Privacy policy

The goal of the present Privacy Policy is to inform you on the way Association 42 processes your personal data and to enable you to exercise your rights on that data.

In order to have a clear vision on the whole processing of your personal data done by Association 42, we invite you to take a few minutes and read this document entirely.

If you simply want to have a global vision on the various processing of your personal data by Association 42 and their main characteristics, we have created below a table containing the list of processing of your personal data.

For any question or comment pertaining to our Privacy Policy, you can send an email to the following address: privacy@42.fr

PROCESSING OBJECTIVES RELEVANT DATA LEGAL BASIS RETENTION PERIOD RECIPIENTS
Registration of students Application management in 42 Admission tests managements in 42 Registration management in 42 Creating statistics ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results Contract execution Legal obligation Legitimate interests (retention of emergency contact in case of incident) 3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed Teaching staff Administrative staff IT staff
Student management Educational follow-up of students Administrative management of students Evaluation of students Emails sent within the school framework ID data, social security number, contact information, school work, school results Contract execution Legal obligation 3 years starting at the last connection to the intranet Teaching staff Administrative staff IT staff
Internships management Educational follow-up of students Administrative management of students Evaluation of students Emails sent within the internships framework ID data and contact information of internships managers Contract execution Legitimate interests 3 years starting at the last connection to the intranet Teaching staff Administrative staff IT staff
Payment management Management of payments for food within 42 and payment of social security Email address, credit card encrypted data, data relevant to transaction Contract execution Legitimate interests (retention of transaction data in case of complaint) 1 month starting on the payment date Technical staff
Event management Management of events organized within 42 Management of publications on the site events.42.fr ID data, contact information, information pertaining to the events Contract execution Legitimate interests (organization and security of events) 1 year starting on the event request date Teaching staff Administrative staff
Video management Management of videos put online on the site tv.42.fr ID data, contact information, information pertaining to the videos Contract execution Legitimate interests (content moderation) 3 years starting at the last connection to the intranet Students Teaching staff Administrative staff
Connection management Attribution and management of access rights Management of registration on the websites of 42 Management of identifications on the websites of 42 Management of intranet connections of 42 IP address, connection logs Contract execution Legitimate interests (platform security) 1 year IT staff
Management of job postings Management of job postings published on the intranet of 42 ID data, contact information, Resume Contract execution Legitimate interests (job search support) 3 years starting at the last connection to the intranet Teaching staff Company relations staff
Legal declarations Management of legal declarations to Social security organizations ID data, social security number Legal obligation 3 years starting at the last connection to the intranet Social security organizations
Management of labels Sending documents to the Economy and Finance Department for obtaining the "Grande école du Numérique" label Statistics on entrance and exit volumes, prior diplomas of students, social and economic features Legitimate interests (obtaining the relevant label) 3 years starting at the last connection to the intranet Grande École du Numérique Teaching staff Administrative staff
Management of alumni Surveys and statistics on integration rates of graduates Management of alumni requests Activities of the alumni network Statistics on entrance and exit volumes, prior diplomas of students, social and economic features Contract execution Legitimate interests (production of statistics and request management) 3 years starting at the last connection to the intranet Teaching staff Administrative staff
Teaching tools Providing students with teaching tools Management of teaching tools ID data, contact information, account identification,work done within 42 Contract execution 3 years starting at the last connection to the intranet Students Teaching staff IT staff
Management of requests to exercise rights Processing requests to exercise rights of subjects pertaining to their personal data and providing and adequate answer ID data, contact information, credentials, personal data pertaining to the request Legal obligation 4 months after the closure of the case Data Protection Officer
Audience measurement Analysis of visits of the sites candidature.42.fr and admissions.42.us.org Optimization of sites candidature.42.fr and admissions.42.us.org IP address, browser used, browsing data Consent 13 months Teaching staff Administrative staff IT staff
Management of contact requests Processing requests sent to Association 42 via the contact form Processing requests sent to Association 42 Providing an adequate answer Contact information Contract execution Legitimate interests (answer to a given question) 4 months after the closure of the case Teaching staff Administrative staff IT staff
Site security Security of sites and respect of legal obligations IP addresses, connection logs Contract execution Legitimate interests (platform security) Legal obligation 1 year IT staff
Video surveillance Ensuring the security of individuals and goods present in 42 Images coming from video surveillance equipment Legitimate interests (Ensuring the security of individuals and goods) 15 days Security staff, maintenance staffEnforcement officers
Access control to 42 Ensuring the security of individuals and goods present in 42 Email, company, last name, first name, badge number, badge pin code Legitimate interests (Ensuring the security of individuals and goods) 3 years starting at the last connection to the intranet Security staff, maintenance staffEnforcement officers
Secure access to 42 Ensuring the security of sites, individuals and goods present in 42 IP addresses, connection logs, date and time of access, door opened Legitimate interests (Ensuring the security of individuals, goods and platforms) 3 months Security staff, maintenance staff

SUMMARY

  1. Who is in charge of processing my personal data?
  2. Has Association 42 designated a DPO?
  3. What personal data is processed by Association 42 and when is it collected?
  4. For what reasons Association 42 processes my personal data?
  5. What are the legal foundations for processing my personal data?
  6. Am I obligated to give my personal data?
  7. How do I manage my preferences in terms of cookies?
  8. Am I susceptible to be the object of an automated decision?
  9. How long is my personal data retained?
  10. Is my personal data secure?
  11. Where is my personal data stored?
  12. With who does Association 42 share my personal data?
  13. Who are the recipients of my personal data?
  14. What are my rights with respect to my personal data?
  15. Evolution of the present privacy policy

1. Who is in charge of processing my personal data?

The controller of processing is the entity that defines the objectives (why?) and the means (how?) of processing your personal data.

The controller of processing your personal data is Association 42, a non-profit organization as per the law of July 1st, 1901 and the decree of August 16, 1901, headquartered at 96 boulevard Bessières - 75017 Paris FRANCE. You may contact Association 42:

2. Has Association 42 designated a DPO?

The Association has designated a Data Protection Officer (or DPO) in charge of all problems pertaining to personal data protection within Association 42.

Find below contact information of our DPO:

3. What personal data is processed by Association 42 and when is it collected?

In accordance with applicable law, we only collect adequate, pertinent and non-excessive personal data in scope of the purposes for which they are collected.

The nature of the collected personal data varies according to your profile and the requested services.

In all cases, we will inform you that we will collect personal data concerning you by indicating at least the identity of the DPO, the objectives and your rights on your personal data.

For example, when you apply to 42 on the site candidature.42.fr, we are susceptible to collect the following personal data:

In addition to personal data that you directly communicate to us, we are also susceptible to collect personal data without direct communication from you. This is the case when you browse our sites candidature.42.fr, admissions.42.us.org, intra.42.fr, adm.42.fr, events.42.fr, steakoverflow.42.fr, tv.42.fr and voxotron.42.fr, on which your IP address is automatically collected for the security of our services and the infrastructure of the site.

In order to optimize the performance of our sites, we host a sentry server in charge of collecting bug reports of our site intra.42.fr. This tool is susceptible to collect the following personal data in case of a bug:

In addition, on sites candidature.42.fr and admissions.42.us.org we use the GOOGLE ANALYTICS tools published by the GOOGLE LLC company that collect the following data on the user in a passive way:

You can get more information on the cookies we use in article 7 of the present document.

4. For what reasons Association 42 processes my personal data?

All personal data processed are collected for determined, explicit and legitimate purposes and will not be subject to further processing which is not compatible with these purposes.

The purposes of processing are the objectives sought by the controller while collecting personal data.

These purposes vary according to the relevant processing.

For example, when we collect your email address during registration, the purpose is to be able to contact you for your registration or your curriculum. Unless agreed upon beforehand, we will never use this email address to send you newsletters by email in the future, because this purpose is incompatible with the initial purpose.

When we process your projects or your school results, the purpose of this processing is the follow-up of your educational path.

In general, we collect and process your personal data for the following purposes:

In addition, at the end of the retention period of your data (see article 9), we are susceptible to use your anonymized personal data for statistical purposes.

We will never process your personal data for other purposes without informing you beforehand and, possibly, asking for your consent.

Regulation demands that any processing of personal data must rest on a legal foundation. It is the existence of a legal foundation that will condition the lawfulness of personal data processing.

Regulation predicts several legal foundations to justify the processing of personal data, such as the consent of the subject, the necessity of processing for contractual execution or the respect of a legal obligation.

At 42, processing your personal data rests on the following foundations:

The legal foundation of processing your personal data varies with the processing at stake.

For example, the processing of your email address in order to contact you is necessary for the execution of the contract made with Association 42, whereas the video surveillance used inside 42 rests on the legitimate interest of Association 42 in ensuring the security of individuals and goods. To know the legal basis for each personal data processing done by Association 42, please consult the list in the introduction of the present document.

6. Am I obligated to give my personal data?

In general, we will never force you to communicate your personal data.

However, communication of certain personal data is necessary for the service we offer.

This data can be identified by the presence of an asterisk "*".

If you do not wish to communicate this essential data, we cannot guarantee access to the services offered.

7. How do I manage my preferences in terms of cookies?

On our websites candidature.42.fr and admissions.42.us.org we use cookies to measure the audience of our sites.

A cookie is a small text file put on the hard disk of the user by the site server or by a third party server.

We will never use cookies for audience measurement without your consent. You have the possibility to activate or deactivate these cookies by clicking the "cookies policy" tab on the relevant sites.

If you wish to find more information on this subject, you can access the list of legal documents on this page then select the article concerning Cookies.

8. Am I susceptible to be the object of an automated decision?

An automated decision can be defined by a decision on an individual by way of algorithms applied to his personal data, without any human interference in the process.

When you apply for 42 using our website candidature.42.fr, some of your personal data can be used automatically by an algorithm to validate the various tests accomplished.

As such, we use a first algorithm to validate the logic and memory scores of candidates so that they can continue the application process.

Candidates that have failed these tests cannot continue the application process.

We also use a second algorithm after the "piscine" (pool) periods to determine the possible candidates that can be admitted to 42.

Candidates that have failed these tests cannot continue the application process.

In certain specific cases, after these tests, the teaching team can meet to make a definitive decision on a candidate.

You can obtain more information on the algorithms used to validate the above application test as well as their underlying logic below:

9. How long will my personal data be retained?

We are committed to retain your personal data only for the period necessary for the purposes of the relevant processing.

This retention period will necessarily vary with the type of data and processing at hand.

Some legal dispositions also force us to retain your personal data for a minimum duration.

Below, you will find, for each processing, the retention period of the data.

At the end of this period, unless you indicated otherwise, we will delete your personal data or anonymize it for statistics purposes.

Processing Data types Retention period
Management of admission tests in 42 ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results 3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Management of registration of 42 ID data (last name, first name, date and place of birth, etc.), contact information (email, phone), emergency contact, test results 3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Production of statistics Test results 3 years starting at the last connection to the application site or deleted weekly, every monday, in case the tests were failed
Educational follow-up of students ID data, contact information, schoolwork, school results 3 years starting at the last connection to the intranet
Administrative student management ID data, social security number, contact information 3 years starting at the last student's connection to the intranet
Student evaluation Contact information, schoolwork, test results 3 years starting at the last connection to the intranet
Management of emails sent in the school framework Contact information 3 years starting at the last connection to the intranet
Management of emails sent in the internships framework ID data and contact information in the company for internships management 3 years starting at the last connection to the intranet
Management of food payments within 42 Email address, credit card encrypted data, data relevant to transaction 1 month starting at payment
Management of social security payments within 42 Email address, credit card encrypted data, data relevant to transaction 1 month starting at payment
Management of events within 42 ID data, contact information, information pertaining to the events 1 year starting at the event request
Management of publications on the site events.42.fr ID data, contact information, information pertaining to the events 1 year starting at the event request
Management of online videos on the site tv.42.fr ID data, contact information, information pertaining to the video 3 years starting at the last connection to the intranet
Attribution and management of access rights IP, connection logs 1 year
Management of registrations on the websites of 42 IP, connection logs 1 year
Management of identifications on the websites of 42 IP, connection logs 1 year
Management of connections via the intranet of 42 IP, connection logs 1 year
Management of job postings published on the intranet of 42 ID data, contact information, Resume 3 years starting at the last connection to the intranet
Management of legal declarations to Social Security organizations ID data, social security number 3 years starting at the last connection to the intranet
Sending documents to the Economy and Finance Department for obtaining the "Grande école du Numérique" label Statistics on entrance and exit volumes, prior diplomas of students, social and economic features 3 years starting at the last connection to the intranet
Surveys and statistics on the integration rate of graduates Statistics on entrance and exit volumes, prior diplomas of students, social and economic features 3 years starting at the last connection to the intranet
Management of alumni requests Statistics on entrance and exit volumes, prior diplomas of students, social and economic features 3 years starting at the last connection to the intranet
Management of alumni network Statistics on entrance and exit volumes, prior diplomas of students, social and economic features 3 years starting at the last connection to the intranet
Providing students with teaching tools ID data, contact information, account identification,work done within 42 3 years starting at the last connection to the intranet
Management of teaching tools ID data, contact information, account identification,work done within 42 3 years starting at the last connection to the intranet
Processing requests to exercise rights of subjects pertaining to their personal data and providing an adequate answer ID data, contact information, credentials, personal data pertaining to the request 4 months after the closure of the case
Analysis of visits to the sites candidature.42.fr and admissions.42.us.org IP address, browser used, device used, browsing data 13 months
Optimization of sites candidature.42.fr and admissions.42.us.org IP address, browser used, device used, browsing data 13 months
Processing requests sent to Association 42 via the contact form Contact information 4 months after the closure of the case
Processing information requests sent to Association 42 Contact information 4 months after the closure of the case
Provide an adequate answer to contact requests Contact information 4 months after the closure of the case
Site security and respect of legal obligations IP addresses, connection logs 1 year
Ensuring the security of individuals and goods present in 42 Images from the video surveillance system, email, company, last name, first name, badge number, badge code pin, connection logs, date and time of access, door accessed 15 days for video surveillance, 1 year starting at the last connection to the intranet, contact and badge information, 3 months for access control logs

10. Is my personal data secure?

We take the security of your personal data seriously. This is why we have adopted internal measures to ensure as much as possible the integrity and privacy of your data, such as:

If you wish to obtain more information on the security measures of Association 42 to protect your personal data, you can send a request to the following address: dpo@42.fr.

11. Where is my personal data stored?

Your personal data is mostly stored in the databases located inside the European Union.

However, because Association 42 is part of an international network of establishments in various countries, some of your personal data can be transferred to countries located outside the European Union.

This is notably the case of personal data collected on our site admissions.42.us.org dedicated to our partner establishment in the United States, and this data is stored by necessity in the United States.

This is also the case concerning personal data collected on the internal site of 42 intra.42.fr, which is accessible from all campuses of Association 42, namely:

In those cases, we guarantee that these transfers are destined to countries ensuring a protection level equivalent to that of the European Union or constrained by restriction tools that can meet the demands of applicable regulations.

These guarantees can be constraining company rules, standard contractual clauses, adoption of a code of conduct or a certification.

At any moment, you can ask Association 42 how the transfers of personal data outside the European Union are supervised and consult the documents relevant to the above guarantees by sending your request to: dpo@42.fr.

Furthermore, as elaborated below, we strictly supervise the communication of your personal data to our service providers to ensure its integrity and privacy.

12. With who does Association 42 share my personal data?

The personal data that we collect can be shared with third party companies in the following cases:

In all cases, we commit to:

13. Who are the recipients of my personal data?

A recipient is defined as any individual authorized to obtain data because of his/her role.

The recipients of your personal data are:

14. What are my rights with respect to my personal data?

Because of our activity, we perform various processing of your personal data. However, you remain the master of your data and how it is used.

This is why you have the following rights for your personal data:

If you wish to exercise your rights, send your request to the following address:

When dealing with your request, we may ask for credentials to verify its accuracy.

In all cases, we commit to give you an answer within one month, with an eventual delay depending on the complexity and number of requests.

Lastly, in case of dispute concerning the processing of your personal data, you may file a claim with a competent authority. In France, this institution is the "Commission Nationale Informatique et Libertés" (CNIL): www.cnil.fr.

15. Evolution of the present Privacy Policy

Association 42 has the right to modify the present privacy policy at any moment. If the present Privacy Policy is modified, we commit to publish the new version on our website. The date of the last update of the present Privacy Policy will always be mentioned at the end of the present document.

We will inform you of any modification by email, and if possible before it takes effect. If you do not agree with the new terms, you have the possibility to ask for the erasure of your personal data.


Last updated: May 23 2022