apart from exceptions, you have:

  • The right to obtain confirmation that personal data concerning you have or have not been processed, and if they have been, access to these personal data and information on our processing ( right of access – article 15 of the GDPR);
  • The right to obtain the correction of inaccurate personal data concerning you ( right of correction – article 16 of the GDPR);
  • The right to obtain the deletion of personal data concerning you in certain cases ( right of deletion or "right to be forgotten"– article 17 of the GDPR);
  • The right to obtain the limitation of processing in certain cases ( right to the limitation of processing – article 18 of the GDPR);
  • The right to obtain, at any time, for reasons to do with your particular situation, that we will no longer process personal data concerning you in certain cases ( right of objection – article 21.1 of the GDPR);
  • The right to oppose at any time the processing of personal data concerning you for prospecting purposes ( right to oppose prospecting – article 21.2 of the GDPR);
  • The right to lodge a complaint with the competent data protection authority in your Member State or with the CNIL (the French data protection authority);
  • The right to define, modify and revoke at any time instructions relating to the storage, deletion and communication of your personal data after your death, pursuant to article 40-1 of the Data Protection Act. These instructions may be general or specific. We can only be the depositories of these particular instructions concerning the data we process; general instructions can be collected and stored by trusted third parties in the digital sphere certified by the CNIL.

You also have the right to appoint a third party to whom data concerning you can be communicated after your death. You then undertake to inform this party of your approach and the fact that data enabling them to be unambiguously identified are transmitted to us, and to communicate this Privacy Policy to them.

Subject to proving your identity and the above-mentioned information, you can exercise your rights by writing to us, at either or the following postal address: Ulule SAS, 10 rue de Penthièvre, 75008, Paris, France.

If you have an account on the Okpal.com website, you can correct and delete certain information via your user account.

In addition, you can contact us at the above-mentioned electronic or postal addresses for any question concerning the Privacy Policy or the processing of your data.

6. How long do we store your data?

Data concerned Period stored (apart from exceptions*)
Data concerning the management of visitors and users who have not proposed or contributed to any projects on Okpal.com If you are an active user (who logs onto their account): for the period of your account, then for 3 months after requesting the closure of your account (apart from data required for commercial prospecting, which are stored for 3 years)
If you are an inactive user: at the end of a 3-year period without you logging onto your account, we will ask you if you wish to keep the account.
If you wish to close it, your data will be deleted 3 months after your request.
If you do not reply, your data will be deleted 3 months after our request.
Data concerning the management of projects and fundraising campaigns on Okpal.com If you are an active fundraiser (who logs onto their account): for the period of your account, then for 5 years after requesting the closure of your account (in line with the legal limitation period)
If you are an inactive fundraiser: at the end of a 5-year period without you logging onto your account, we will ask you if you wish to keep the account.
If you wish to close it, your data will be deleted 3 months after your request.
If you do not reply, your data will be deleted 3 months after our request.
Data relating to the management of contributions and fund transfers on Okpal.com If you are an active contributor: for the period of your account, then for 5 years after requesting the closure of your account (in line with the legal limitation period)
If you are an inactive contributor: at the end of a 5-year period without you logging onto your account, we will ask you if you wish to keep the account.
If you wish to close it, your data will be deleted 3 months after your request.
If you do not reply, your data will be deleted 3 months after our request.
Bank data Deletion once the transaction is complete, unless we have obtained your consent to store the data, and for 15 months for the purposes of proving the transaction in the event of a dispute
Report of contents 1 year from the date on which the content reported was created
Comments or description of fundraising campaigns Deleted on the closure of the account, or made anonymous at the request of the user concerned
Performance statistics No specific timeframe when our statistics are compiled using anonymous data
Cookies and traces 13 months after the first deposit on your computer terminal
Data relating to our obligations to combat fraud, money laundering and the financing of terrorism 5 years after the contractual relationship has ended or your account has been closed, as concerns identity data and documents.
5 years from the execution of the financial operation in question, as concerns documents and information relating to the operations carried out.
Data relating to the management of pre-litigation and litigation In the event of pre-litigation, deletion as from the amicable settlement of the dispute or from the time limitation of the legal action
In the event of litigation, deletion when appeals are no longer possible against the decision made to have it enforced
Data relating to your instructions concerning what happens to your data after your death As long as the data concerned by the instructions are stored
Data relating to the exercise of your rights (point 5) 5 years from the date on which you exercise a right
Copy of proof of identity communicated in order to exercise your rights 1 year from the date it is received by Okpal

At the end of the above timeframes, your data will either be deleted or made anonymous.

*As an exception to the previous paragraphs, in the event of litigation, all or some of your data may be stored for a longer period if they prove necessary for this litigation.

7. Will we transfer your data outside the European Economic Area?

With regard to the services we offer, and the purposes mentioned in point 2, we use several subcontractors or service providers, to which we need to transfer all or part of the data we collect and process. The servers of some of our subcontractors are located outside the European Union, and your data will thus be transferred outside the European Economic Area.

If your data are transferred outside the European Economic Area, Okpal will take every necessary precaution. It will ensure, in particular, that your data are transferred to countries whose level of personal data protection has been acknowledged as adequate by the European Commission; if not, that the standard contractual clauses of this Commission apply.

If you send a request to our Data Protection Officer ( ), we can provide you with more information about such transfers (particularly as regards the European Commission's standard contractual clauses).

8. Who is your contact person at Okpal to answer your questions on personal data?

We have appointed a data protection officer, who is your contact for all questions regarding the processing of your data by Okpal. This officer can be contacted at or the following postal address: Ulule SAS, 10 rue de Penthièvre, 75008, Paris, France.