Privacy Policy
Version effective 7 October 2026.
Key points
- We collect only what is needed for Compost'ON to work.
- Your data is never sold or used for advertising.
- If your access was provided by a local authority or another organisation, that organisation decides how your data is used; we process it on its behalf. In areas where we offer Compost'ON directly, MLK Concept is responsible for it.
- You can view, correct or delete your data, and delete your account from Settings.
1. Purpose
This policy explains how the personal data of users of the Compost'ON app (iOS, Android and web browser) is processed. Separate information about the composton.com website, in particular its contact form and cookies, is provided in the legal notice.
It supplements the terms of use. The terms “Client Organisation” and “Site” have the same meaning here.
2. Who is responsible for your data
Compost'ON is published by MLK Concept, SAS, 114 rue du Maréchal Joffre, 85000 La Roche-sur-Yon, France (“MLK Concept”, “we”, “us”). Roles are allocated as follows:
- Where your access comes under a Client Organisation (local authority, social housing provider, association, company), that organisation determines why and how your data is used: it is the data controller. MLK Concept acts as a processor, on its instructions and under a contract that complies with Article 28 of the GDPR. The name of the organisation is shown in the app.
- MLK Concept is the data controller in Compost'ON Zones, where it offers the Service directly to residents and local stakeholders, for any account opened without a Client Organisation, and for the security of the Service, assistance, moderation, measuring the reliability of the app and handling the requests to exercise rights that are addressed to it.
Whatever the situation, you can write to us: we will deal with your request or forward it without delay to the organisation concerned.
3. The data processed
- Identity and contact details: surname, first name, email address and, if you provide them, telephone number and profile photo.
- Account: password (stored in encrypted form, never in plain text), language, display and notification preferences.
- Affiliation: Sites of which you are a member or manager, role and, for home composting, the household's address, number of people and equipment.
- Composting activity: deposits, weighings, monitoring checks, alerts, participation in events, and photos and documents added.
- Conversations: messages and attachments posted in conversations; for managers, an indication of which messages have been read.
- Location: only if you allow it, to show Sites near you. It is not tracked in the background.
- Technical data: device model and operating system, app version, notification identifier, connection logs, error reports and app usage statistics.
The Service does not need any so-called sensitive data (health, opinions, religion, etc.). Please do not post any in conversations.
4. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, and operating Sites, deposits, monitoring checks, the calendar and conversations | Performance of the Terms; for a public-sector Client Organisation, its public interest task of waste prevention and management |
| Sending service notifications and emails (membership, reminders, messages) | Performance of the Terms |
| Producing composting statistics for the Client Organisation or, in Compost'ON Zones, for MLK Concept and site managers | Public interest task or legitimate interest of the organisation; legitimate interest of MLK Concept in Compost'ON Zones |
| Responding to your requests for assistance | Performance of the Terms |
| Ensuring security, preventing abuse and handling reports | Legitimate interest of MLK Concept and legal obligations of hosting providers |
| Measuring the reliability and use of the app in order to fix and improve it | Legitimate interest of MLK Concept |
| Complying with legal obligations and requests from the authorities | Legal obligation |
Your data is never sold, rented or used for advertising purposes. The Service does not take any automated decision producing legal effects concerning you.
5. Who has access to it
- Other members of your Sites see your name and your messages in the Site's conversations.
- The managers of your Sites and, where applicable, the authorised officers of the Client Organisation see the information needed to run and monitor the Site: contact details, affiliation, deposits and monitoring checks.
- The Compost'ON team, which is bound by confidentiality, only where necessary (assistance, reports, security, fixing a malfunction).
- Our technical service providers, who act only on our instructions: PlanetHoster (data hosting, France and Switzerland), Google Firebase (notifications, conversations, files, authentication, error reports and usage statistics), Google Maps (map display), and our email delivery provider.
- The authorities, where required by law.
6. Transfers outside the European Union
Data is hosted mainly in France and in Switzerland, a country recognised by the European Commission as providing adequate protection. Some Google services may involve access from the United States: these transfers are governed by the EU-US Data Privacy Framework and by the European Commission's standard contractual clauses.
7. Retention periods
- Account: for as long as it is used. After 3 years without login, it is deleted or anonymised, following a warning message where we have an address for you.
- After the account is deleted: data that identifies you is erased within 30 days. Deposits and monitoring checks are kept in a form that no longer allows you to be identified, for Site statistics. Your messages in group conversations may be kept without your name, so that the conversations remain understandable.
- Technical logs: 12 months at most.
- Backups: overwritten as part of their rotation cycle.
A Client Organisation may set other periods in its contract. Lastly, some data may be kept for longer, with restricted access, where required by law or for the establishment or defence of legal claims.
8. Security
We protect your data with appropriate measures: encrypted connections, encrypted passwords, access restricted according to each person's role, regular backups, and a confidentiality undertaking from authorised persons. In the event of a data breach that poses a risk to you, the CNIL and, where necessary, the persons concerned are informed under the conditions laid down by the GDPR.
9. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability in respect of your data, the right to withdraw your consent where it has been requested and, in France, the right to give instructions on what happens to your data after your death.
You can change most of your information directly in the app, and delete your account from Settings, under “Delete my account”. For any other request, write to our data protection officer: dpo@mlkconcept.com. We respond within one month. You will be asked for proof of identity only if there is reasonable doubt about your identity.
You may also lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country of residence.
10. Device permissions
The app may ask for access to your location, your camera, your photos and files, and permission to send notifications. Each permission is optional and is used only for the feature concerned. You can withdraw it at any time in your device settings.
The web version of the app stores in your browser only the information needed for it to work (session, language, preferences). It does not use advertising cookies.
11. Minors
A minor under the age of 15 uses the Service with the consent of one of their parents or their legal representative, who may exercise the minor's rights on their behalf.
12. Changes to this policy
This policy may change. The date of the current version is shown at the top of the page. You will be notified of any significant change in the app or by email before it takes effect.
13. Contact
MLK Concept's data protection officer: dpo@mlkconcept.com. General enquiries: contact@composton.com. Post: MLK Concept, 114 rue du Maréchal Joffre, 85000 La Roche-sur-Yon, France.