Privacy notice
Privacy notice
How we handle your personal data when you visit this site or apply to join.
Draft, pending legal review. This notice is not yet in force. Text in shaded brackets is still to be confirmed.
Version: draft 0.1, dated 24 October 2026.
1. Who is responsible for your data
The data controller is [Association details to be confirmed: name, registered office, registration number], which runs Monacano (“we”, “us”).
Until the association has been formed, the controller is Francis Hellyer, a resident of Monaco, acting as interim data controller.
For any question about your data, or to exercise your rights, write to [email protected].
This notice is written to meet Monaco Law no. 1.565 of 3 December 2024 on the protection of personal data. Where the EU General Data Protection Regulation (GDPR) also applies to you, for example because you live in the European Union, we apply it as well.
2. What we collect
When you apply: your name; your email address; the part of Monaco where you live, or that you plan to move here; your invitation code, the name of the member who suggested you apply, or how you heard of us; and the short note you write about why you would like to join. We also record the date of your application, that you ticked the privacy box, and the version of this notice you saw.
During review: the status of your application, notes written by the club's admins, and, if you meet a host, a record that your residency document was seen, by whom and on what date. We never take a copy, a photograph or the number of any identity document.
For security: to stop abuse of the form, we keep a one-way scrambled (hashed) form of your IP address for up to one hour. The security check on the form is provided by Cloudflare Turnstile, which processes technical information about your browser and device to tell people from automated programs.
We do not ask for your date of birth, nationality, photograph, income, employer, phone number, payment details or identity documents. Please do not include health, religious, political or financial details in your note.
3. Why we use it, and on what legal basis
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Considering your application and replying to you | Steps taken at your request before a possible membership agreement. Your consent to this use, given on the form, which you may withdraw at any time. | If you are not accepted or you withdraw: deleted 12 months after the decision. If you are placed on a waiting list: 24 months, after which we ask whether you want us to keep it. [Retention periods to be confirmed] |
| Checking an invitation or asking a member to confirm they know you | Our legitimate interest in admitting people who are known to the club. The member is told why they are being contacted. | With the application |
| Recording that residency was seen in person | Our legitimate interest in keeping the club for residents, done in the least intrusive way. | With the application, or for the membership |
| Protecting the form against abuse | Our legitimate interest in keeping the service secure. | Hashed IP address: up to one hour. Hosting provider logs: [to be confirmed] |
If you become a member, a separate section of this notice will explain how membership data is used. [Membership section to be drafted before membership opens]
4. Who receives your data
Your application is read only by the interim controller, Francis Hellyer, and later by the club's named admins. Each new application is sent to him by email so that it can be answered. We do not sell or rent personal data, and we do not use advertising or tracking cookies.
We use these service providers, who process data on our behalf under contract:
- Cloudflare, Inc. (United States): website hosting, the database that stores applications, the Turnstile security check and the email that notifies us of new applications. We ask Cloudflare to store the application database in its European Union jurisdiction.
- The email account that receives application notifications, operated by the interim controller's email provider.
5. Transfers outside Monaco and the EU
Cloudflare is a United States company, so some data may be accessed from or transferred to the United States. We rely on Cloudflare's data processing terms and the transfer safeguards they contain. [Transfer mechanism under Law no. 1.565 and the GDPR to be confirmed by legal review]
6. Your rights
You have the right to ask for access to your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time without affecting what was done before. You also have the right not to be subject to a decision based solely on automated processing. Membership decisions are always made by people.
To use any of these rights, contact us at the address in section 1. We will reply within one month.
You can complain to the Autorité de Protection des Données Personnelles (APDP) in Monaco, at apdp.mc. If you live in the European Union, you can also complain to the data protection authority where you live.
7. Do you have to give us this data?
No. But we cannot consider an application without the details on the form.
8. Cookies
The public pages of this site do not set cookies and do not use analytics or advertising trackers. The Turnstile security check on the application form is loaded from Cloudflare. [Turnstile storage behaviour to be confirmed in legal review]
9. Security and breaches
Applications are stored in a database that only the club's admins can reach, through a separate login. If a personal data breach occurs, we will notify the APDP within 72 hours of becoming aware of it, and tell you where the law requires.
10. Changes to this notice
We will publish any change on this page with a new version number and date.