Article 1: Introduction and scope of application
In accordance with legislation on the protection of personal data, in particular the European Regulation (EU) 2016/679 of 27th April 2016 and the French Information Technology, Data Files and Civil Liberties Law No. 78-17 of 6th January 1978, as amended by Law No. 2018-493 of 20th June 2018 on Personal Data Protection, EXCELIA GROUP is committed to protecting all personal information collected and used as part of its data processing activities.
This data protection policy applies exclusively to all students and learners, as well as to all members of organisations that are not part of EXCELIA GROUP or that do not belong to EXCELIA GROUP. It does not apply to EXCELIA GROUP employees.
This policy applies in the following circumstances:
- Using any of EXCELIA GROUP’s services, including
- its websites, Intranet (forms, cookies, etc.) or digital workplace
- its social media pages
- any type of message exchange (emails, text messages, paper or electronic forms, etc.)
- mobile applications
- Joining a training course/study programme or attending an event
- Responding to a request from EXCELIA as an alumnus, contributor, partner or supplier
EXCELIA GROUP websites contain links that may redirect Users to third-party pages that have their own confidentiality and cookie management policies. The policy of these third parties should be consulted and EXCELIA GROUP declines all responsibility for the confidentiality practices implemented by these third parties.
Article 2: Data controller
The data controller is EXCELIA GROUP, a French higher education establishment, registered on 23/11/1988 as a non-profit association in accordance with the 1901 French Association Law.
- Répertoire National des Associations (national directory of associations) number: W173000778
- Head office: 102 RUE DE COUREILLES, Les Minimes, 17000 LA ROCHELLE
- French SIRET number (company identification number): 34876850800015
Represented by its legal representative.
Article 3: Data subjects
In order to ensure the smooth running of its operations, EXCELIA GROUP is required to implement and use the processing of personal data relating to its prospects, applicants, clients, learners, former learners, third-party payers, lecturers, suppliers, partners (companies and other organisations), users:
- ‘Prospects’ refers to any person potentially interested in a study programme/course or event
- ‘Applicants’ refers to any person who is interested in a study programme/course and has started the application process
- ‘Clients’ refers to anyone who has confirmed their enrolment or anyone who has had their enrolment approved by their company, where applicable, following an admissions procedure, whether by paying an initial deposit or by signing a contract or finance agreement
- ‘Learners’ refers to any person enrolled in a qualification-awarding study programme/course at EXCELIA GROUP
- ‘Former learners’ refers to any person who has attended a study programme/course (qualification-awarding or not), and who may or may not have completed the training
- ‘Third-party payers’ refers to any individual person or legal entity financing all or part of a Client’s studies/training
- ‘Lecturers’ refers to any person responsible for providing pedagogical services, whether or not they are an employee of EXCELIA GROUP
- ‘Suppliers’ refers to companies or organisations with which EXCELIA GROUP has a contract to purchase services, as well as to EXCELIA GROUP’s subcontractors
- ‘Partners’ refers to companies or organisations with which EXCELIA GROUP has a formal partnership agreement, notably within the framework of its training activities
- ‘Users’ refers to any person using the services of EXCELIA GROUP’s information system
Article 4: Processing of personal data
1. Data Types
Types of non-technical data processed by EXCELIA GROUP include the following:
Types of technical data processed by EXCELIA GROUP include the following:
2. Data collected
EXCELIA GROUP collects and processes different data according to user type:
3. Origin of data
Direct data collection
Data is mainly collected directly via the following sources:
- application procedure
- registration/enrolment procedure
- accounts created on EXCELIA GROUP websites
- online forms or questionnaires from the various EXCELIA GROUP websites and/or third-party sources
- paper forms
- information provided by Prospects, Applicants or Clients
- ordering of products or services
Indirect data collection
EXCELIA GROUP may collect data indirectly via the following sources:
- academic partners
- corporate partners
Such data collection is carried out in strict compliance with the obligations set out in Article 14 of the GDPR.
Data enhancement
EXCELIA GROUP informs Learners/Students that data is cross-referenced and shared between its different departments. Once they have been accepted, they will be asked to check and, where necessary, to update their data in order to complete their administrative enrolment.
Lecturers and Service Providers are advised that data is used for management purposes, in particular for placing orders, and for managing the services provided by Lecturers and Service Providers.
Required data
Only essential data required for the purposes of data processing will be collected.
When personal data is collected via forms or questionnaires, whether online or paper-based, compulsory fields are clearly marked.
If the compulsory fields are not filled in, services linked to this data collection may not be provided or the application or access to the specific service may not be fully considered. There are also optional fields which are used to process requests more efficiently.
Article 5: Purpose of data collection
1. Lawful basis
The lawful basis depends on the type of processing:
- EXCELIA GROUP’s legal obligations
- Performance of public tasks
- Fulfilment of a contract or pre-contractual measures
- Consent of the person concerned
- Safeguarding the vital interests of the person concerned
- Legitimate interests of EXCELIA GROUP
2. Purpose
The purpose of collecting this information is to enable a number of services including the following:
- access to the admissions platform
- managing and monitoring applications and, once the applicant has been selected, monitoring the administrative, financial and educational aspects of the Client’s studies
- Customer Relationship Management
- invoicing
- managing outstanding payments and litigation
- the issuing of the following:
- for students – a student card with an ID photo, enabling them to prove their identity and gain access to the campus and library services, and to print and/or photocopy documents
- for other users: a temporary badge enabling access to the premises and, where applicable, to print and/or photocopy documents
- managing the library and related services
- medical monitoring of learners
- managing emergency contacts
- managing attendance records to verify that students have followed the course and, where applicable, managing end-of-studies certificates
- creating and managing User accounts for access to EXCELIA GROUP’s digital workplace
- managing a messaging service directory
- attending lessons or consulting online educational content
- submitting documents and coursework
- managing videoconferencing or web conferencing services, where appropriate
- managing assessments of courses taken by Clients
- managing continuous assessment as well as end-of-year exams, end-of-semester exams, and overseeing the panels that award qualifications or certificates
- managing disciplinary measures in the event of breaches of EXCELIA GROUP’s regulations, policies or charters
- implementing research studies, indicators and surveys
- providing access to professional support services developed by EXCELIA GROUP’s Corporate Relations Department
- managing the issuing of qualifications or certificates
- collecting the French apprenticeship tax (taxe d’apprentissage)
- managing corporate relations
- communicating data, in particular CVs, to companies and to partners of EXCELIA GROUP
- communicating data to the EXCELIA Foundation so that it can inform Clients of the actions it is taking and contact them
- managing the transfer of data to EXCELIA Alumni in the case of Students having joined the association in question or having consented to the transfer of their data to the said association
- implementing marketing operations such as prospecting and advertising for study programmes, activities or events organised by EXCELIA GROUP or its community
- creating statistics
If a Learner/Student is enrolled on a programme managed jointly by EXCELIA GROUP and a partner university or school (including one located abroad), within this specific framework, EXCELIA GROUP will communicate the Learner’s/Student’s data to the partner university or school for the purposes of managing their enrolment, monitoring their education, and obtaining the necessary credits from the partner university or school.
Article 6: Data retention periods
EXCELIA GROUP determines how long it retains the data it processes in accordance with the following criteria:
- legal retention period (established by law)
- contractual retention period (provided for by a contractual obligation)
- as required by the reasons for which the data is collected
In accordance with the principles set out in the GDPR, each data retention period set by EXCELIA GROUP shall not exceed the duration strictly necessary for the purposes of the data processing.
Article 7: Data recipients
1. Subcontractors
EXCELIA GROUP is committed to working only with subcontractors who have provided the necessary guarantees in terms of compliance with GDPR requirements.
EXCELIA GROUP undertakes to ensure compliance with this Policy by all subcontractors that process personal data on its behalf in connection with the use of one of EXCELIA GROUP’s services.
EXCELIA GROUP ensures that personal data is accessible to authorised internal or external recipients only.
2. Data disclosure to third parties
Internally, only the relevant departments of EXCELIA GROUP will be granted access to User data, within the scope of their respective responsibilities.
EXCELIA GROUP may transmit personal data to the following:
- EXCELIA GROUP partner universities and schools
- organisations involved in student life
- Ministry of Higher Education, Research and Innovation
- EXCELIA GROUP student associations, in particular EXCELIA Alumni and the EXCELIA Foundation (if applicable)
- partner companies
- organisations involved in lifelong learning/continuing education
- companies that finance training for Clients
- professionals involved in selection panels or involved in the delivery of education provided by EXCELIA GROUP
- publishers of educational content or services connected to EXCELIA GROUP or accessible via EXCELIA GROUP platforms
- accommodation providers and/or travel companies
These third parties are required to act on EXCELIA GROUP’s instructions with regard to the User’s personal data and to only use it within the framework of the contract signed between EXCELIA GROUP and said third parties, unless the person concerned explicitly consents to these third parties using it for their own purposes.
3. International data transfers
Third parties connected with EXCELIA GROUP may be located outside the European Union. In such cases, the Learner/Student accepts that his/her data may be transferred to these third parties.
However, EXCELIA GROUP shall take all necessary measures to ensure that the service provider or partner presents an adequate level of data protection with regard to the legislation and regulations on the protection of personal data. In order to ensure respect for a User’s privacy and personal data, the subcontractors concerned will be signatories to the type of standard contractual clauses approved by the European Commission.
4. Alumni
EXCELIA GROUP will transfer a Learner’s/Student’s personal data to the EXCELIA GROUP alumni association (EXCELIA Alumni). The Learner/Student may object to this by sending an email.
For partners/companies/organisations, all personal contact data of will be sent to the EXCELIA Foundation.
Article 8: Rights of data subjects
In accordance with European Regulation (EU) 2016/679 and the amended French Information Technology, Data Files and Civil Liberties Law No. 78-17, Users have the right to access, modify, rectify and remove their personal data and the right to object on legitimate grounds.
To exercise this right, Users must contact the Data Protection Officer, either by letter or by email.
- By letter: Data Protection Officer (DPO), Excelia Group, 102 RUE DE COUREILLES, Les Minimes, 17000 LA ROCHELLE
- By email: donneespersonnelles@excelia-group.fr, specifying ‘Personal Rights’ in the subject line and enclosing a copy of his/her proof of identity.
These are individual rights that can only be exercised by the data subject with respect to his/her personal information: for security reasons, the department concerned will therefore have to verify the identity of the data subject in order to avoid any communication of confidential information concerning him/her to another person.
1. Right of access
The User has the right to request a copy of any personal information that EXCELIA GROUP holds about him/her, except in cases where disclosure of this data would violate the privacy of another person or if the request is deemed unreasonable.
2. Right to rectification
Any request for rectification will be sent to the department concerned and EXCELIA GROUP will inform the User when this rectification has been made.
3. Right to erasure ('right to be forgotten')
Any request for erasure of data by the User will be examined in order to determine whether or not it is appropriate to carry out said erasure. The User’s right to erasure shall not apply where processing is carried out in order to comply with a legal obligation. Certain data is necessary for the follow-up of a study programme or course and/or for its financial processing.
If processing requires the User’s consent, the User may withdraw this consent at any time.
4. Right to data portability
The User is hereby advised that he/she has the right to data portability in order that data may be reused for his/her own purposes in another IT environment. To exercise this right, the User must write to EXCELIA GROUP, Data Protection Coordinator, 1 Rue de la Libération, 78350 Jouy-en-Josas, France, or by sending an email to donneespersonnelles@excelia-group.fr, specifying ‘Personal Rights: Data Portability’ in the subject line and enclosing a copy of his/her proof of identity.
This right to data portability does not apply to all processing operations undertaken by EXCELIA GROUP, such as those carried out as part of EXCELIA GROUP’s performance of public tasks or in connection with its legal obligations. The User’s request will be carefully examined and only data eligible for the right to portability will be treated and transmitted.
5. Right to submit a complaint to the CNIL
The CNIL is the French national commission for ‘informatics and freedoms’. The User has the right to submit a complaint to this French data protection agency, by writing to:
- COMMISSION NATIONALE DE L’INFORMATIQUE ET DES LIBERTÉS
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
A list of the various European regulatory authorities can be found on the French version of the CNIL website: CNIL
Article 9: Security
With a view to ensuring data security, EXCELIA GROUP has implemented appropriate security measures that are commensurate with the potential risks incurred, by taking all necessary precautions, whether physical, logical, administrative or organisational, with regard to the nature of the data it collects, processes and transmits.
Article 10: Data protection officer (DPO)
EXCELIA GROUP has a designated Data Protection Officer.
In the event of an issue with the processing of personal data, the Data Subject may contact the appointed Data Protection Officer, either by letter or by email.
- By letter: Excelia Group, Data Protection Officer (DPO), Excelia Group, 102 RUE DE COUREILLES, Les Minimes, 17000 LA ROCHELLE
- By email: donneespersonnelles@excelia-group.fr
Article 11: Cookies and other trackers
A cookie is a small text file or ‘tracker’ that is sent by an Internet server to the hard disk of a computer, mobile phone, tablet or any other device used for accessing the Internet. Cookies and other trackers do not enable a person to be identified; however, they do record information relating to a User’s browsing activities. Servers can therefore read and store this information.
Different types of cookies are used on our site.
- Technical cookies are used for the following reasons:
- saving pages
- sending notifications
- subscribing to one of our newsletters
- contributing to the security of the service requested
- registering the language or other preferences necessary for the provision of the requested service
- operating a media player (audio or video) associated with the requested content
- enabling identification to a restricted area
- enabling load balancing
- adapting the site to visitor requests
We hereby inform Users that deleting technical cookies may adversely affect access to the sites and services offered.
- Audience measurement cookies are used for the following reasons:
- measuring audiences of the various content and sections of the sites, the paths taken to access them, analysing browsing behaviour and producing statistics. EXCELIA GROUP uses Google Analytics provided by Google Inc.
- Data generated by these cookies relating to the use of our sites will be transmitted to and stored by Google on its servers, primarily in the USA; Google will use this information to provide other services relating to website activity and internet use; the data is stored for a period of 14 months; Users can install an opt-out add-on in their browser to deactivate Google Analytics
- Social media cookies are used for the following reasons:
- activating the ‘share’ and ‘like’ buttons available on LinkedIn and Twitter social networks, lists of tweets (Twitter), videos available on the site (YouTube, etc.) and any animated presentations; these features are enabled via third-party cookies installed on a User’s device by said third parties who are likely to use this type of button to identify Users when a page is viewed and a connection is made on a social media site (i.e. when a User initiates a session)
USER PREFERENCES AND PROCEDURE FOR DELETING COOKIES ON OUR SITES
The User has the option of deactivating the use of these cookies by configuring his/her Internet browser accordingly.
Users can configure their browser to refuse or delete certain cookies.
The following links explain how to configure cookies for different browsers:
Please refer to the CNIL website for further information: CNIL – French data protection agency
Article 12: Management of Excelia group's social media sites
1. Purpose of data processing
EXCELIA GROUP, whose registered head office is located at 102 rue de Coureilles, Les Minimes, 17024 La Rochelle Cedex 1, France, processes data in order to manage the various social media sites administered by EXCELIA GROUP. This is done via the following:
- technical administration of accounts
- interaction via a messaging service with all Users of these social media sites, in particular page subscribers and visitors
- usage and performance statistics for its pages
- implementation of a campaign to test the effectiveness of advertising to promote EXCELIA’s programmes and social media pages, in order to improve awareness of the programmes and the institution in general
- contact, via groups made up of participants on some of our programmes, in order to inform them of the latest developments in the study programmes relevant to these specific groups
The processing of data is carried out on the grounds of legitimate interest, as defined in article 6.1.f of the EU General Data Protection Regulation (GDPR), for the purposes of informing the public about its educational offer, events and activities, as well as for corporate relations purposes.
2. Source of data and obligation to collect data
The data collected is provided by Users of the social networking site, Facebook.
The collection of this data is the result of the User’s personal decision to access the content published on EXCELIA GROUP’s social media sites. An individual who does not have a Facebook account can still access the information published on the EXCELIA GROUP pages. However, to benefit from personalised information, social features or online response services, a User must have an account on said social networking site.
3. Automated decision-making
The data processing does not involve automated decision-making (GDPR – Automated individual decision-making).
4. Types of data processed
The data processed includes data visible by default on Facebook, including the following: last and first name or pseudonym, profile photo or avatar, introductory message, publications, sent/received messages, data made public as a result of User settings, data on the use of the platform for the production of anonymised statistics.
Note that EXCELIA GROUP does not configure and does not have access to your personal data resulting from cookies installed by Facebook. The statistical data from these cookies is made available to EXCELIA GROUP in an aggregated (anonymous) form and is not personal. Only Facebook can respond technically to your requests relating to any cookies used.
5. Types of persons concerned
Any User who accesses the social networking site, Facebook.
6. Data recipients and potential data transfers outside of EU
The recipients of the data are the following: Communications Department, all departments responsible for programme admissions, departments managing events, EXCELIA GROUP lecturers and, if required, EXCELIA GROUP subcontractors carrying out media campaigns and analyses on its behalf.
Publications and public discussions will be accessible by any member of the public as a result of their presence on Facebook and, as a result, may be shared outside of the European Union.
Data used for statistical purposes may be transferred and processed outside of the European Union, as indicated by Facebook in its data management policy.
7. Data retention period
Data will be retained for as long as the corresponding social media account exists, unless the Data Subject exercises his/her right to erasure or right to object.
8. Security
The security measures relating to the administration of accounts are implemented in accordance with EXCELIA GROUP’s information systems security policy.
The security measures relating to the management of data enabling the production of anonymous statistics are specified by Facebook.
9. Individual rights
You have the right to access your personal data and the right to request that it be deleted.
To exercise your rights or if you have any questions about the processing of your data within this framework, you can contact EXCELIA GROUP’s Data Protection Officer (DPO), either by letter or by email.
- By letter: Data Protection Officer (DPO), Excelia Group, 102 RUE DE COUREILLES, Les Minimes, 17000 LA ROCHELLE
- By email: donneespersonnelles@excelia-group.fr
If, after contacting us, you feel that your rights with respect to the French Information Technology, Data Files and Civil Liberties Law have not been respected, you can contact the CNIL to submit a complaint (online or by post).
Article 13: Policy evolution
This data confidentiality policy is subject to modification or revision at any time as a result of changes in legislation, case law or usage.
Article 14: Further information
For further information, please send a request by email: donneespersonnelles@excelia-group.fr
For any other information on the protection of personal data, the User may consult the website of the CNIL: CNIL – French data protection agency
If you wish to consult the previous version of this policy, please send your request by email: donneespersonnelles@excelia-group.fr
IMPORTANT NOTE:
This document is a translation from the original French. In the event of any discrepancy, the French version prevails.
