Last updated: 19 October 2026
These pages are provided in several languages for clarity. In the event of any discrepancy between translations, only the French version is authoritative.
Data controller
The controller for personal data collected on WAFIKO is the site's publisher, whose identity and contact details appear on the Legal notice page.
Data collected
The following categories of data are collected as part of the operation of the service:
• Account: username, e-mail address, password (stored in encrypted form, never in plain text), declared city, country, languages spoken, bio, profile picture, date of birth or confirmation of being an adult.
• Animal profiles: name, species, breed, date of birth, photos, description.
• Location: only the city of residence for profiles; an approximate position chosen manually on a map for lost/found alerts (public) and meetups (visible only to confirmed participants). The application never collects the device's precise GPS geolocation.
• Exchanges and content: private messages between members and their attachments, news-feed posts, comments, answers on the questions forum.
• Reports: the content of a report made by a member, and the history of moderation decisions concerning their own account.
• "Found animal" reports (QR code): if you are logged in when sending a "found animal" or "I saw it" report from a collar's public QR code page, your account is linked to that report — solely to award you the "Good Samaritan" badge, if applicable, once the animal's owner has confirmed the report. This link is never shown to the animal's owner, who only confirms the report's content, never an identity. The form remains usable without an account.
• Messages sent via the contact form: name, e-mail, subject and message, for people who are not (yet) members.
• Technical logs: IP address, timestamp and pages visited, kept for security purposes (fighting fraud and abuse).
• Moderation and administration team: in addition to account data, an encrypted two-factor authentication (2FA) secret and encrypted recovery codes, since access to the administration area requires them.
Purposes and legal basis
Providing the service (creating and managing the account, animal profiles, putting members in touch, alerts, messaging): performance of the contract that binds you to WAFIKO by accepting these terms.
Security, abuse prevention and moderation (technical logs, handling reports, two-factor authentication for the team): legitimate interest in ensuring the security of the service and its members.
Handling the contact form: performance of a pre-contractual step or legitimate interest in responding to requests addressed to us.
Sending account-related e-mails (registration confirmation, password reset, notifications): performance of the contract.
Retention periods
Account data is kept for as long as the account exists. If an account is deleted, the associated personal data is deleted or anonymised, subject to retention periods required by law.
Content deleted by a member or removed by moderation (animal profiles, posts, messages, alerts, comments, shelters) is kept for 30 days in a technical recycle bin before its final, irreversible deletion, to allow for restoration in case of error or to contest a moderation decision.
Messages sent via the contact form are kept until they are dealt with, then archived for a reasonable time for evidential purposes, before deletion.
Technical connection logs are kept for a limited period for security purposes.
Recipients and processors
Data is not shared with any third party for commercial purposes and is never sold.
Hosting: data is hosted with o2switch SAS (Chemin des Pardiaux, 63000 Clermont-Ferrand, France), which acts as a processor within the meaning of the GDPR.
Sending e-mails: transactional e-mails (registration confirmation, password reset, notifications) are sent by the SMTP server included with this hosting, located in France. This is therefore the same processor as the host, not an additional e-mail-sending provider.
Push notifications (if you enable them): they travel through your browser's or operating system's notification service (Google, Apple, Mozilla or Microsoft, depending on your device), which delivers them to your device. Only the content needed to display the notification (title, short text, link) is shared with them — never the full content of a private message, nor any other sensitive data. You can disable push notifications at any time from Settings > Notifications.
Mapping: the base maps shown (animal profiles, alerts, directory) are provided by the OpenStreetMap project and loaded directly by your browser from its servers; your IP address is therefore transmitted to it when the map is displayed, independently of WAFIKO, under the terms described by OpenStreetMap's own privacy policy.
Within WAFIKO, only the moderation and administration team can access data to the extent necessary for the operation and security of the service.
Transfers outside the European Union
Data is hosted in France, within the European Union. Loading OpenStreetMap base maps may involve a technical transfer to servers located in the United Kingdom, a country covered by a European Commission adequacy decision guaranteeing a level of protection equivalent to the GDPR. No other transfer of data outside the European Union is carried out at this time.
Confidentiality of location
As a matter of principle, no precise address or exact GPS coordinates of a person or an animal is ever displayed publicly: profiles only show a city, lost/found alerts only show an approximate position chosen manually by the member, and the location of a meetup is visible only to participants who have confirmed they are attending.
Data security
Passwords are stored in encrypted form. Access to the administration area is protected by two-factor authentication. Exchanges with the service are encrypted (HTTPS). These measures do not guarantee absolute security but reflect a reasonable state of the art for a service of this nature.
Your rights
In accordance with the GDPR and Spanish law (LOPDGDD), you have the following rights over your data: access, rectification, erasure, restriction of processing, objection and portability.
Most of these rights can be exercised directly from your account settings (editing your profile, downloading your data, deleting your account). For any other request, use the Contact us.
If you believe your rights are not being respected, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es), the supervisory authority competent for the publisher, or with the data-protection authority of your own country of residence if different: the CNIL in France, the Garante per la protezione dei dati personali in Italy, the CNPD in Portugal and Luxembourg, the BfDI or the competent Land authority in Germany, the APD in Belgium, or the Autoriteit Persoonsgegevens in the Netherlands.
Minors
The service is reserved for people aged 18 or over; no data about a minor is knowingly collected. If you notice that an account has been created by a minor, report it via the Contact us.
Changes to this policy
This policy may be changed to reflect developments in the service or in applicable regulations. The date of the last update appears at the top of this page.