ENSTA Bretagne attaches great importance to your privacy. This privacy policy informs you about how we collect, use and disclose your personal data.
1. About this Privacy Policy
This Privacy Policy applies when you visit our website, access our services, or participate in our school's events (together referred to as the "Service(s)"). This Privacy Policy may be supplemented by additional items specified in all or part of a Service provided. ENSTA Bretagne, which owns or administers the Services, is the main controller of the personal information processed there.
When you access one of our Services, you may be asked to provide personal data by filling in registration forms: we indicate the types of personal data required. You may choose not to submit the requested data, but this may limit your access to the Service.
2. The data we collect
2.1. Collection of personal data
During your browsing, we may collect information from:
- Or the voluntary completion of certain form fields (e.g. contact, recruitment, etc.)
- Or certain actions that may or may not be linked to a tangible reality (e.g. taking the call for a lesson, recording absences, etc.)
- Either data resulting from your navigation on the sites by means of cookies: consultation of a web page, click on a link...
For more details, please consult the ENSTA Bretagne cookie management policy.
2.2 How we use your data:
Depending on how you interact with us and the Service, we use your personal data to:
- Provide, enable and manage your access to and use of the Service;
- Process and respond to a request;
- Provide technical support, a complementary service and thereby enable the Service to function properly and securely;
- Improve our events and Services;
- Offer personalised content and other customisations to make the Service more relevant to your academic background;
- Respond to your requests, research, comments and concerns;
- Identify usage patterns and develop data analysis, including for research, auditing, reporting;
- Comply with our legal obligations, resolve disputes and enforce our obligations.
3. Sharing your data
3.1. ENSTA Bretagne website
For forms or actions carried out: this information is exclusively intended for the processing of your request by ENSTA Bretagne.
3.2. MyENSTABretagne mobile application
The MyENSTABretagne mobile application is intended for students and teachers of ENSTA Bretagne. It allows users to consult their timetable. It also allows students to follow their grades and teachers to have a list of students in order to manage absences and lateness.
If you access the MyENSTABretagne application on the Service, your personal data may be shared with the publisher of that third-party application for maintenance purposes, subject to the terms of its licence agreement and privacy policy. In addition, the action of downloading the application, as well as relevant information about the user who downloads it, is recorded by the publisher for record keeping.
3.3. Third party application
If you access a third-party application on the Service your personal data may be shared with the publisher of that third-party application so that they can provide you with access to the application, subject to the terms of their licence agreement and privacy policy.
4. The purposes of the processing
When we collect or process your personal data in compliance with European data protection laws, we do so:
- as necessary to provide the Service;
- as necessary to comply with applicable law or any other legal obligation;
- as necessary to carry out a task in the public interest;
- where necessary with your consent.
Where we rely on your consent to process your personal data, you have the right to withdraw your consent at any time, and where we rely on legitimate interests, you have the right to object.
5. Retention of your personal data
We keep your personal data for as long as necessary to carry out our public service mission as a school and research centre, to satisfy the proper functioning of the school, to provide the Service or for other essential purposes such as compliance with our legal obligations, dispute resolution or maintaining security.
The duration of data retention is defined by ENSTA Bretagne with regard to the legal and contractual constraints on it and, failing that, according to its needs. For more information on the length of time personal data is kept, please consult our GDPR policy.
6. Locations of processing - transfer of personal data
Your personal data is stored and processed by ENSTA Bretagne. It is ENSTA Bretagne's responsibility to define and implement the technical security measures, physical or logical, that it deems appropriate to fight against the destruction, loss, alteration or unauthorised disclosure of data in an accidental or illicit manner.
In the event of the transfer of personal data to a country outside the European Union or to an international organisation, ENSTA Bretagne will inform the person concerned and ensure that their rights are respected. ENSTA Bretagne undertakes, if necessary, to sign one or more contracts to govern transborder data flows.
The provisions relating to flows outside the European Union are enforceable against ENSTA Bretagne, except in the derogatory cases provided for in Article 49 of the RGPD.
It is specified that the personal data collected by the MyENSTABretagne mobile application is not transferred outside the European Union.
7. Data security
We implement technical and organisational measures to ensure an appropriate level of security for the personal information we process. These measures aim to ensure the integrity, confidentiality and availability of personal information.
8. Protection of children's privacy
We do not knowingly collect information relating to children under the age of 14 and the ENSTA Bretagne website is not intended for children under the age of 14.
9. Access to your data and updates
9.1. Your rights
With a view to respecting the privacy of its users, ENSTA Bretagne undertakes to ensure that the collection and processing of personal information, carried out on the site and on the MyENSTABretagne application, is carried out in accordance with the French Data Protection Act, article 34. You therefore have the right to access, modify, rectify and delete data concerning you.
You may exercise this right at any time, either by sending your request to the following postal address ENSTA Bretagne, DPO, 2 rue François Verny in Brest (29 806), or by writing to dpo@ensta-bretagne.fr. The request must be accompanied by a photocopy of a valid identity document. In accordance with the law, your request will be processed within a maximum of 2 months following receipt. We remind you that abusive requests are punished by law.
10. Updates
We will update this privacy policy regularly. Any changes will be posted on this page with an updated revision date.
11. Processing of personal data
For more information on our processing of personal data in accordance with the applicable regulations, please consult our GDPR policy.
Updated: 9 May 2023
