Privacy and Personal Data Protection Policy of the Collège de Paris and the organizations of the group. Our commitments to protect your Data.
This document explains the principles and our commitments for the protection of your Personal Data and aims to inform you about :
- The Personal Data that the Collège de Paris collects and the reasons for its collection,
- How the Personal Information will be used,
- Your rights as a data subject of our data processing.
This Policy applies to all Collège de Paris organizations and services, regardless of their nature (site, applications, services, etc.). They mention it and give access to it via links on their sites and in their collection mentions.
The person responsible for processing your data
The person in charge of data processing is Elfe : 15, rue Montmartre – 75001 Paris – France – SA with a share capital of 40 700€ Registered at the RCS of Paris under the number 351 644 414 . The contact details are as follows:
- Postal address : Elfe : 15, rue Montmartre – 75001 Paris – France
- E-mail: [email protected]
How does Collège de Paris implement the protection of Personal Data?
Collège de Paris is committed to taking into account the protection of your Personal Data and your privacy from the design of the services offered to you (Privacy by design). To ensure the security and guarantee the respect and proper exercise of your rights, measures to ensure the protection of your Personal Data are implemented (Privacy by default).
What Personal Information is used by the Collège de Paris?
The Collège de Paris undertakes to collect only the data strictly necessary to carry out the services offered, which are mainly teaching and training activities and to contract them.
In the event that you are asked for optional data, the Collège de Paris will clearly inform you of the Personal Data required to provide the service.
Personal Information collected directly from you is used only for the purposes for which you have been notified. When they have not been collected from you, the Collège de Paris will inform you as soon as possible of the processing for which they have been collected and of its purposes.
Personal Information is used to provide you with additional services, only if you have agreed to receive additional services or communications.
What is the basis for the legitimacy of our treatments?
The Collège de Paris relies on the following legitimate bases in order to process Personal Data:
- Execution of the contract
The legal basis for the processing of the user’s Personal Data that is collected is the execution of the contract. In this regard, the user is obliged to provide the data necessary for its execution. If he does not provide these data, it will not be possible to carry out the service.
- Legal obligations
Obligations by which the Collège de Paris complies with a legal or regulatory obligation fall into this category, such as the management and issuance of invoices in the context of the Collège de Paris’ relationship with clients.
- Consent
For the following purposes, the legal basis for the processing of the user’s Personal Data will be the user’s consent, in the event that the user has given it, such as for
- Management of the registration on the site and the applications.
- Management of the sending of information about the activities of the site and personalized information adapted to the user’s profile.
- Response to the exercise of rights, as well as to questions and complaints. Withdrawal of consent for such processing will not affect the performance of contracts entered into by the data subject with the Collège de Paris.
- Legitimate interest
The legal basis for the processing of the user’s Personal Data may be the legitimate interest of the Collège de Paris in cases where an evaluation of the interest of such processing will make it possible to verify that it does not disproportionately infringe the rights of the person concerned: This may be, for example, the sending of satisfaction surveys on the services of the Collège de Paris in order to ask for their opinion and to improve them, the legitimate interest of the Collège de Paris then consisting of being able to understand the needs, the expectations of its students and clients, with a view to improving their satisfaction level.
Personal Data of minors
Some services may be used by minors under the age of fifteen. In this case, minors must obtain the consent of their parents or legal representatives.
To whom may your Personal Information be communicated?
Your data may be transmitted to :
- Internal departments of the Collège de Paris: departments in charge of the execution of the subscribed services, in particular Customer Service, Sales Administration, schooling, etc.
- To external service providers of the Collège de Paris: technical service providers, including subcontractors;
- To commercial partners of the Collège de Paris, after having informed you beforehand and having allowed you to express your choices thanks to a checkbox.
- To the administrations to which the Collège de Paris belongs
Can your Personal Information be transferred outside the European Union?
Collège de Paris primarily processes your Personal Information within the European Union (EU). However, for certain specific services, Collège de Paris may use subcontractors established outside the EU. Certain Personal Data may then be communicated to them for the strict needs of their missions. In this case, in accordance with the regulations in force, Collège de Paris requires its subcontractors or co-contractors to provide the necessary guarantees for the supervision and security of such transfers, in particular by signing the European Commission’s standard contractual clauses.
How long does Collège de Paris keep your Personal Information?
The length of time your Personal Information is kept depends on the service you have subscribed to. Collège de Paris undertakes not to keep your Personal Data beyond the period necessary for the provision of the service, and therefore for your use of the service, plus the period of retention imposed by the applicable rules on legal prescription. The retention periods will be specified in the information of each treatment.
Is your Personal Information protected?
Collège de Paris undertakes to take all measures to ensure the security and confidentiality of Personal Data and in particular to prevent them from being damaged, erased or accessed by unauthorized third parties.
Furthermore, in the event of a security incident affecting your Personal Data (destruction, loss, alteration or disclosure), Collège de Paris undertakes to comply with the obligation to notify violations of Personal Data, in particular to the CNIL.
What are your rights regarding your Personal Information?
At any time, you have the right to exercise the rights provided for by current regulations applicable to personal data with Collège de Paris, provided you meet the conditions (which is linked to the legal basis of the processing):
- Right of access: you may have access to your Personal Data that is being processed on the basis of your consent, the performance of a public service mission, a legal obligation, the performance of your contract or legitimate interest;
- Right of rectification: you can update your Personal Data or have your processed Personal Data rectified, based on your consent, the performance of a public service mission, a legal obligation, the performance of your contract or legitimate interest ;
- Right to object You can express your wish that your Personal Data no longer be processed in the event that the processing is based on your consent (you withdraw your consent) or on contractual performance (contractual waiver clause) as well as in the case of processing carried out in the legitimate interest. On the other hand, you cannot object to a processing carried out within the framework of a legal obligation or within the framework of the execution of a mission of public service which presents imperious and legitimate reasons prevailing on your rights and freedoms;
- Right to erasure You may request the deletion of your Personal Data, subject to the legal retention period, in the event that the processing is based on your consent (you withdraw your consent) or on contractual performance (contract waiver clause) as well as in the case of processing carried out in the legitimate interest. On the other hand, you cannot request the deletion of data from a processing carried out within the framework of a legal obligation or the realization of a mission of public service;
- Right to limitation: you may request the suspension of the processing of your Personal Data based on your consent, legal obligation, contractual performance or legitimate interest if you have a pending request for rectification, erasure or objection or if you consider the processing unlawful ;
- Right to portability: you may request to retrieve your Personal Data in order to dispose of it only if the processing is based on your consent or the performance of a contract. You cannot benefit from the right to portability in the event that the processing is carried out in the context of a legal obligation, the performance of a public service mission or the legitimate interest.
When subscribing to a service or collecting your Personal Data, you will be given the address (postal and/or e-mail) to which you can send your request to exercise your rights. Any request may, where necessary to ensure that it comes from you, require proof of identity. Collège de Paris undertakes to respond to your requests to exercise your rights as soon as possible and in any event within the legal time limits.
Who to contact?
The appointment of a Data Protection Officer demonstrates Collège de Paris’ commitment to the protection, security and confidentiality of its customers’ Personal Data. You can contact the Data Protection Officer at the following address: [email protected]
You may contact the Collège de Paris data protection officer at the following address: Elfe: 15, rue Montmartre – 75001 Paris – France You also have the right to complain to the Commission nationale de l’informatique et des libertés (CNIL), 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 (https://www.cnil.fr/) about any complaint relating to the way in which the Collège de Paris processes your Personal Data.
Changes to this policy
Updates to this Privacy Policy will be posted on the www.elfe-paris.com website.
Glossary
Each term beginning with a capital letter has the meaning given below.
- “Privacy and Data Protection Policy” and “Policy” means this Policy describing the measures taken for the processing, use and management of your Personal Data and your rights as a data subject.
- “Personal Information” means any information about you that directly or indirectly identifies you.
- “Processing” means any operation or set of operations applied to your Personal Data.
- “Data Controller”: Refers to the Collège de Paris which processes your Personal Data.
- “Personal Data Breach” means a breach of security, resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to your Personal Data.
- “Recipient” means the department or company that receives communication and may access your Personal Information.
