PERSONAL DATA PROTECTION POLICY
Who are we and why do we want to process your personal data?
The non-profit association Rennes School of Business (Rennes SB) takes the protection of your personal data very seriously. We have clearly set out our commitments in this area in this Policy. You may also find a brief summary of the main points of this Policy in the other documents and applications that we make available to you.
Rennes SB is the data processing controller, and the purposes of the processing are indicated below.
Some of the situations described in this Policy may not apply to you, as the purpose of this document is to provide general information covering all of Rennes SB’s relationships (with students, alumni, external service providers, etc.).
Rennes SB has appointed a Data Protection Officer (DPO), whose postal and email addresses are as follows:
– DPO, Secrétariat Général, 2 Rue Robert d’Arbrissel, 35065 Rennes
– dpo@rennes-sb.com
Rennes SB needs to collect and process personal data when:
– the data are needed for the performance of a contract to which the data subject is a party, or
– the data are needed for the implementation of pre-contractual measures, or
– the data are needed to enable Rennes SB to comply with its regulatory obligations, or
– the data have been collected with the consent of the data subject, or
– the data are collected on grounds of Rennes SB’s legitimate interests (namely, the safety and security of individuals, premises and resources made available by the association and for promotion of the School).
When the processing of the data subject’s personal data is based on his or her consent, Rennes SB implements specific procedures to obtain consent.
Purpose
Legal basis
Selection of future Rennes SB students: management of entrance exams and assessment of applicants
The implementation of pre-contractual measures and our legitimate interests
Management of student programmes (undergraduate programmes, executive education, customised corporate programmes)
The implementation of contractual measures and our legitimate interests
Management of student examinations and assessments
The implementation of contractual measures and our legitimate interests
Management of internships and work-study programmes (apprenticeships / vocational training contracts)
The implementation of contractual measures
Management and monitoring of teaching positions
Our legitimate interests
Management of students’ specific needs (in particular as regards examinations and assessments)
Our legitimate interests or your consent when this is required by the regulations
Management of disciplinary measures
The implementation of contractual measures and our legitimate interests
Management of specific schemes (coaching, incubators, etc.)
Our legitimate interests
Management of contracts entered into with data subjects, including management and monitoring of invoices, payments and any disputes
The implementation of contractual measures
Management and monitoring of student grants
The implementation of contractual measures and our legitimate interests
Management and coordination of the alumni network
Our legitimate interests
Monitoring of registrations for alumni events and services
The implementation of contractual measures and our legitimate interests
Management of research, publications and chairs
The implementation of contractual measures and our legitimate interests
Rennes SB promotional and direct marketing initiatives
Our legitimate interests or your consent when this is required by the regulations
Management of browser data (cookies on websites published by Rennes SB)
Our legitimate interests or your consent when this is required by the regulations
Satisfaction surveys and questionnaires
Our legitimate interests or your consent when this is required by the regulations
Management of resources made available by Rennes SB (teaching rooms, projection equipment, etc.)
Our legitimate interests
Security of premises and safety of individuals
Our legitimate interests
Supervision of the use of IT resources made available by Rennes SB (including electronic messaging systems)
Our legitimate interests
Monitoring and management of collection of the “continued professional development tax” (taxe d’apprentissage) paid by businesses
Our legitimate interests and compliance with regulatory obligations
What data do we process?
Rennes SB collects most of its data directly from the data subjects. However, it may have received your data from a third party, including in particular:
– Partners specialising in student selection and the organisation of entrance exams, in the case of data concerning applicants for programmes and courses offered by Rennes SB;
– Foreign educational institutions, in the case of data concerning students on programmes/courses involving those institutions;
– Partners specialising in the recruitment of external job applicants (headhunters) or Rennes SB employees (cooptation), in the case of data concerning job applicants.
The categories of data processed vary according to the purpose for which they are processed. When your data are collected by Rennes SB in a questionnaire/form, we will always flag with an asterisk the essential (“mandatory”) data we need to collect, without which we will not be able to provide the corresponding service.
As a general rule, Rennes SB processes the following data:
– Information on your civil status and identity (last names, first names, date of birth, nationality, etc.),
– Your contact details (postal address, telephone, email),
– Information on your personal circumstances (civil status, etc.),
– Data concerning the payment of enrolment fees and payment defaults,
– Diplomas obtained,
– Languages spoken,
– Your academic data: timetables, internal and external programmes, diplomas, validation of prior experience, documents relating to tests and examinations, attendance sheets, etc.),
– Any specific needs (and disabilities), particularly with regard to examinations and assessments,
– Identification and login data for the IT resources made available by Rennes SB,
– The findings of non-anonymous surveys and questionnaires, testimonials,
– Disciplinary measures,
– Data concerning internships
– Any particular difficult circumstances that may entitle you to a grant
– etc.,
Who can access your personal data?
Personal data may be used by the following:
– Within Rennes SB: the Teaching and Learning Department, the Information Systems Department, the Brand and Digital Department, the General Secretary Department, security staff and reception desk staff;
– Foreign teaching institutions that are Rennes SB partners at which students also study;
– Rennes SB partners for contract management purposes, such as for example debt collection agencies;
– Rennes SB’s IT outsourcers, such as website hosting companies and IT maintenance service providers;
– Rennes SB’s technical subcontractors, such as mailing firms, partners involved in the organisation of Rennes SB events (such as galas), etc.
– Survey and statistics specialists (in particular relating to rankings of higher education institutions);
– The regional education authority and, more generally, any institution that operates under the authority of the French Ministry of National Education, in particular for the purpose of national surveys;
– Bodies that cover the full or partial cost of tuition fees, such as accredited continued professional development funds;
– The Rennes School of Business Alumni association;
– Rennes SB partners, for the management of Rennes SB’s academic accreditations;
– the European Commission, for management of grants awarded in connection with the Erasmus programme;
– Rennes SB partners that run student associations, clubs and other structures operating under the aegis of Rennes SB;
– Any judicial or administrative entities, so that Rennes SB can comply with its regulatory obligations.
In the event a data subject’s personal data are transferred outside of the European Union, Rennes SB will use one of the mechanisms offering appropriate safeguards provided for in the applicable regulations, including in particular the adoption of the standard contractual clauses issued by the European Commission. You may contact the Rennes SB Data Protection Officer to obtain further information on the foregoing, and copies of the relevant documents.
How long do we keep your data?
Personal data processed by Rennes SB is kept for the time period necessary for Rennes SB to comply with its statutory and contractual obligations, in compliance with the regulations on data protection and in accordance with statutory limitation periods. As a general rule, data are kept in compliance with circular no. 2005-003 of 22 February 2005 issued by the French Minister of National Education, Higher Education and Research.
For example:
– Data relating to students’ administrative and academic files are kept for ten years;
– Copies of exams and assessments are kept for one year after publication of the results, unless the results are disputed;
– Invoices are kept for ten years;
– Interns’ attendance sheets and copies of internship certificates are kept for five years;
– Data concerning the management of a disability are kept for the period of disability if this is less than the period of study or, otherwise, for the period of study;
– Data on payment defaults are kept until amicable settlement of the dispute or, failing that, until the limitation period for any legal action has expired;
– Data concerning contract management are kept for the term of the contract plus an additional five years;
– Direct marketing data are kept for three years after the last contact;
– Survey questionnaires are kept for five years and survey findings (summarised reports, charts, etc.) are kept for ten years.
What are your rights?
As a general rule:
– Any data subject shall have the right to request access to and rectification of his/her personal data.
– Any data subject shall have the right to request the restriction of processing of his/her personal data, (i) when the data subject contests the accuracy of his/her personal data, for a period enabling us to verify the accuracy of the data, (ii) when the data subject considers that our processing of his/her data is unlawful and requests the restriction of their use rather than their erasure, (iii) when we no longer need the personal data for the aforementioned purposes, but they are still required for the establishment, exercise or defence of legal claims, (iv) when the data subject has objected to processing pending the verification whether our legitimate grounds override those of the data subject.
– Any data subject shall have the right to request the erasure of his/her personal data. When a data subject requests erasure of his/her personal data, Rennes SB may nevertheless keep them in temporary files until such time as it has satisfied its statutory, accounting and tax obligations.
– Any data subject shall have the right to object to processing at any time, on grounds relating to his/her particular situation.
– Any data subject shall also have the right to object to the processing of data for direct marketing purposes, at any time and without any explanation.
– Any data subject shall have the right to exercise his/her right to data portability, which entitles the data subject to obtain a copy of his/her personal data or to transmit them to a third party in a structured, commonly used and machine-readable format.
– Any data subject shall have the right not to be subject to a decision based solely on automated processing, which produces legal effects concerning or significantly affecting the data subject.
– Any data subject shall have the right to withdraw his/her consent at any time.
– Any data subject shall also have the right to issue instructions concerning the retention, erasure and communication of his/her personal data after his/her death.
These rights may be exercised at any time by sending an email to dpo@rennes-sb.com or a letter to the following address: 2 Rue Robert d’Arbrissel, 35065 Rennes.
Any data subject shall always have the right to file a complaint with the French data protection authority (CNIL). You will find further information on the CNIL website: www.cnil.fr.
[1]Translated by Jackie McCorquodale-Dupont, a professional translator specializing in legal and business projects, and a sworn translator registered with the Douai Appeal Court. Tel. +33 ( 0)3 27 42 43 60. e-mail: jackiemcc@orange.fr.Please note that as this translation was delivered in electronic format it may have been modified once or more than once since my original translation. Every care is taken to ensure the accuracy of all translations. Liability is strictly limited to the amount invoiced for the translation. Personal data: personal data collected in connection with your order or in the course of translation are processed for the administrative management of your order and to translate your document(s). They will be kept for 5 years after the end of our business relationship. Please contact me if you wish to exercise your statutory rights with regard to your personal data.
