Privacy policy

The goal of the present Privacy Policy is to inform you on the way Association FATA processes your personal data and to enable you to exercise your rights on that data.

In order to have a clear vision on the whole processing of your personal data done by Association FATA, we invite you to take a few minutes and read this document entirely.

For any question or comment pertaining to our Privacy Policy, you can send an email to the following address: dpo@fata.school.

Art. 1: Who is in charge of processing my personal data?

The controller of processing is the entity that defines the objectives (why?) and the means (how?) of processing your personal data.

The controller of processing your personal data is Association FATA, a non-profit organization as per the law of July 1st, 1901 and the decree of August 16, 1901, headquartered at 45 rue Belgrand – 75020 Paris FRANCE. You may contact Association FATA:

• by email: dpo@fata.school

Art. 2: Has Association FATA designated a DPO?

The Association has designated a Data Protection Officer (or DPO) in charge of all problems pertaining to personal data protection within Association FATA.

Find below contact information of our DPO:

• by email: dpo@fata.school

Art. 3: What personal data is processed by Association FATA and when is it collected?

In accordance with applicable law, we only collect adequate, pertinent and non-excessive personal data in scope of the purposes for which they are collected.

The nature of the collected personal data varies according to your profile and the requested services.

In all cases, we will inform you that we will collect personal data concerning you by indicating at least the identity of the DPO, the objectives and your rights on your personal data.

For example, when you apply to FATA.school on the site https://fata.school, we are susceptible to collect the following personal data:

• Email
• First name
• Last name
• Date and place of birth
• Postal address
• Gender
• Nationality
• Phone number
• Emergency contact information (phone number, last name, first name, affiliation)
• Incident tickets
• Test results

In addition to personal data that you directly communicate to us, we are also susceptible to collect personal data without direct communication from you. This is the case when you browse our sites on which your IP address is automatically collected for the security of our services and the infrastructure of the site.

In order to optimize the performance of our sites, we host a sentry server in charge of collecting bug reports of our site fata.school. This tool is susceptible to collect the following personal data in case of a bug:

• Browser used
• Device used
• IP address
• Browsing data

In addition, on site fata.school we use the tool FATHOM ANALYTICS published by the Conva Venture Inc. company that collect the following data on the user in a passive way:

• Browser used
• Device used
• IP address
• Browsing data

You can get more information on the cookies we use in article 7 of the present document.

Art. 4: For what reasons Association FATA processes my personal data?

All personal data processed are collected for determined, explicit and legitimate purposes and will not be subject to further processing which is not compatible with these purposes.

The purposes of processing are the objectives sought by the controller while collecting personal data.

These purposes vary according to the relevant processing.

For example, when we collect your email address during registration, the purpose is to be able to contact you for your registration or your curriculum. Unless agreed upon beforehand, we will never use this email address to send you newsletters by email in the future, because this purpose is incompatible with the initial purpose.

When we process your projects or your school results, the purpose of this processing is the follow-up of your educational path.

In addition, at the end of the retention period of your data (see article 9), we are susceptible to use your anonymized personal data for statistical purposes.

We will never process your personal data for other purposes without informing you beforehand and, possibly, asking for your consent.

Art. 5: What are the legal foundations of processing my personal data?

Regulation demands that any processing of personal data must rest on a legal foundation. It is the existence of a legal foundation that will condition the lawfulness of personal data processing.

Regulation predicts several legal foundations to justify the processing of personal data, such as the consent of the subject, the necessity of processing for contractual execution or the respect of a legal obligation.

Processing your personal data rests on the following foundations:

• The necessity of processing for the execution of the contract between you and Association FATA or relevant pre-contract measures;
• Respect a legal obligation;
• Your expressed and prior consent;
• The existence of a legitimate interest of Association FATA.

The legal foundation of processing your personal data varies with the processing at stake.

Art. 6: Am I obligated to give my personal data?

In general, we will never force you to communicate your personal data.

However, communication of certain personal data is necessary for the service we offer.

This data can be identified by the presence of an asterisk “*”.

If you do not wish to communicate this essential data, we cannot guarantee access to the services offered.

Art. 7: How do I manage my preferences in terms of cookies?

On our website fata.school we use a session cookie to keep your session open and to prevent security breaches (csrf breach). This session cookie is deleted when you log out of the site.

A cookie is a small text file put on the hard disk of the user by the site server or by a third party server.

Art. 8: How long will my personal data be retained?

We are committed to retain your personal data only for the period necessary for the purposes of the relevant processing.

This retention period will necessarily vary with the type of data and processing at hand.

Some legal dispositions also force us to retain your personal data for a minimum duration.

At the end of this period, unless you indicated otherwise, we will delete your personal data or anonymize it for statistics purposes.

Art. 9: Is my personal data secure?

We take the security of your personal data seriously. This is why we have adopted internal measures to ensure as much as possible the integrity and privacy of your data, such as:

• Setting up a strict policy in terms of creation and renewal of passwords granting access to your personal data;
• Access to personal data restricted to the individuals directly concerned by the purpose of processing;
• Use of firewalls and secured connections;
• Encryption of your password;
• Security of access to our offices (video surveillance, access control, etc.)

If you wish to obtain more information on the security measures of Association FATA to protect your personal data, you can send a request to the following address: dpo@fata.school.

Art. 10: Where is my personal data stored?

Your personal data is mostly stored in the databases located inside the European Union.

However, because Association FATA is part of an international network of establishments in various countries, some of your personal data can be transferred to countries located outside the European Union.

At any moment, you can ask Association FATA how the transfers of personal data outside the European Union are supervised and consult the documents relevant to the above guarantees by sending your request to: dpo@fata.school.

Furthermore, as elaborated below, we strictly supervise the communication of your personal data to our service providers to ensure its integrity and privacy.

Art. 11: With who does Association FATA share my personal data?

The personal data that we collect can be shared with third party companies in the following cases:

• When we use a third party service provider for a process purpose; for example, when paying online, the bank data is used on the site of the service provider in a secure way.
• If the law demands it, we can transfer data to meet the claims presented against us and conform to the obligations of administrative and legal procedures;
• If Association FATA is part of a fusion, acquisition, disposal of assets or a judicial redress, we may have to dispose of part or all of our assets, including personal data. In that case, you will be informed before the personal data is transferred to a third party.

In all cases, we commit to:

• Transfer your personal data only when it is necessary for the purpose of the processing;
• Transfer your personal data only to service providers that have sufficient guarantees in terms of personal data protection;
• Strictly supervise the personal data processing performed by our service providers for us;
• Never sell your personal data to third parties.

Art. 12: Who are the recipients of my personal data?

A recipient is defined as any individual authorized to obtain data because of his/her role.

The recipients of your personal data are:

• The teaching staff of Association FATA;
• The IT staff of Association FATA;
• The administrative staff of Association FATA;
• The teaching, IT and administrative staff of our partner campuses.

Art. 13: What are my rights with respect to my personal data?

Because of our activity, we perform various processing of your personal data. However, you remain the master of your data and how it is used.

This is why you have the following rights for your personal data:

• You can access all the personal data processed by Association FATA;
• You can update or ask for the erasure of your personal data;
• You can object the processing of your personal data;
• You can withdraw your consent at any time;
• You can request the communication in interoperable format of all your personal data processed by Association FATA to exercise your right of data portability.

If you wish to exercise your rights, send your request to the following address:

• By email: dpo@fata.school

When dealing with your request, we may ask for credentials to verify its accuracy.

In all cases, we commit to give you an answer within one month, with an eventual delay depending on the complexity and number of requests.

Lastly, in case of dispute concerning the processing of your personal data, you may file a claim with a competent authority. In France, this institution is the “Commission Nationale Informatique et Libertés” (CNIL): www.cnil.fr.

Art. 14: Evolution of the present Privacy Policy

Association FATA has the right to modify the present privacy policy at any moment. If the present Privacy Policy is modified, we commit to publish the new version on our website. The date of the last update of the present Privacy Policy will always be mentioned at the end of the present document.

We will inform you of any modification by email, and if possible before it takes effect. If you do not agree with the new terms, you have the possibility to ask for the erasure of your personal data.

Last updated: April 21st, 2023