Privacy policy

Data controller

The processing described on this page is carried out by Condorcet.Vote, whose registered office is at 47 rue Vivienne, 75002 Paris, France. Any request about your data can be sent to contact@condorcet.vote.

Who decides what: organizer and platform

For your account, billing, the contact form and the optional survey, Condorcet.Vote is the data controller. For an election’s electoral roll (the voters’ names and e-mail addresses), the organizer decides what is collected and why: they are the controller, and Condorcet.Vote acts as a processor, on their behalf and on their instructions. The processing agreement required by article 28 GDPR governs that relationship; it is published and binding.

Data collected

We collect nothing that does not directly serve running an election, an account or an order. No analytics, no advertising cookie, no third-party tracker.

Organizer account

Name, e-mail address, password (stored hashed), two-factor authentication (encrypted secret and recovery codes), passkeys (of which only the public part is kept), time zone and notification preference.

Elections

Title, description, candidates, options and schedule, as entered by the organizer.

Electoral roll

Each voter’s e-mail address, their name if the organizer provides one, their voting weight, their vote link (kept as a digest, never in clear) and their voting public key.

Participation

Whether a voter has voted (the attendance record) and the cryptographic ring assigned to them. This data deliberately carries no timestamp at all, so that no chronology of the votes can be reconstructed.

Ballots

The content of the ballot and its cryptographic signature, with no link whatsoever to the voter’s identity (see below).

E-mail delivery log

Recipient, message type, status and any error, needed to prove a message was sent and to diagnose a delivery failure.

Optional survey

When creating an account or an election, an optional question about your use case: the motivations you tick, a free-text comment, and your e-mail if you ask to be contacted back. Answering nothing stores nothing.

Contact form

Name, e-mail address and message, delivered to our inbox. These messages are not stored in a database.

Billing

Credit orders: quantity, price, payment method and settlement status.

Technical logs

Our server logs, needed for security and incident diagnosis. No analytics tool is installed on the site.

Purposes and legal bases

Every processing operation answers a precise purpose and an identified legal basis.

Providing the service

Creating and administering an election, distributing vote links, collecting ballots, computing and publishing the result. Legal basis: performance of the contract, or of the one entered into by the organizer on whose behalf we act.

Guaranteeing a sound election

Attendance record, one vote per voter, publication of the verifiable register. Legal basis: performance of the contract and our legitimate interest in producing a result that stands up to challenge.

Security

Preventing unauthorized access, abuse and fraud; keeping technical logs. Legal basis: our legitimate interest.

Billing and accounting

Issuing invoices and keeping accounting records. Legal basis: a legal obligation.

Understanding how the service is used

The optional motivation survey, and a follow-up exchange if you ask to be contacted. Legal basis: your consent, given by answering.

Anonymity and non-anonymous voting

Ballot anonymity is the default setting: no link between a ballot and a voter’s identity is published or stored, and the public register lets no one restore it. One caveat: in a signing group where almost nobody else voted, the organizer or the platform, who know the voters’ identities, could infer that link. A non-anonymous voting option, off by default and chosen by the organizer at the draft stage, instead publishes the voter’s identity in clear, linked to their ballot. This option is reserved for votes that are attributable by nature (co-ownership, general meetings). It requires a legal basis (consent, bylaws, legitimate interest) and explicit information to the voter before the vote: gathering both is the organizer’s responsibility.

The public register and what it implies

An election’s public register is published as hash-chained, signed blocks: it is immutable by construction. It holds the signed ballots, the attendance record and the voters’ technical identifiers, which are pseudonyms. The correspondence between an identifier and an identity is never published there, unless the organizer enabled nominative participation or non-anonymous voting. One consequence to know before running an election: what the register has published cannot be erased without destroying the integrity proof of the whole vote. An erasure request therefore covers the personal data we hold outside the register.

Retention periods

The periods or criteria below apply to each category of data. The Official offer carries a retention commitment; the Free offer does not: free elections are kept on a best-effort basis and may be purged at our discretion.

Public register

Kept without time limit: it is the very purpose of the service, it holds no identity in clear, and its integrity forbids any deletion.

Electoral roll (names, e-mails)

Kept for as long as the election, and the period during which its result can be challenged, require. The organizer can ask us to delete it at any time.

Organizer account

Kept until you ask for its deletion. Deletion erases the account’s personal data (name, e-mail, password, two-factor authentication, passkeys); elections that are already public stay published, with no identity attached.

E-mail delivery log

The recipient’s address is erased automatically six months after the election ends or the group closes. The technical line itself is kept.

Billing

Ten years, as accounting obligations require.

Optional survey

Kept to analyse how the service is used; you may ask for its deletion.

Hosting and sub-processors

We rely on the strict minimum of providers, and no third-party service loads in your voters’ browsers.

OVH (France)

Hosting of the entire service: servers, database and public register, in France.

Resend

Delivery of transactional e-mails (vote links, confirmations, notifications). Recipient addresses pass through this service, whose infrastructure may sit outside the European Union; that transfer is covered by the European Commission’s standard contractual clauses.

Security

Encrypted transport (TLS), hashed passwords, secrets encrypted at rest, two-factor authentication and passkeys available on accounts, a cryptographic signature on every register block, hosting in France. The voting protocol and its guarantees are described in detail on the Security page.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability over your data. Write to contact@condorcet.vote: we answer within one month. If your request concerns an election’s electoral roll, contact the organizer first, who is its controller. If it reaches us directly, we pass it on to them.

Cookies

No analytics cookie, no advertising cookie, no third-party tracker: that is why the site shows no consent banner. The three cookies below are strictly functional.

Session

Needed to sign in and to protect forms. Expires at the end of the browsing session.

Language

Remembers the language you picked. The server needs it to serve the site in your language.

Theme

Remembers your light or dark choice, for one year. It is set on the parent domain so that your choice follows you onto the voting pages.

Lodging a complaint

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr).