Personal Data Protection and Privacy Policy
September 2026 edition
Preamble
The purpose of this privacy policy is to inform visitors to the website www.twiice.org, TWIICE members, prospects and partners (hereinafter the “Website User”) about the use of their personal data (hereinafter “Personal Data”) and their rights.
TWIICE may amend this policy at any time, in particular to comply with legal, regulatory or technical developments. If it is amended, the update date at the beginning of this document will be revised.
Article 1 – Parties and definitions
This policy applies between the publisher of the Website, namely TWIICE (hereinafter “TWIICE”), and the Website User.
- Website: the website accessible at www.twiice.org, together with its subdomains.
- Website User: any person connecting to the Website. « MyTwiice Portal » : a separate member area, accessible at www.mytwiice.org, subject to a dedicated privacy policy.
Article 2 – Personal Data
2.1 Identity of the data controller
The controller of the Personal Data is TWIICE, a simplified joint-stock company (SAS) with variable capital and a minimum share capital of €105,000, whose registered office is located at 11 rue Tronchet, 75008 Paris, France, registered in the Paris Trade and Companies Register under number 904 147 410.
2.2 Contact details of the Data Protection Officer (DPO)
TWIICE’s DPO can be contacted at the following address: dpo@twiice.org.
2.3 Processing carried out on the Website
| Collection point | Data collected | Legal basis | Purpose |
|---|---|---|---|
| Website browsing | Browsing data (pages viewed, duration), audience measurement identifier, IP address (through analytics and functional cookies) | TWIICE’s legitimate interests (cookies exempt from consent) and the Website User’s consent (non-exempt audience measurement cookies), see Article 3 | Ensuring the operation, security and improvement of the Website; measuring visitor traffic |
| Contact form (Salesforce integration) | Surname, first name, email address, telephone number, company, job title, submitted message | TWIICE’s legitimate interests: responding to the Website User’s request | Handling and responding to the contact request; following up on relationships with members, prospects and partners |
| Newsletter subscription form (Brevo) | Surname, first name, email address, company, job title, and data on opens and clicks in the emails sent (tracking pixel embedded in communications) | Website User’s consent | Sending the newsletter and information about the EPR scheme for professional packaging; measuring email campaign performance (open rate, click rate) |
Emails sent as part of the newsletter through the Brevo solution contain a tracking pixel (a measurement technology treated in the same way as cookies), enabling TWIICE to measure the open and click rates of its communications. The Website User may object to this tracking at any time through the dedicated link in each email, without affecting their newsletter subscription.
2.4 Retention period
| Collection point | Retention period |
|---|---|
| Browsing / audience measurement cookies | Audience measurement data is retained for 14 months from collection. Audience measurement cookies have a maximum lifespan of 13 months from placement, in accordance with CNIL recommendations. |
| Contact form (Salesforce integration) | 3 years from the last contact initiated by the Website User, unless there is an ongoing contractual relationship (membership through MyTwiice, governed by the dedicated policy) |
| Newsletter subscription form (Brevo) | Until the Website User unsubscribes |
At the end of these periods, TWIICE permanently deletes the Personal Data, unless a legal obligation requires longer retention (accounting, litigation).
2.5 Personal Data security
Personal Data is stored securely in line with the state of the art, in compliance with the GDPR and national legislation.
2.6 Personal Data minimisation
TWIICE only collects the Personal Data strictly necessary for the stated purposes and asks the Website User not to submit unnecessary data, particularly through the contact form or by email.
Article 3 – Cookies
A cookie is a small file placed by a server on a user’s device (computer, mobile phone, etc.) and associated with a web domain. Some cookies are strictly necessary for the Website to function and are exempt from consent; others, particularly non-exempt audience measurement cookies and third-party cookies, require the Website User’s prior consent (source: CNIL).
TWIICE manages the collection of cookie consent through the tarteaucitron.js banner, which allows the Website User to accept, refuse or customise their consent by purpose, and to withdraw it at any time.
3.1 Cookies used on the Website
| Cookie name | Provider | Purpose | Retention period | Subject to consent |
|---|---|---|---|---|
| Twiice-tarteaucitron | TWIICE (via Tarte au Citron.js) | Stores the Website User’s consent choices | 12 months | No (strictly necessary to record proof of consent) |
| _ga / _ga_0743K0CKX2 | Google LLC (Google Analytics 4) | Website audience measurement | 13 months maximum | Yes |
| wp-wpml_current_language | WPML | Remembers the language selected by the Website User | Session / 1 year | No (functionality requested by the Website User) |
| Wp_lang | WordPress | Remembers the interface language displayed to the Website User | Session | No (functionality requested by the Website User) |
Google Analytics 4 audience measurement cookies are only placed after the Website User’s prior consent has been obtained through tarteaucitron.js. If consent is refused, no audience measurement cookie is placed.
3.2 Cookie settings
The Website User may change their choices at any time through the tarteaucitron.js banner accessible at the bottom of the Website’s pages, or configure their browser to refuse cookies. Refusing non-essential cookies does not affect access to the Website’s main features.
Article 4 – Data recipients
The Personal Data collected is accessible to TWIICE staff authorised by virtue of their duties (Website management, member relations, communications), as well as to the DPO.
It may also be disclosed to the following processors, to the extent necessary to provide their services:
- Salesforce (processing of the contact form and management of member and prospect relations), hosted in the European Union
- Brevo / Sendinblue (newsletter distribution), a French company
- Google Ireland Limited (Google Analytics service, audience measurement), see Article 6 on data transfers outside the European Union
- OVH (technical hosting of the Website), a French company
- TROA (agency responsible for Website management and maintenance), a French company
Article 5 – Data subjects’ rights
Under the GDPR, the Website User has the following rights, which may be exercised by emailing dpo@twiice.org:
- right of access to the Personal Data held by TWIICE;
- right to rectification in the event of an error or omission;
- right to erasure in the cases provided for by the GDPR;
- right to object to processing, in particular processing based on legitimate interests;
- right to restriction of processing in certain cases;
- right to portability of the data provided;
- right to withdraw consent at any time for processing based on consent;
- right to lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.
TWIICE undertakes to respond within one month of receiving the request. This period may be extended by two months for a complex request.
Article 6 – Data transfers outside the European Union
When certain IT services and tools are used, some Personal Data may be transferred to recipients located outside the European Union or the European Economic Area.
Where such transfers occur, TWIICE ensures that they comply with Regulation (EU) 2016/679 (GDPR), in particular on the basis of a European Commission adequacy decision or, failing that, the appropriate safeguards provided for in Article 46 et seq. of the GDPR.
Further information on the safeguards implemented may be obtained by submitting a request to TWIICE.
Article 7 – Intellectual property
The Website’s content (texts, images, structures, databases) is protected by copyright and database rights. Any unauthorised reproduction or communication to the public constitutes an infringement that may give rise to legal proceedings.
Article 8 – Final provisions
TWIICE may amend this policy at any time. The invalidity of one clause does not affect the validity of the others. This policy was drafted in French. In the event of any discrepancy between language versions, the French version prevails.
Article 9 – Applicable law and disputes
This policy is governed by French law and the applicable European regulations, in particular the GDPR. In the event of a dispute that is not resolved amicably, the Website User may seek mediation or bring the matter before the competent courts.
Article 10 – Image rights
Recording of images and sound at events
When you are identified or identifiable, TWIICE processes your personal data, such as your image, as data controller on the basis of your consent, for communication purposes on its website and social media (such as LinkedIn, X (formerly Twitter) and YouTube). You may withdraw your consent at any time by sending a request to dpo@twiice.org. Withdrawal does not affect the lawfulness of processing carried out before it.
Once published, Personal Data will be accessible to third parties, subject to the data policy of the platform concerned, where applicable. Your personal data is retained for up to 3 years and may then be archived for the applicable statutory limitation periods.