PRIVACY POLICY

In accordance with the General Data Protection Regulation (GDPR – EU 2016/679) and the French Data Protection Act (Informatique et Libertés).

Last updated : October 23, 2025.

1. WHO IS THE DATA CONTROLLER?

Data Controller :
INSTITUT DE LANGUE ESPAGNOLE ELE USAL STRASBOURG
Local law registered association (Bas-Rhin)
Registered office : 9 rue Saint-Aloïse, 67100 Strasbourg, France
SIRET : 812 275 733 00036
RNA : W671189640
NDA : 42 67 05560 67
Phone : +33 6 67 53 77 41
Email : info@strasbourg-eleusal.com
Legal representative : Mrs. Diana BRAVO MORENO (President)

Data Protection Officer (DPO) :
ELE USAL Strasbourg is not required to appoint a DPO under Article 37 of the GDPR. However, for any questions regarding the protection of your personal data, you may contact:
Email : info@strasbourg-eleusal.com
Contact : Mrs. Diana BRAVO MORENO.

2. WHAT PERSONAL DATA IS COLLECTED?

As part of our Spanish language training activities, we collect and process the following categories of personal data:

For learners (individuals and companies):

– Identification data : surname, first name, date of birth, nationality.

– Contact data : postal address, email, phone.

– Academic data : language level, placement test results, attendance, assessments, pedagogical progression, diplomas obtained.

– Financial data : payment methods, invoices, CPF information.

– Professional life data (if applicable) : employer, position, OPCO.

– Health data (only if necessary) : information relating to pedagogical adaptation needs for persons with disabilities (based on explicit consent).

– Image data : photographs and videos taken during classes or events (based on consent).

For parents/legal guardians (minors aged 16 to 18):

– Identification and contact data.

For job applicants:

– CV, cover letter, diplomas, professional experience.

For commercial contacts:

– Surname, first name, email, phone, company.

3. WHY DO WE COLLECT YOUR DATA? (PURPOSES)

Your personal data is collected and processed for the following purposes:

a) Registration and training path management

– Processing information requests.

– Registration and learner file creation.

– Organization and pedagogical monitoring of training courses.

– Assessment of skills and certificate issuance.

– Communication of results and progression.

b) Administrative and accounting management

– Invoicing and collection.

– Funding management (CPF, OPCO, employers).

– Legal and accounting obligations.

c) Service improvement

– Satisfaction surveys.

– Statistical analysis (anonymized) of our training courses.

d) Communication and marketing

– Sending information about our training courses and events (with prior consent).

– Management of our social networks.

e) Recruitment

– Processing of unsolicited applications.

f) Accessibility and disability

– Adaptation of pedagogical conditions for persons with disabilities.

4. WHAT IS THE LEGAL BASIS FOR PROCESSING?

We process your personal data based on the following legal grounds:

Important : You can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5. MANDATORY OR OPTIONAL NATURE OF COLLECTION

Mandatory data : Data marked with an asterisk (*) in our forms is mandatory for managing your registration and the proper conduct of your training. Otherwise, we will not be able to process your request.

Optional data : Other data may be collected optionally (e.g. photographs, commercial communications). Refusal does not prevent access to our training courses.

6. WHO ARE THE RECIPIENTS OF YOUR DATA?

Your personal data is intended for the following persons:

a) Authorized internal staff

– ELE USAL Strasbourg teaching and administrative team.

– Management and training managers.

b) Partner and institutional organizations

– Universidad de Salamanca (parent company – ESCUELAS DE LENGUA ESPAÑOLA DE LA UNIVERSIDAD DE SALAMANCA S.L.) for the issuance of certain diplomas.

– Instituto Cervantes for DELE and SIELE exams.

– Funders : OPCO, Caisse des Dépôts (CPF), employers.

– Administrations : DREETS (Direccte), tax services, Qualiopi control bodies.

c) Service providers and subcontractors

– Website host.

– Pedagogical and administrative management tools.

– IT providers (maintenance, backups).

– Secure payment providers.

– All our subcontractors are subject to strict contractual obligations regarding the protection and confidentiality of personal data (Article 28 GDPR).

d) Other recipients
Your data will not be sold, rented or sold to third parties for commercial purposes without your prior explicit consent.

7. IS YOUR DATA TRANSFERRED OUTSIDE THE EUROPEAN UNION?

Principle : Your data is hosted and processed in the European Union (France and Spain).

Exception : If certain tools used (e.g. cloud services) involve data transfer outside the EU, we ensure that appropriate safeguards are implemented in accordance with the GDPR (European Commission standard contractual clauses, adequacy decision, etc.).

8. HOW LONG DO WE KEEP YOUR DATA?

Retention periods are defined according to purposes and legal obligations:

Archiving : After active periods, certain data may be securely archived with restricted access to satisfy legal, contentious or historical obligations.

9. WHAT ARE YOUR RIGHTS?

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

a) Right of access (art. 15 GDPR)
Obtain confirmation that data concerning you is being processed and access that data.

b) Right of rectification (art. 16 GDPR)
Have inaccurate or incomplete data corrected.

c) Right to erasure / “right to be forgotten” (art. 17 GDPR)
Request deletion of your data under certain conditions (except legal retention obligations).

d) Right to restriction of processing (art. 18 GDPR)
Request temporary freezing of processing of your data.

e) Right to object (art. 21 GDPR)
Object to processing of your data for reasons related to your particular situation or for direct marketing purposes.

f) Right to portability (art. 20 GDPR)
Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.

g) Right to withdraw consent
For processing based on consent, you can withdraw it at any time.

h) Right to define post-mortem directives
Define directives regarding the fate of your data after your death.

10. HOW TO EXERCISE YOUR RIGHTS?

You can exercise your rights at any time by contacting us:

By email : info@strasbourg-eleusal.com
By mail : ELE USAL Strasbourg – 9 rue Saint-Aloïse, 67100 Strasbourg, France
Subject : Exercise of my GDPR rights

Documents to provide : For security reasons, we will ask you for a copy of a valid identity document.

Response time : We undertake to respond within a maximum period of one month from receipt of your request. This period may be extended by two months in case of complexity.

11. RIGHT TO LODGE A COMPLAINT WITH THE CNIL

If you believe your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority:

Commission Nationale de l’Informatique et des Libertés (CNIL)
3 Place de Fontenoy – TSA 80715
75334 Paris Cedex 07, France
Phone : +33 1 53 73 22 22
Website : https://www.cnil.fr
Online form : https://www.cnil.fr/fr/plaintes

12. DATA SECURITY

ELE USAL Strasbourg implements appropriate technical and organizational measures to guarantee a level of security adapted to the risk:

Technical measures:

– Encryption of sensitive data.

– Secure access through strong passwords and authentication.

– Regular and secure backups.

– Firewalls and up-to-date antivirus.

– HTTPS connections (SSL certificate).

Organizational measures:

– Limited data access based on “need to know”.

– Staff training and awareness.

– Confidentiality policy and internal procedures.

– Data breach management (CNIL notification within 72 hours if necessary).

Archiving and document destruction : Paper documents containing personal data are kept in secure cabinets. At the end of the retention period, they are securely destroyed (physical destruction or certified service provider).

13. COOKIES AND TRACKERS

Our website uses cookies and other trackers. For more information on their use, purposes, your right to object and settings, please consult our Cookie Policy accessible on the site.

14. CONFIDENTIALITY AND PROFESSIONAL SECRECY

ELE USAL Strasbourg and all its staff are bound by professional secrecy and an obligation of confidentiality regarding personal data they access in the course of their duties.

No disclosure or use of your data for purposes other than those provided for in this policy will be made without your prior consent, except legal obligation.

15. MODIFICATION OF THE PRIVACY POLICY

ELE USAL Strasbourg reserves the right to modify this Privacy Policy at any time, particularly to comply with any legislative, regulatory, case law or technological developments.

Any modification will be brought to users’ attention via our website. We invite you to consult this page regularly to be aware of any changes.

16. CONTACT

For any questions regarding the protection of your personal data or this privacy policy:

Email : info@strasbourg-eleusal.com
Phone : +33 6 67 53 77 41
Mail : ELE USAL Strasbourg – 9 rue Saint-Aloïse, 67100 Strasbourg, France

© 2025 Institut de Langue Espagnole ELE USAL Strasbourg