Privacy Policy

1. Who is the Data Controller?

2. What personal data is collected?

As part of our Spanish language training activities, we collect and process the following categories of personal data:

For trainees (individuals and companies):

• Identification data: surname, first name, date of birth, nationality.
• Contact data: postal address, email, phone number.
• Academic data: language level, test results, attendance, evaluations, educational progress, diplomas obtained.
• Financial data: payment methods, invoices, CPF information.
• Professional data: employer, job title, OPCO (if applicable).
• Health data: only if necessary for educational adaptation related to a disability (based on explicit consent).
• Image data: photographs and videos taken during classes or events (based on consent).

For other profiles:

• Parents/Legal guardians (for minors): identification and contact data.
• Job applicants: CV, cover letter, diplomas, professional experience.
• Business contacts: surname, first name, email, phone number, company.

3. Why do we collect your data? (Purposes)

• Registration and training path management: processing inquiries, educational organization, evaluation, and issuance of certificates.
• Administrative and accounting management: billing, payment collection, funding management (CPF, OPCO), and compliance with legal obligations.
• Service improvement: satisfaction surveys and anonymized statistical analysis.
• Communication: sending information about our training courses (with prior consent) and social media management.
• Recruitment: processing spontaneous applications.
• Accessibility: adapting educational conditions for people with disabilities.

4. What is the legal basis for processing?

We process your personal data based on the following legal grounds:

Important: You can withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

5. Mandatory or Optional Nature

Mandatory data: Data marked with an asterisk (*) in our forms are mandatory for processing your registration. Failure to provide them will prevent us from processing your request.

Optional data: Other data (e.g., photographs, commercial communications) are collected optionally. Refusal to provide them does not prevent access to our training courses.

6. Who are the recipients of your data?

• Internally: The authorized educational and administrative staff of ELE USAL Strasbourg.
• Partners and Institutions: Universidad de Salamanca (diploma issuance), Instituto Cervantes (exams), funding bodies (OPCO, CPF), and control administrations (DREETS, Qualiopi auditors).
• Subcontractors: Web hosting provider, educational management tools, IT and secure payment providers (all subject to strict contractual obligations under Art. 28 of the GDPR).

Your data will never be transferred, rented, or sold to third parties for commercial purposes without your explicit prior consent.

7. Transfers Outside the European Union

Principle: Your data is hosted and processed within the European Union (France and Spain).

Exception: If certain tools used (e.g., cloud services) involve a data transfer outside the EU, we ensure that appropriate safeguards are strictly implemented in accordance with the GDPR (European Commission standard contractual clauses, adequacy decisions, etc.).

8. How long do we keep your data?

Archiving: After active periods, certain data may be securely archived with restricted access to meet legal, litigious, or historical obligations.

9. What are your rights?

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• Right of access (Art. 15): to obtain confirmation that your data is being processed and to access it.
• Right to rectification (Art. 16): to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): to request deletion (subject to legal retention obligations).
• Right to restriction of processing (Art. 18): to temporarily freeze the processing.
• Right to object (Art. 21): to object to processing (e.g., for commercial prospecting).
• Right to data portability (Art. 20): to receive your data in a structured, readable format.
• Post-mortem directives: to define instructions regarding your data after your death.

10. How to exercise your rights?

You can exercise your rights at any time by contacting us:

• By email: info@strasbourg-eleusal.com
• By mail: ELE USAL Strasbourg – 9 rue Saint-Aloïse, 67100 Strasbourg, France

Identity Verification: In accordance with CNIL recommendations, proof of identity will only be requested if there is reasonable doubt about your identity.

Response Time: We commit to responding within a maximum of one month from receipt (extendable by two months for complex requests).

11. Right to Complain to the CNIL

If you believe your rights have not been respected, you have the right to lodge a complaint with the French supervisory authority:

CNIL
3 Place de Fontenoy – TSA 80715
75334 Paris Cedex 07
Website: www.cnil.fr | Online complaints: www.cnil.fr/fr/plaintes

12. Data Security

ELE USAL Strasbourg implements appropriate technical measures (encryption, HTTPS/SSL, firewalls, secure backups) and organizational measures (restricted “need-to-know” access, staff awareness) to protect your data against any breach.

Paper documents are kept in secure cabinets and are physically destroyed in a confidential manner at the end of their retention cycle.

13. Cookies and Trackers

Our website uses cookies. To configure your choices, please consult our Cookie Policy.

14. Confidentiality and Modifications

All our staff members are bound by strict professional secrecy. We reserve the right to modify this privacy policy at any time to comply with legal or technological developments. Any updates will be posted on this page.