The goal of the present Privacy Policy is to inform you on the way Association 42 processes your personal data and to enable you to exercise your rights on that data.

In order to have a clear vision on the whole processing of your personal data done by Association 42, we invite you to take a few minutes and read this document entirely.

If you simply want to have a global vision on the various processing of your personal data by Association 42 and their main characteristics, we have created below a table containing the list of processing of your personal data.

For any question or comment pertaining to our Privacy Policy, you can send an email to the following address: privacy@42.fr

PROCESSING	OBJECTIVES	RELEVANT DATA	LEGAL BASIS	RETENTION PERIOD	RECIPIENTS
Registration of students	Application management in 42 Admission tests managements in 42 Registration management in 42 Creating statistics	ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results	Contract execution Legal obligation Legitimate interests (retention of emergency contact in case of incident)	3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed	Teaching staff Administrative staff IT staff
Student management	Educational follow-up of students Administrative management of students Evaluation of students Emails sent within the school framework	ID data, social security number, contact information, school work, school results	Contract execution Legal obligation	3 years starting at the last connection to the intranet	Teaching staff Administrative staff IT staff
Internships management	Educational follow-up of students Administrative management of students Evaluation of students Emails sent within the internships framework	ID data and contact information of internships managers	Contract execution Legitimate interests	3 years starting at the last connection to the intranet	Teaching staff Administrative staff IT staff
Payment management	Management of payments for food within 42 and payment of social security	Email address, credit card encrypted data, data relevant to transaction	Contract execution Legitimate interests (retention of transaction data in case of complaint)	1 month starting on the payment date	Technical staff
Event management	Management of events organized within 42 Management of publications on the site events.42.fr	ID data, contact information, information pertaining to the events	Contract execution Legitimate interests (organization and security of events)	1 year starting on the event request date	Teaching staff Administrative staff
Video management	Management of videos put online on the site tv.42.fr	ID data, contact information, information pertaining to the videos	Contract execution Legitimate interests (content moderation)	3 years starting at the last connection to the intranet	Students Teaching staff Administrative staff
Connection management	Attribution and management of access rights Management of registration on the websites of 42 Management of identifications on the websites of 42 Management of intranet connections of 42	IP address, connection logs	Contract execution Legitimate interests (platform security)	1 year	IT staff
Management of job postings	Management of job postings published on the intranet of 42	ID data, contact information, Resume	Contract execution Legitimate interests (job search support)	3 years starting at the last connection to the intranet	Teaching staff Company relations staff
Legal declarations	Management of legal declarations to Social security organizations	ID data, social security number	Legal obligation	3 years starting at the last connection to the intranet	Social security organizations
Management of labels	Sending documents to the Economy and Finance Department for obtaining the "Grande école du Numérique" label	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	Legitimate interests (obtaining the relevant label)	3 years starting at the last connection to the intranet	Grande École du Numérique Teaching staff Administrative staff
Management of alumni	Surveys and statistics on integration rates of graduates Management of alumni requests Activities of the alumni network	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	Contract execution Legitimate interests (production of statistics and request management)	3 years starting at the last connection to the intranet	Teaching staff Administrative staff
Teaching tools	Providing students with teaching tools Management of teaching tools	ID data, contact information, account identification,work done within 42	Contract execution	3 years starting at the last connection to the intranet	Students Teaching staff IT staff
Management of requests to exercise rights	Processing requests to exercise rights of subjects pertaining to their personal data and providing and adequate answer	ID data, contact information, credentials, personal data pertaining to the request	Legal obligation	4 months after the closure of the case	Data Protection Officer
Audience measurement	Analysis of visits of the sites candidature.42.fr and admissions.42.us.org Optimization of sites candidature.42.fr and admissions.42.us.org	IP address, browser used, browsing data	Consent	13 months	Teaching staff Administrative staff IT staff
Management of contact requests	Processing requests sent to Association 42 via the contact form Processing requests sent to Association 42 Providing an adequate answer	Contact information	Contract execution Legitimate interests (answer to a given question)	4 months after the closure of the case	Teaching staff Administrative staff IT staff
Site security	Security of sites and respect of legal obligations	IP addresses, connection logs	Contract execution Legitimate interests (platform security) Legal obligation	1 year	IT staff
Video surveillance	Ensuring the security of individuals and goods present in 42	Images coming from video surveillance equipment	Legitimate interests (Ensuring the security of individuals and goods)	15 days	Security staff, maintenance staffEnforcement officers
Access control to 42	Ensuring the security of individuals and goods present in 42	Email, company, last name, first name, badge number, badge pin code	Legitimate interests (Ensuring the security of individuals and goods)	3 years starting at the last connection to the intranet	Security staff, maintenance staffEnforcement officers
Secure access to 42	Ensuring the security of sites, individuals and goods present in 42	IP addresses, connection logs, date and time of access, door opened	Legitimate interests (Ensuring the security of individuals, goods and platforms)	3 months	Security staff, maintenance staff

SUMMARY

1. Who is in charge of processing my personal data?
2. Has Association 42 designated a DPO?
3. What personal data is processed by Association 42 and when is it collected?
4. For what reasons Association 42 processes my personal data?
5. What are the legal foundations for processing my personal data?
6. Am I obligated to give my personal data?
7. How do I manage my preferences in terms of cookies?
8. Am I susceptible to be the object of an automated decision?
9. How long is my personal data retained?
10. Is my personal data secure?
11. Where is my personal data stored?
12. With who does Association 42 share my personal data?
13. Who are the recipients of my personal data?
14. What are my rights with respect to my personal data?
15. Evolution of the present privacy policy

1. Who is in charge of processing my personal data?

The controller of processing is the entity that defines the objectives (why?) and the means (how?) of processing your personal data.

The controller of processing your personal data is Association 42, a non-profit organization as per the law of July 1st, 1901 and the decree of August 16, 1901, headquartered at 96 boulevard Bessières - 75017 Paris FRANCE. You may contact Association 42:

• by email:
  dpo@42.fr

• by post:
  Data protection officer
  Association 42
  96 boulevard Bessières
  75017 Paris
  FRANCE

2. Has Association 42 designated a DPO?

The Association has designated a Data Protection Officer (or DPO) in charge of all problems pertaining to personal data protection within Association 42.

Find below contact information of our DPO:

• by email:
  dpo@42.fr

• by post: Data Protection Officer
  Association 42
  96 boulevard Bessières
  75017 Paris
  FRANCE

3. What personal data is processed by Association 42 and when is it collected?

In accordance with applicable law, we only collect adequate, pertinent and non-excessive personal data in scope of the purposes for which they are collected.

The nature of the collected personal data varies according to your profile and the requested services.

In all cases, we will inform you that we will collect personal data concerning you by indicating at least the identity of the DPO, the objectives and your rights on your personal data.

For example, when you apply to 42 on the site candidature.42.fr, we are susceptible to collect the following personal data:

• Email
• First name
• Last name
• Date and place of birth
• Postal address
• Sex
• Nationality
• Phone number
• Emergency contact information (phone number, last name, first name, affiliation)
• Incident tickets
• Test results

In addition to personal data that you directly communicate to us, we are also susceptible to collect personal data without direct communication from you. This is the case when you browse our sites candidature.42.fr, admissions.42.us.org, intra.42.fr, adm.42.fr, events.42.fr, steakoverflow.42.fr, tv.42.fr and voxotron.42.fr, on which your IP address is automatically collected for the security of our services and the infrastructure of the site.

In order to optimize the performance of our sites, we host a sentry server in charge of collecting bug reports of our site intra.42.fr. This tool is susceptible to collect the following personal data in case of a bug:

• Browser used
• Device used
• IP address
• Browsing data

In addition, on sites candidature.42.fr and admissions.42.us.org we use the GOOGLE ANALYTICS tools published by the GOOGLE LLC company that collect the following data on the user in a passive way:

• Browser used
• Device used
• IP address
• Browsing data

You can get more information on the cookies we use in article 7 of the present document.

4. For what reasons Association 42 processes my personal data?

All personal data processed are collected for determined, explicit and legitimate purposes and will not be subject to further processing which is not compatible with these purposes.

The purposes of processing are the objectives sought by the controller while collecting personal data.

These purposes vary according to the relevant processing.

For example, when we collect your email address during registration, the purpose is to be able to contact you for your registration or your curriculum. Unless agreed upon beforehand, we will never use this email address to send you newsletters by email in the future, because this purpose is incompatible with the initial purpose.

When we process your projects or your school results, the purpose of this processing is the follow-up of your educational path.

In general, we collect and process your personal data for the following purposes:

• Applications to 42;
• Admission tests in 42;
• Registration to 42;
• Making statistics;
• Educational follow-up of students;
• Administrative management of students;
• Evaluation of students;
• Management of emails addressed within the school framework;
• Management of food payments within 42 and social security payments;
• Management of events organized within 42;
• Management of publications on the site events.42.fr;
• Management of videos put online on the site tv.42.fr;
• Attribution and management of access rights;
• Management of applications on the websites of 42;
• Management of identifications on the websites of 42;
• Management of connections via the intranet of 42;
• Management of job postings published on the intranet of 42;
• Management of legal declarations to Social Security organizations;
• Sending information to the Economy and Finance Department for obtaining the label "Grande école du Numérique";
• Surveys and statistics on the integration rate of graduates;
• Management of alumni requests;
• Activities of the alumni network;
• Giving teaching tools to students;
• Management of teaching tools;
• Process requests to exercise rights by individuals on their personal data and providing adequate answers;
• Analysis of visits on the sites candidature.42.fr and admissions.42.us.org;
• Optimization of sites candidature.42.fr and admissions.42.us.org;
• Process requests sent to Association 42 via the contact form;
• Process information requests sent to Association 42;
• Provide an adequate answer to contact requests;
• Security of sites and respect of legal obligations;
• Ensure the security of individuals and goods present in 42.

In addition, at the end of the retention period of your data (see article 9), we are susceptible to use your anonymized personal data for statistical purposes.

We will never process your personal data for other purposes without informing you beforehand and, possibly, asking for your consent.

5. What are the legal foundations of processing my personal data?

Regulation demands that any processing of personal data must rest on a legal foundation. It is the existence of a legal foundation that will condition the lawfulness of personal data processing.

Regulation predicts several legal foundations to justify the processing of personal data, such as the consent of the subject, the necessity of processing for contractual execution or the respect of a legal obligation.

At 42, processing your personal data rests on the following foundations:

• The necessity of processing for the execution of the contract between you and Association 42 or relevant pre-contract measures;
• Respect a a legal obligation;
• Your expressed and prior consent;
• The existence of a legitimate interest of Association 42.

The legal foundation of processing your personal data varies with the processing at stake.

For example, the processing of your email address in order to contact you is necessary for the execution of the contract made with Association 42, whereas the video surveillance used inside 42 rests on the legitimate interest of Association 42 in ensuring the security of individuals and goods. To know the legal basis for each personal data processing done by Association 42, please consult the list in the introduction of the present document.

6. Am I obligated to give my personal data?

In general, we will never force you to communicate your personal data.

However, communication of certain personal data is necessary for the service we offer.

This data can be identified by the presence of an asterisk "*".

If you do not wish to communicate this essential data, we cannot guarantee access to the services offered.

7. How do I manage my preferences in terms of cookies?

On our websites candidature.42.fr and admissions.42.us.org we use cookies to measure the audience of our sites.

A cookie is a small text file put on the hard disk of the user by the site server or by a third party server.

We will never use cookies for audience measurement without your consent. You have the possibility to activate or deactivate these cookies by clicking the "cookies policy" tab on the relevant sites.

If you wish to find more information on this subject, you can access the list of legal documents on this page then select the article concerning Cookies.

8. Am I susceptible to be the object of an automated decision?

An automated decision can be defined by a decision on an individual by way of algorithms applied to his personal data, without any human interference in the process.

When you apply for 42 using our website candidature.42.fr, some of your personal data can be used automatically by an algorithm to validate the various tests accomplished.

As such, we use a first algorithm to validate the logic and memory scores of candidates so that they can continue the application process.

Candidates that have failed these tests cannot continue the application process.

We also use a second algorithm after the "piscine" (pool) periods to determine the possible candidates that can be admitted to 42.

Candidates that have failed these tests cannot continue the application process.

In certain specific cases, after these tests, the teaching team can meet to make a definitive decision on a candidate.

You can obtain more information on the algorithms used to validate the above application test as well as their underlying logic below:

• The algorithm of games on the platform candidature.42.fr evaluates the levels achieved on various games to determine if the candidate has shown enough competence to go further in the selection process. It is based only on the test results and simply evaluates the levels achieved.
• The selection algorithm at the end of the "piscine" is based on several criteria such as, for example, competence, motivation and engagement shown by the candidate. Candidates that have reached the minimum prerequisites defined by the algorithm are simply admitted.

9. How long will my personal data be retained?

We are committed to retain your personal data only for the period necessary for the purposes of the relevant processing.

This retention period will necessarily vary with the type of data and processing at hand.

Some legal dispositions also force us to retain your personal data for a minimum duration.

Below, you will find, for each processing, the retention period of the data.

At the end of this period, unless you indicated otherwise, we will delete your personal data or anonymize it for statistics purposes.

Processing	Data types	Retention period
Management of admission tests in 42	ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results	3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Management of registration of 42	ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results	3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Production of statistics	Test results	3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Educational follow-up of students	ID data, contact information, schoolwork, school results	3 years starting at the last connection to the intranet
Administrative student management	ID data, social security number, contact information	3 years starting at the last student's connection to the intranet
Student evaluation	Contact information, schoolwork, test results	3 years starting at the last connection to the intranet
Management of emails sent in the school framework	Contact information	3 years starting at the last connection to the intranet
Management of emails sent in the internships framework	ID data and contact information in the company for internships management	3 years starting at the last connection to the intranet
Management of food payments within 42	Email address, credit card encrypted data, data relevant to transaction	1 month starting at payment
Management of social security payments within 42	Email address, credit card encrypted data, data relevant to transaction	1 month starting at payment
Management of events within 42	ID data, contact information, information pertaining to the events	1 year starting at the event request
Management of publications on the site events.42.fr	ID data, contact information, information pertaining to the events	1 year starting at the event request
Management of online videos on the site tv.42.fr	ID data, contact information, information pertaining to the video	3 years starting at the last connection to the intranet
Attribution and management of access rights	IP, connection logs	1 year
Management of registrations on the websites of 42	IP, connection logs	1 year
Management of identifications on the websites of 42	IP, connection logs	1 year
Management of connections via the intranet of 42	IP, connection logs	1 year
Management of job postings published on the intranet of 42	ID data, contact information, Resume	3 years starting at the last connection to the intranet
Management of legal declarations to Social Security organizations	ID data, social security number	3 years starting at the last connection to the intranet
Sending documents to the Economy and Finance Department for obtaining the "Grande école du Numérique" label	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	3 years starting at the last connection to the intranet
Surveys and statistics on the integration rate of graduates	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	3 years starting at the last connection to the intranet
Management of alumni requests	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	3 years starting at the last connection to the intranet
Management of alumni network	Statistics on entrance and exit volumes, prior diplomas of students, social and economic features	3 years starting at the last connection to the intranet
Providing students with teaching tools	ID data, contact information, account identification,work done within 42	3 years starting at the last connection to the intranet
Management of teaching tools	ID data, contact information, account identification,work done within 42	3 years starting at the last connection to the intranet
Processing requests to exercise rights of subjects pertaining to their personal data and providing an adequate answer	ID data, contact information, credentials, personal data pertaining to the request	4 months after the closure of the case
Analysis of visits to the sites candidature.42.fr and admissions.42.us.org	IP address, browser used, device used, browsing data	13 months
Optimization of sites candidature.42.fr and admissions.42.us.org	IP address, browser used, device used, browsing data	13 months
Processing requests sent to Association 42 via the contact form	Contact information	4 months after the closure of the case
Processing information requests sent to Association 42	Contact information	4 months after the closure of the case
Provide an adequate answer to contact requests	Contact information	4 months after the closure of the case
Site security and respect of legal obligations	IP addresses, connection logs	1 year
Ensuring the security of individuals and goods present in 42	Images from the video surveillance system, email, company, last name, first name, badge number, badge code pin, connection logs, date and time of access, door accessed	15 days for video surveillance, 1 year starting at the last connection to the intranet, contact and badge information, 3 months for access control logs

10. Is my personal data secure?

We take the security of your personal data seriously. This is why we have adopted internal measures to ensure as much as possible the integrity and privacy of your data, such as:

• Setting up a strict policy in terms of creation and renewal of passwords granting access to your personal data;
• Access to personal data restricted to the individuals directly concerned by the purpose of processing;
• Use of firewalls and secured connections;
• Encryption of your password;
• Security of access to our offices (video surveillance, access control, etc.)

If you wish to obtain more information on the security measures of Association 42 to protect your personal data, you can send a request to the following address: dpo@42.fr.

11. Where is my personal data stored?

Your personal data is mostly stored in the databases located inside the European Union.

However, because Association 42 is part of an international network of establishments in various countries, some of your personal data can be transferred to countries located outside the European Union.

This is notably the case of personal data collected on our site admissions.42.us.org dedicated to our partner establishment in the United States, and this data is stored by necessity in the United States.

This is also the case concerning personal data collected on the internal site of 42 intra.42.fr, which is accessible from all campuses of Association 42, namely:

• USA
• Russia
• Ukraine
• Moldavia
• Morocco
• South Africa

In those cases, we guarantee that these transfers are destined to countries ensuring a protection level equivalent to that of the European Union or constrained by restriction tools that can meet the demands of applicable regulations.

These guarantees can be constraining company rules, standard contractual clauses, adoption of a code of conduct or a certification.

At any moment, you can ask Association 42 how the transfers of personal data outside the European Union are supervised and consult the documents relevant to the above guarantees by sending your request to: dpo@42.fr.

Furthermore, as elaborated below, we strictly supervise the communication of your personal data to our service providers to ensure its integrity and privacy.

12. With who does Association 42 share my personal data?

The personal data that we collect can be shared with third party companies in the following cases:

• When we use a third party service provider for a process purpose; for example, when paying via 42.frto buy food, the bank data is used on the site of the service provider in a secure way.
• If the law demands it, we can transfer data to meet the claims presented against us and conform to the obligations of administrative and legal procedures;
• If Association 42 is part of a fusion, acquisition, disposal of assets or a judicial redress, we may have to dispose of part or all of our assets, including personal data. In that case, you will be informed before the personal data is transferred to a third party.

In all cases, we commit to:

• Transfer your personal data only when it is necessary for the purpose of the processing;
• Transfer your personal data only to service providers that have sufficient guarantees in terms of personal data protection;
• Strictly supervise the personal data processing performed by our service providers for us;
• Never sell your personal data to third parties.

13. Who are the recipients of my personal data?

A recipient is defined as any individual authorized to obtain data because of his/her role.

The recipients of your personal data are:

• The teaching staff of Association 42;
• The IT staff of Association 42;
• The administrative staff of Association 42;
• The teaching, IT and administrative staff of our partner campuses.

14. What are my rights with respect to my personal data?

Because of our activity, we perform various processing of your personal data. However, you remain the master of your data and how it is used.

This is why you have the following rights for your personal data:

• You can access all the personal data processed by Association 42;
• You can update or ask for the erasure of your personal data;
• You can object the processing of your personal data;
• You can withdraw your consent at any time;
• You can request the communication in interoperable format of all your personal data processed by Association 42 to exercise your right of data portability.

If you wish to exercise your rights, send your request to the following address:

• By email:
  privacy@42.fr

• By post:
  Association 42
  96 boulevard Bessières
  75017 Paris
  FRANCE

When dealing with your request, we may ask for credentials to verify its accuracy.

In all cases, we commit to give you an answer within one month, with an eventual delay depending on the complexity and number of requests.

Lastly, in case of dispute concerning the processing of your personal data, you may file a claim with a competent authority. In France, this institution is the "Commission Nationale Informatique et Libertés" (CNIL): www.cnil.fr.

15. Evolution of the present Privacy Policy

Association 42 has the right to modify the present privacy policy at any moment. If the present Privacy Policy is modified, we commit to publish the new version on our website. The date of the last update of the present Privacy Policy will always be mentioned at the end of the present document.

We will inform you of any modification by email, and if possible before it takes effect. If you do not agree with the new terms, you have the possibility to ask for the erasure of your personal data.