Cookie Policy
This policy is published pursuant to Directive 2002/58/EC ("ePrivacy") Art. 5(3), GDPR Art. 6 and Recital 30, and CNIL guidelines n° 2020-091 of 17 September 2020 (Légifrance JORFTEXT000042388179).
1. Our position: no cookies or trackers subject to consent
The Lourdes-Massabielle.org portal was designed from the outset to set no cookies or trackers subject to consent on the lourdes-massabielle.org domain.
This architecture results from deliberate technical choices, detailed below.
2. Component inventory
2.1 Analytics — Plausible Analytics
Tool used: Plausible Analytics (Plausible Insights OÜ, Estonia, EU).
Plausible is an analytics solution that works without any cookies. It collects no personal data within the meaning of the GDPR. Plausible does not track users across sites, does not build user profiles and does not share any data with third parties.
The CNIL has clarified in its guidelines that analytics tools exempt from consent must meet certain conditions (purpose strictly limited to audience measurement, no cross-referencing with other processing, no transmission to third parties, limited lifespan). Plausible meets all these conditions and goes further by setting no cookie whatsoever.
Hosting: servers in the European Union (Estonia).
2.2 Fonts
The fonts used on the portal (Cormorant, Inter) are self-hosted on the portal's Cloudflare servers. No call to Google Fonts, Adobe Fonts or any other third-party font CDN is made. No cookie is set.
2.3 Maps
Maps displayed on the portal use OpenStreetMap without third-party cookies. Map tiles are served without trackers.
2.4 Anti-bot — Cloudflare Turnstile
Cloudflare Turnstile is used on the portal's forms (donation, prayer wall, listing
claim, contact) as an accessible alternative to cognitive CAPTCHAs. Turnstile is an
invisible challenge that sets no advertising tracking cookie. Any
technical cookies that Cloudflare may set for the challenge to function (e.g.
cf_clearance) fall within the consent exemption for strictly
necessary cookies required for the service to operate (Art. 82 of the French
Data Protection Act, transposing Art. 5(3) of the ePrivacy Directive).
2.5 Payment — Stripe
When a visitor makes a donation, they are redirected to a payment page hosted by Stripe (domain stripe.com or checkout.stripe.com). Stripe may set cookies on its own domain for payment processing and fraud prevention. Those cookies are subject to Stripe's privacy policy, not to that of Lourdes-Massabielle.org.
No Stripe cookie is set on the lourdes-massabielle.org domain.
2.6 Newsletter — Brevo
Newsletter sign-up uses a form hosted on the portal itself. Brevo sets no cookie on the lourdes-massabielle.org domain. Open-tracking pixels in emails fall within the "newsletter" processing activity documented in the Privacy policy, and not within cookies set on the website.
3. Strictly necessary cookies (consent-exempt)
The only cookies that may be present on the lourdes-massabielle.org domain are strictly necessary for the technical operation of the site, exempt from consent under Article 82 of the French Data Protection Act:
| Cookie | Issuer | Purpose | Duration | Exemption |
|---|---|---|---|---|
cf_clearance | Cloudflare | Turnstile challenge validation | Session or a few hours | Strictly necessary (anti-bot security) |
__cf_bm | Cloudflare | Bot Management (if activated) | 30 minutes | Strictly necessary (security) |
These cookies do not require the user's consent because they are indispensable for providing the service expressly requested (Art. 5(3), Directive 2002/58/EC; CNIL guidelines 2020-091, §14).
4. No cookie banner
As no cookies or trackers subject to consent are present, no cookie consent banner is displayed on the portal. This decision complies with CNIL guidelines: a banner is only required when non-strictly-necessary cookies are set.
Displaying a banner in the absence of cookies subject to consent would be misleading and contrary to the principle of transparency.
5. Compliance documentation
The absence of cookies subject to consent has been verified and documented via:
- The CNIL self-assessment cookie tool (version 04/07/2025) — result archived in the portal's compliance file.
- A technical scan of the lourdes-massabielle.org domain (DevTools → Application → Cookies) confirming the absence of third-party cookies.
- A dependency review: no third-party SDK setting cookies (no Google Analytics, no Google Fonts, no Facebook Pixel, no reCAPTCHA).
This scan must be renewed whenever a new feature or third-party service is deployed on the portal.
6. Publisher's commitment
Should the portal evolve to integrate cookies or trackers subject to consent, the publisher undertakes to:
- Update this policy before deployment.
- Implement a consent banner compliant with CNIL recommendations n° 2020-092: refusal as easy as acceptance, no cookie wall, granularity by purpose, proof of consent retained.
- Inform users of the change.
Legal references
| Source | Reference |
|---|---|
| ePrivacy Directive | Directive 2002/58/EC, Art. 5(3) |
| French Data Protection Act | Law n° 78-17 of 6 January 1978, as amended, Art. 82 |
| CNIL — Cookie guidelines | Guidelines n° 2020-091 of 17 September 2020 (JORFTEXT000042388179) |
| CNIL — Cookie recommendation | Recommendation n° 2020-092 of 17 September 2020 |
| GDPR | Regulation (EU) 2016/679, Art. 6, Recital 30 |
| Plausible Analytics | plausible.io — privacy-first, cookieless |
| Cloudflare Turnstile | developers.cloudflare.com/turnstile/ |