Privacy policy - Learning Planet Institute

1. Personal information, forms

1.1 Introduction

The Learning Planet institute attaches great importance to the protection of Personal Data that it has to collect and process as a data controller, within the framework of its activity. This declaration explains how we use your data and how you can exercise your rights with regard to your data.

The collection and Processing of Personal Data carried out by the Association as part of the operation of its business, its websites (https://www.learningplanetinstitute.org/) and associated websites, its databases and web applications offered as part of the Association's missions and services, where applicable, and requiring the creation of an account, are governed by the present data protection policy (hereinafter referred to as the «Policy»).

All of the Personal Data Processing implemented in this context complies with the regulations applicable to the protection of personal data, and in particular the provisions of the French Data Protection Act of January 6, 1978, as amended, and the General Data Protection Regulation (EU Regulation 2016/679) («RGPD»).

To ensure that these rules are properly applied, the Association has appointed a Data Protection Officer, who acts as the main contact for the Commission Nationale de l'Informatique et des Libertés («CNIL»). The Association also implements appropriate internal procedures to raise employee awareness and ensure compliance with these rules within its organization.

The purpose of this Policy is to explain to Data Subjects how their data is processed.

Data Subjects are therefore invited to read this Policy carefully in order to know and understand the Association's practices regarding the Processing of Personal Data that the Association implements.

1.2 Definitions

Capitalized terms are defined as follows. Terms have the same definition whether used in the singular or plural.

« Personal data »or « Personal data »Any information relating to an identified or identifiable natural person.
« Person(s) concerned »means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
« Data controller means Learning Planet Institute, which is the legal entity that, alone or jointly with others, determines the purposes and means of the processing.
« Website »means all the web pages and related resources accessible at the address www.learningplanetinstitute.org
« Treatment »processing" means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. Personal data protection policy

2.1. Commitments

The Association undertakes to guarantee a high level of protection for the Personal Data of Data Subjects and any other person whose Personal Data it processes.

The Association undertakes to comply with the regulations applicable (in particular Articles 5 and 6 of the RGPD) to all the Processing of Personal Data that it implements. More specifically, the Association undertakes in particular to comply with the following principles:

Personal data are processed lawfully, fairly and transparently (lawfulness, fairness, transparency); ;
Personal data is collected for specific, explicit and legitimate purposes, and is not further processed in a way that is incompatible with these purposes (purpose limitation); ;
Personal data are stored in an adequate and relevant manner and are limited to what is necessary for the purposes for which they are processed (data minimization); ;
Personal Data are accurate, kept up to date and all reasonable steps are taken to ensure that inaccurate data, having regard to the purposes for which they are processed, are deleted or rectified without delay (accuracy).

The Association implements the appropriate technical and organizational measures to guarantee a level of security appropriate to the risk inherent in its Processing operations, to meet regulatory requirements and to protect the rights and Personal Data of Data Subjects from the outset of Processing operations.

In addition, the Association contractually imposes the same level of protection of Personal Data on its subcontractors (service providers, suppliers, etc.).

Lastly, the Association undertakes to comply with all other principles applicable to the protection of Personal Data, in particular with regard to the rights of Data Subjects, the retention periods for Personal Data and the obligations relating to cross-border transfers of Personal Data.

2.2. The data

In the context of the use and communication of its activities or services as well as its Websites, several types of Personal Data may be collected by the Association.

Mainly, the data collected correspond to the following categories:

identification data: surname, first name, pseudonym, date of birth ;
contact data: landline or cell phone number, postal address, e-mail address.
professional data: position/function, organization/employer

2.3 Means of collecting personal data

Data subjects may communicate their Personal Data to the Association by various means, in particular via the Learning Planet Institute newsletter subscription and donation forms, when creating an account, when submitting an application, during any contact with the Association or during any other transmission of Personal Data in other circumstances.

2.4. Processing purposes and legal basis

The purpose(s) of the Processing of Personal Data carried out by the Association are based on the following legal grounds: contractual performance, the consent of the Data Subjects, the Association's legal and regulatory obligations, its legitimate interest.

The purposes associated with each legal basis are listed below.

Based on the consent of the Data Subjects, the Association implements Processing for the following purposes:

the provision of personalized communications, such as announcements, newsletters, training, etc; ;
managing user participation in games and competitions; ;
management of cookies subject to consent.

Based on compliance with its legal and regulatory obligations, the Association implements Processing for the following purposes:

IT development to facilitate contact via the website; ;
managing responses to official requests from authorized public or judicial authorities; ;
compliance with the regulations applicable to our business; ;
managing requests to exercise rights.

Based on its legitimate interests, the Association implements Processing for the following purposes:

commercial and philanthropic prospecting operations aimed at professionals; ;
managing user requests for information and complaints; ;
the establishment of any evidence necessary to defend the Association's rights; ;
management of cookies not subject to consent.

The Association undertakes to keep Data Subjects informed of any changes in the data processing it carries out. For example, should the purpose of data processing change, the Association undertakes to keep the Data Subjects informed.

2.5. Profiling

The Association uses «profiling» techniques in order to offer services and communications in line with the presumed expectations of Data Subjects. Data Subjects may object to the use of these techniques by sending their request to the Data Protection Officer: dpo@learningplanetinstitute.org

2.6. Recipients

The data collected may be communicated to the Association's authorized personnel, its partners or its service providers, as part of the provision of all or part of the services. The Association reminds you that in this context, it requires its service providers, by contract, to implement strict confidentiality and data protection measures. Data may also be communicated to partners in the commercial sector, the press, and other sectors offering an advantage in developing our collection at the lowest cost.

2.7. Transfers outside the European Union (EU)

Some of the above-mentioned recipients may be established outside the European Union and may have access to all or part of the personal information collected by the Association by virtue of a specific legal entitlement. The Association may transfer data outside the EU. The Association takes care to give preference to recipient countries qualified as «adequate» by the CNIL.

In this context, the Association undertakes to guarantee the protection of the Personal Data of Data Subjects in accordance with the strictest rules, in particular through the signing, on a case-by-case basis, of contractual clauses based on the European Commission's model, or any other mechanism that complies with the RGPD, whenever the Personal Data of Data Subjects is processed by a service provider outside the European Economic Area and whose country is not considered by the European Commission to ensure an adequate level of protection.

Data Subjects may at any time object to the sharing of their information and exercise their rights over their data by sending a request to the designated Data Protection Officer : dpo@learningplanetinstitute.org.

2.8. Shelf life

The Association undertakes to keep the Personal Data of the Persons concerned for a period not exceeding that necessary to achieve the purposes for which they are processed, increased by the statutory limitation period, or if the Persons concerned so request. In addition, the Association retains the Personal Data of Data Subjects in accordance with the retention periods imposed by the applicable laws in force, where applicable.

2.9. Modifications

The Association reserves the right to adapt this Policy.

If the Association makes a change to this Policy, it will publish the new version on the relevant media and update the «last updated» date at the top of this Policy.

The Association therefore invites you to regularly consult the relevant media where the Policy is published.

3. Individual rights and exercise of rights

3.1 Introduction

In accordance with the RGPD, Data Subjects may, at any time, exercise their rights of access, rectification, deletion of data concerning them as well as their rights of limitation and opposition to the Processing and portability of their Personal Data.

Furthermore, where the Processing of Personal Data by the Association is based on the consent of the Data Subjects, the latter may withdraw their consent at any time. The Association will then cease to process the Personal Data of the Persons concerned, without the previous operations for which the Persons concerned had given their consent being called into question.

Furthermore, any person who was a minor at the time his or her Personal Data was collected may obtain its deletion as soon as possible.

3.2 Exercising rights

The Association undertakes to process this request within 30 days.

In the event that the Association is unable to identify the Persons concerned in the files on the basis of the information provided, the Association will inform the Persons concerned for further information.

When the request is made electronically, the information is provided in a commonly used electronic form, unless the Persons concerned request otherwise.

The Association systematically archives all traces of requests and responses. These elements will be kept as proof.

3.3. Right of access

Data subjects have the right to obtain confirmation that their data is - or is not - being processed by the Association's services.

In particular, Data Subjects have the right to know :

The purpose(s) of their processing ;
Categories of data concerned by the processing ;
The recipients or categories of recipients to whom the data have been or will be disclosed, in particular recipients established in third countries or international organizations; ;
Where possible, the intended retention period of the data or, where this is not possible, the criteria used to determine this period; ;
The existence of the right to ask the Association to rectify or delete your data, or to restrict its processing, or the right to object to such processing; ;
The right to lodge a complaint with a supervisory authority; ;
Where personal data has not been collected directly from the Data Subjects, the Association provides information on its source; ;
The existence of automated decision-making, including profiling; ;
Where data is transferred to a third country or to an international organization, Data Subjects have the right to be informed of the appropriate safeguards with respect to such transfer.

Data Subjects may obtain a copy of their data being processed and the Association may charge a reasonable fee based on administrative costs for any additional copies requested.

When Data Subjects submit their request electronically, the information is provided in a commonly used electronic form, unless Data Subjects request otherwise.

This right to obtain a copy of data must not infringe the rights and freedoms of others. To this end, the Association will request proof of identity.

3.4. Right of rectification

Data subjects have the right to obtain, as soon as possible, the rectification of any inaccurate data. Given the purposes of the processing, Data Subjects have the right to have incomplete data completed, including by providing a supplementary declaration.

3.5. Right to erasure («right to be forgotten»)

This right translates into the right to obtain, as soon as possible, the deletion of the data of the Persons concerned.

The Association is obliged to delete data when one of the following reasons applies:

The data is no longer required for the purposes for which it was collected or otherwise processed; ;
The Data Subjects withdraw the consent on which the processing is based and there is no other legal basis for the processing; ;
Data Subjects object to the processing and there is no compelling legitimate reason for the processing, or Data Subjects object to the processing for canvassing purposes, Data Subjects may exercise this right at any time, including to profiling insofar as it is related to such canvassing ;
The data has been processed unlawfully; ;
Data must be deleted to comply with a legal obligation under European Union law or the law of the Member State to which the Association is subject; ;
The data was collected as part of a service offered by an organization in charge of providing information to children. This processing of data relating to a child is lawful when the child is at least 15 years old. Where the child is under 15, such processing is lawful only if, and insofar as, consent is given or authorized by the holder of parental responsibility for the child.

If the Association has made public data that the Association is required to erase, taking into account available technologies and implementation costs, the Association will take reasonable steps, including technical steps, to inform other data controllers who process the data of the erasure request, by any link to such data or any copy or reproduction thereof.

However, this right does not apply if the processing is necessary:

Exercising the right to freedom of expression and information
to comply with a legal obligation requiring processing, as provided for by European Union law or by the law of the Member State to which we are subject, or to perform a task in the public interest or in the exercise of official authority vested in us
for archival purposes in the public interest, for scientific or historical research, or for statistical purposes
establishing, exercising or defending legal rights

3.6. Right to restrict processing

Data Subjects have the right to obtain the limitation of the processing of their data in particular when:

They contest the accuracy of their data (for a period that will allow the Association to verify the accuracy of their data); ;
The processing is unlawful and the Data Subjects request the deletion of the data unless they intervene in another processing that would be lawful to them by demanding the limitation of their use; ;
The Association no longer requires the data for processing purposes, but it is still necessary for the establishment, exercise or defense of legal claims; ;
Data Subjects object to processing by virtue of their right to object, during the verification as to whether the legitimate grounds for processing pursued prevail; ;
Where processing is restricted, data may, with the exception of storage, only be processed with your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important reasons of public interest of the European Union or a Member State.

A data subject who has obtained a restriction on the processing of his or her data is informed before the restriction on processing is lifted.

3.7. Notification obligation

The Association shall notify each recipient to whom the data has been communicated of any rectification or erasure of data or any restriction on the processing carried out, unless such communication proves impossible or would require disproportionate effort. The Association will provide Data Subjects with information on these recipients on request.

3.8. Right to data portability

Data Subjects have the right to have the data they have provided, in a structured, commonly used and machine-readable format, and have the right to transmit such data to another data controller without the Association's hindrance, where:

Processing is based on consent or contract
Processing is carried out using automated procedures

When exercising this right to data portability, Data Subjects have the right to have their personal data transmitted directly from one data controller to another, where technically possible.

Exercise of the right to portability is without prejudice to the right to erasure. This right does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

This right is without prejudice to the rights and freedoms of third parties.

3.9. Right to object

Data subjects have the right to object:

At any time, for reasons relating to your particular situation, to the processing of your data, including profiling; ;
In this case, the Association will no longer process the data, unless there are compelling legitimate grounds for the processing which override the interests and rights and freedoms of the Data Subjects, or for the establishment, exercise or defense of legal claims ;
Where data is processed for canvassing purposes, Data Subjects have the right to object at any time to the processing of their data for canvassing purposes, including profiling insofar as it is linked to such canvassing; ;
When Data Subjects object to the processing of their data for canvassing purposes, the data is no longer processed for these purposes.

The Association will present and remind the Data Subjects of this right to object, clearly and separately from any other information, at the latest at the time of the first communication.

When using information society services, Data Subjects may exercise their right to object by means of automated processes using technical specifications.

Where data is processed for scientific or historical research or statistical purposes, Data Subjects have the right to object, on grounds relating to their particular situation, to the processing of their data, unless the processing is necessary for the performance of a task in the public interest.

3.10. Automated individual decision, including profiling

Data Subjects have the right not to be subject to a decision based exclusively on automated processing, including profiling, which would produce legal effects or significantly affect Data Subjects.

This right does not apply if the :

Is necessary for the conclusion or performance of a contract between the data subject and a controller; ;
Is authorized by the law of the European Union or the law of the Member State to which the Association would be subject and which also provides for appropriate measures to safeguard rights and freedoms and legitimate interests; ;
Is based on the explicit consent of the Data Subjects.

The Association implements appropriate measures to safeguard the rights and freedoms and legitimate interests of the Persons concerned, at least the right to obtain human intervention on the part of the Association, to express their point of view and to contest the decision.

Such decisions may not be based on particular categories of data unless appropriate measures to safeguard rights and freedoms and legitimate interests are put in place.

3.11. Claims

Data Subjects have the right to lodge a complaint with a supervisory authority.

3.12. Data source

Where the Association is required to process data concerning the Persons concerned which they have not supplied directly and which therefore come from another non-public source, the Association will indicate, on any request from the Persons concerned, from which source the data thus made available to the Association has been obtained.

To exercise their rights, Data Subjects may write to the Learning PIanet Institute's postal address: 8bis rue Charles V - 75004 Paris, or send an e-mail to dpo@learningplanetinstitute.org

4. Electronic mail

Please note that you may receive e-mails from the Association, unless you object.

In order to respect your right to object, we will keep the e-mail address to which you object in order to eliminate it from all our mailings. The retention period is 3 years, after which your address will be permanently deleted.

The Association accepts no responsibility for the correct reception of messages sent to you.

We would like to draw your attention to the risks associated with electronic mail. It is your responsibility to always check the reliability of the sender of any message sent to you.

1 «Profiling»: any form of automated processing of personal data consisting in using this data to assess certain personal aspects.

Confidentiality of personal data