Date of last update: 13/10/2020

1. Introduction

1. In the course of its activity, ECAD IESA Arts Culture, a member of the Galileo Global Education Group, collects and processes personal data.

2. Therefore, as it is keen to foster innovation while building a lasting relationship of trust based on respect for people’s rights and freedoms, the Institution strives to put in place the technical and organizational means necessary to protect the personal data it processes.

3. The main objective of this policy is to bring together, in a concise, transparent, understandable, and easily accessible format, the information concerning the data processing carried out, to allow you to understand under what conditions your data is processed and what your rights are in this regard, and to present the Institution’s commitments.

2. Who are we?

4. ECAD IESA Arts Culture (hereinafter "the Institution") is a school belonging to the private higher education group Galileo Global Education France (hereinafter "Galileo Group").

5. ECAD IESA Arts Culture is a company with a share capital of €120,000, registered with the Paris Trade and Companies Register under SIREN number 331 154 054 RCS, whose registered office is located at 1 Cité Griset 75011 Paris - France.

3. Data protection officer and delegate

6. The Galileo Group has appointed a shared personal data protection officer (DPO) for all the entities and schools of the Galileo Group, whose contact details are as follows: 41 rue Saint Sébastien, 75011 PARIS, Data Protection Officer or DPO, email address: dpo@ggeedu.fr.

7. To act as a relay with the DPO, the Institution has also appointed internally a personal data protection officer ("delegate DPO - DDPO") whose contact details are dpo@iesa.fr.

The DPO and the Institution’s personal data protection delegate are responsible for advising, informing, and monitoring compliance with data protection regulations.

4. Fair and transparent collection

8. In the interest of transparency, the Institution takes care to inform the data subjects of each of the processing operations that concern them.

9. This data is collected fairly. No collection is carried out without people’s knowledge and without their being informed.

5. The purpose principle

10. When the Institution processes data, it does so for specific purposes: each data processing operation carried out pursues a legitimate, determined, and explicit purpose.

6. Proportionate data processing

11. For each processing operation carried out, the Institution undertakes to collect and use only data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

12. The Institution ensures that data is updated where necessary and that procedures are implemented to allow the erasure or rectification of inaccurate data.

7. The personal data we process

13. As part of the personal data processing whose purposes will be presented to you below, the Institution mainly collects and processes the following categories of data:

  • personal identification data such as the surname(s), first name(s), date of birth, and nationality of the data subjects;
  • data relating to the program, such as the educational path or data related to training projects;
  • economic and financial information such as financing arrangements;
  • data relating to personal life, such as home address, telephone number, and email address;
  • where applicable, data relating to professional status, such as occupation, employer, or professional contact details, and professional experience;

14. In general, the Institution does not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor does it process genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning a natural person’s sex life or sexual orientation.

15. However, in exceptional cases, the Institution may collect health data, in particular data relating to a disability, in order to adapt the practical arrangements of the training services provided, or biometric data for managing access controls.

8. The origin of the data we process

8.1 Declarative personal data

16. This is the personal data you mainly provide in the context of:

  • your exchanges with the Institution, in particular at fairs, high school forums, or open days;
  • entering into a contract with the Institution;
  • setting up a file with the Institution;
  • surveys conducted among data subjects.

17. This data is mainly collected through our forms and our paper and electronic questionnaires.

8.2 Personal data from third parties or other services

18. Personal data may also come from:

  • your browsing on the schools' websites;
  • other schools of the Galileo Group or partner institutions;
  • lead providers;
  • if applicable, your employer;
  • public bodies;

9. The legal bases and purposes of our data processing

18. The processing carried out by the Institutions and more broadly by the Galileo Group is necessary for the performance of a contract or for the performance of pre-contractual measures taken at the request of the data subject. This is the case for processing that pursues the following purposes:

  • managing and monitoring registration for a competition or a program;
  • managing and monitoring the program; for this purpose and as part of so-called hybrid programs, classes may be filmed and broadcast to all students attending the class remotely. They may also be recorded.
  • recording and processing the provision of the training service;
  • the administrative and financial monitoring of the program;

19. The processing carried out by the Institution and more broadly by the Galileo Group is necessary for the performance of a contract or for the performance of pre-contractual measures taken at the request of the data subject. This is the case for processing that pursues the following purposes:

  • managing and monitoring registration for a competition or a program;
  • managing and monitoring the program;
  • recording and processing the provision of the training service;
  • the administrative and financial monitoring of the program;

20. The processing that pursues the following purposes is carried out to meet legal and regulatory obligations incumbent on the Institution, namely:

  • program-related actions;
  • necessary adaptation of the course of the program for people with disabilities;
  • implementing the rights of data subjects under personal data regulations;
  • managing accounting / taxation;

21. The processing that pursues the following purposes is carried out to achieve the legitimate interests of the Institution, in particular the management, proper functioning, and development of its activity:

  • managing prospecting for the Institution or for any other school of the Galileo Group;
  • conducting marketing studies and internal statistics;
  • promoting the educational paths offered by the Institution;
  • managing surveys;
  • organizing events;
  • analyzing and measuring site traffic;
  • managing alumni and developing the school’s network; in this context, as a former student, you may be contacted.

22. The Institution relies on the consent of data subjects for processing purposes that are not based on the legal bases of legitimate interest, legal and regulatory obligations, or necessity for the performance of contracts.

10. The recipients of your data

23. The personal data we collect, as well as that collected subsequently, is intended for us in our capacity as data controller.

24. The following categories of recipients also receive your data:

  • members of staff of the Institution, of the other schools of the Galileo Group, and Galileo Group staff, in particular for managing prospective applicants, and where applicable members of staff of partner institutions;
  • our possible subcontractors;
  • public or private bodies in order to meet our legal obligations;
  • ranking organizations in order to promote the school’s reputation;

25. We ensure that only authorized persons can access this data. The Institution applies strict authorization policies so that the data it processes is only transmitted to the persons authorized to access it.

11. Transfers of your data

26. The personal data that the Company processes may, during certain operations, be transferred to countries within or outside the European Union.

27. In the case of processing carried out outside the European Union, including remote access, the company undertakes to put in place safeguards ensuring the protection and security of this information, in accordance with applicable regulations.

28. You can obtain a list of transfers and the safeguards taken by contacting the DPO at dpo@ggeedu.fr.

12. How long we keep your data

29. The Institution ensures that data is kept in a form permitting the identification of data subjects for no longer than is necessary in relation to the purposes for which it is processed.

30. The retention periods we apply to your personal data are proportionate to the purposes for which it was collected.

31. In particular, we organize our data retention policy as follows:

  • Data collected for prospect management: 3 years maximum
  • Data collected and processed in connection with educational training: 10 years maximum
  • Data processed in connection with graduation: 50 years

The Institution reserves the right to retain your data beyond the periods stated above where necessary because of judicial or regulatory obligations.

13. The security of your data

32. The Galileo Group attaches particular importance to the security of personal data.

33. Appropriate technical and organizational measures are implemented so that data is processed in a way that ensures its protection against accidental loss, destruction, or damage that could compromise its confidentiality or integrity.

34. When developing and designing, or when selecting and using the various tools that allow the processing of personal data, the Institution ensures that they provide an optimal level of protection for the data processed.

35. The Institution thus implements measures that respect the principles of data protection by design and by default. In this respect, the Institution is able to use data pseudonymization or encryption techniques where possible and / or necessary.

14. Subcontracting

36. When it uses a service provider, the Institution only communicates personal data to it after having obtained from the provider a commitment and guarantees as to its ability to meet these security and confidentiality requirements.

37. In compliance with our legal and regulatory obligations, we enter into contracts with our subcontractors that precisely define the conditions and methods for their processing of personal data.

38. Likewise, the Galileo Group carries out or has carried out audits of its own services as well as those of its service providers, in order to verify the application of data security rules.

15. The rights granted to you

39. The Institution is particularly keen to respect the rights granted to you in the context of the data processing it carries out, in order to guarantee you fair and transparent processing in view of the particular circumstances and context in which your personal data is processed.

15.1 Your right of access

40. In this respect, you receive confirmation as to whether or not your personal data is being processed and, where it is, you have the right to request a copy of your data and information concerning:

  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients and, where applicable if such disclosures were to take place, the international organizations to which the personal data have been or will be disclosed, in particular recipients established in third countries;
  • where possible, the envisaged retention period for the personal data or, where that is not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller the rectification or erasure of your personal data, the right to request restriction of the processing of your personal data, and the right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • information about the source of the data where it is not collected directly from the data subjects;
  • the existence of automated decision-making, including profiling, and in the latter case, meaningful information about the underlying logic, as well as the significance and envisaged consequences of such processing for the data subjects.

15.2 Your right to rectification of your data

41. You may ask us to have your personal data, as the case may be, rectified or completed if it is inaccurate, incomplete, ambiguous, or outdated.

15.3 Your right to erasure of your data

42. You may ask us to erase your personal data when one of the following grounds applies:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
  • you withdraw the consent previously given;
  • you object to the processing of your personal data where there are no overriding legitimate grounds for the processing;
  • the processing of personal data does not comply with the provisions of the applicable legislation and regulations.

The right to erasure of data is not a general right; it can only be granted if one of the grounds provided for in the applicable regulations is present.

43. Failing that, the Institution will not be able to respond favorably to your request; this will be the case if it is required to retain the data because of a legal or regulatory obligation or for the establishment, exercise, or defense of legal claims.

15.4 Your right to restriction of data processing

44. You may request the restriction of the processing of your personal data in the cases provided for by legislation and regulations.

15.5 Your right to object to data processing

45. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data whose legal basis is the legitimate interest pursued by the controller (see the article above on the legal basis of processing).

46. If you exercise such a right to object, we will ensure that we no longer process your personal data in the context of the processing concerned, unless we can demonstrate that we have compelling legitimate grounds for maintaining that processing. These grounds must override your interests and your rights and freedoms, or the processing must be justified for the establishment, exercise, or defense of legal claims.

47. You have the right to object to commercial prospecting and to profiling to the extent that it is linked to such prospecting.

48. With regard to commercial prospecting, please note that you may object to receiving prospecting from the Institution by post or by telephone.

49. In the case of prospecting by electronic mail (email, SMS, MMS), the Institution may use it if you have given your consent at the time of collection. You may then object at any time via the link in the email sent to you or by sending stop to the number shown in the message received.

15.6 Your right to data portability

50. You have the right to portability of your personal data. This is not a general right. It only concerns automated processing, excluding manual or paper processing.

51. This right is limited to processing whose legal basis is your consent or the performance of pre-contractual measures or of a contract.

52. It does not include derived data or inferred data, which are personal data created by the Institution or the Galileo Group.

53. The data to which this right may be applied is:

  • only your personal data, which excludes anonymized personal data or data that does not concern you;
  • the declarative personal data as well as the operational personal data mentioned above.

54. The right to portability cannot adversely affect the rights and freedoms of third parties, such as those protected by trade secrets.

55. You may request data portability according to the procedure defined below, specifying whether you wish to receive the data yourself or, if technically possible for us, to have us transmit it directly to another controller.

56. In the latter case, you must indicate to us the exact name of this controller, their contact details, and the department or person who should receive it. To facilitate the exercise of this right, you must inform this recipient of your request to our departments.

15.7 Your right to withdraw your consent

57. Where the data processing we carry out is based on your consent, you may withdraw it at any time. We then cease to process your personal data, without calling into question the prior operations for which you had given consent.

15.8 Your right to lodge a complaint

58. You have the right to lodge a complaint with the Cnil (3 place de Fontenoy 75007 Paris) in French territory, without prejudice to any other administrative or judicial remedy.

15.9 Your right to set post-mortem directives

59. You may set specific directives concerning the retention, erasure, and disclosure of your personal data after your death with our departments, according to the procedures defined below. These specific directives will only concern the processing carried out by us and will be limited to that scope alone.

60. Where such a person has been designated by the executive authority, you will also be able to set general directives for the same purposes.

15.10 How to exercise your rights

61. All the rights listed above may be exercised by proving your identity and contacting the Institution’s DDPO, the personal data protection delegate.

62. The latter will be responsible for communicating to the Galileo Group’s DPO the rights requests made to them.

15.11 Changes to this document

63. We invite you to consult this policy regularly on our website. It may be updated.