PERSONAL DATA PROTECTION POLICY

Introduction

As a committed player in Education, Vittascience places the security and confidentiality of its users' personal data at the heart of its concerns.

Vittascience is engaged in an ongoing process to protect its users' data, in compliance with the French Data Protection Act of January 6, 1978 and the General Data Protection Regulation of April 27, 2016 (hereinafter: the "GDPR").

Below you will find Vittascience's Privacy Policy, which we have tried to present as clearly as possible to help you better understand and exercise your rights.

Who is responsible for processing your data?

The company VITTASCIENCE (hereinafter: "VITTASCIENCE") provides, through its website www.vittascience.com (hereinafter: the "Site"), features aimed at teachers and individuals (hereinafter: the "Users") dedicated to the teaching and learning of science and digital technology.

VITTASCIENCE offers a set of online services (hereinafter: the "Services") allowing users to run, create, edit and publish computer programs as well as educational resources, activities and learning paths (jointly referred to hereinafter as: the "Content").

VITTASCIENCE is therefore the data controller for the personal data you provide as part of the Services accessible on the Site.

Some users (hereinafter: the "Learners") use the Services at the invitation of, or under the supervision of, another User (for example: a teacher, a trainer or a school administrator). In this case, that person is jointly responsible with VITTASCIENCE for protecting your data in connection with your use of the Services (management of your user account and of the Content you create), since it is that person who chose to offer you the use of these Services. Even in this situation, VITTASCIENCE remains your primary point of contact for any question or concern regarding the collection and use of your data.

The Site and the Services are operated by the company VITTASCIENCE; for further details and contact information, please refer to the Legal Notice.

What data concerning you is collected, and for what reasons?

In general, it is possible to use the Vittascience Site and Content without providing any personal information.

Part "1. Statistical data and audience measurement" concerns all visitors to the Site; the following parts describe several actions you may take that involve the collection of personal data. You may not be able to benefit from certain features if you refuse to provide certain information about yourself.

1. Statistical data and audience measurement

In order to adapt our site to our visitors' needs and improve it to offer you relevant content, we measure the sources of traffic to our site, the number of visits, the number of pages viewed, as well as visitor activity on the site and how often they return.

The statistics tool used on the Site is Matomo, a free/open-source tool, configured to comply with the CNIL's "Cookies" recommendation. This means that your IP address, for example, is anonymized before being recorded. It is therefore impossible to link your visits to this site to you personally.

The lifespan of these cookies (the length of time they remain stored on your device) does not exceed 13 months. More details are available on the Cookie Information page.

2. Data collected when you connect to the site

Certain personal data is necessary to allow you to connect to the Site, as well as to detect connection or display errors and cyberattack attempts: this mainly consists of your IP address, along with other technical information about your device (computer, tablet, smartphone or other) and your internet browser.

This information is automatically detected and collected by the Services' hosting provider. It is retained by the hosting provider for a period of 12 months before being deleted.

Its collection and use are justified as being necessary for the pursuit of a legitimate interest of VITTASCIENCE, namely being able to provide Services that are functional and adapted to the various types of devices and browsers on the market, in accordance with Article 6.1.f) of the GDPR.

3. Data collected when you register

Certain data is collected when you register. It is requested from you via the account creation form: this consists of your first and last name, an email address and a password.

This data is necessary to allow you to access and use the Services. Its collection, use and retention are therefore justified as being necessary for the conclusion and performance of a contract between you and VITTASCIENCE, namely the Terms of Service, in accordance with Article 6.1.b) of the GDPR.

Important: If you are a minor, you cannot validly "enter into a contract" with VITTASCIENCE. In this case, the data is collected under the public-service mission entrusted to your school (primary or secondary education).

Several other optional pieces of information allow you to complete your profile, in particular your phone number, your school, a profile picture and a short biography.

We will retain the data related to the creation and subsequent changes to your account, including after it is deleted, for the following two reasons:

• We may need to use some of this data to respond to a claim made by you, by your school or by a third party, or in order to defend our rights in court. This would be the case, for example, if you breach the Terms of Service, or if you complain about a failure on the part of VITTASCIENCE; we will therefore retain the necessary data as a precaution, for as long as such a dispute could arise.
  
  This extended retention and this contentious use of your data are justified by VITTASCIENCE's legitimate interest in preserving evidence useful for defending its rights and interests, in accordance with Article 6.1.f) of the GDPR.
• Furthermore, the law requires us to keep available to the competent authorities and courts the data needed to identify the users of our Services (including the date and time the user account was created and the IP address used). This obligation is set out in Article 6.II of Law No. 575-2004 of June 21, 2004 on confidence in the digital economy and its implementing decree No. 2011-219 of February 25, 2011.
  

In total, we will therefore retain the data related to your account until it is deleted, and then archive it for the legally applicable limitation period for an action before civil or criminal courts (in principle, 5 years).

Users creating a Vittascience account can choose whether or not to enable a public profile. In the case of a public profile, the User's first name, last name, profile picture, biography and school are made public on a dedicated profile page. Your email address, password and phone number are never made public.

4. Data related to the Content you create

Once your account has been created, you can start creating Content, i.e. resources, activities, learning paths, projects and Vittamap experiences.

We will retain this Content, along with the dates and times it was published, linking it to your user account.

This data processing is justified as being necessary for the performance of a contract between you and VITTASCIENCE, namely the Terms of Service, in accordance with Article 6.1.b) of the GDPR.

Important: If you are a minor, you cannot validly "enter into a contract" with VITTASCIENCE. In this case, the data is collected under the public-service mission entrusted to your school (primary or secondary education).

We will retain the data related to the Content you publish (such as a record of the Content, as well as the date and time of publication and the IP address used), including after you remove this Content from the platform, for the two reasons already mentioned:

• We may need to use some of this data to respond to a claim made by you, by your school or by a third party, or in order to defend our rights in court. This would be the case, for example, if you breach the Terms of Service, or if you complain about a failure on the part of VITTASCIENCE; we will therefore retain the necessary data as a precaution, for as long as such a dispute could arise.
  
  This extended retention and this contentious use of your data are justified by VITTASCIENCE's legitimate interest in preserving evidence useful for defending its rights and interests, in accordance with Article 6.1.f) of the GDPR.
• Furthermore, the law requires us to keep available to the competent authorities and courts the data needed to identify the authors of Content published on the platform (including the date and time the Content was published, and the IP address used). This obligation is set out in Article 6.II of Law No. 575-2004 of June 21, 2004 on confidence in the digital economy and its implementing decree No. 2011-219 of February 25, 2011.
  
  This is therefore processing of your data necessary for compliance with legal and regulatory obligations specific to VITTASCIENCE, in accordance with Article 6.1.c) of the GDPR.

In total, we will therefore retain the data related to each piece of Content until you remove that Content from the Services, and then archive it for the legally applicable limitation period for an action before civil or criminal courts (in principle, 5 years).

This processing of data related to the Content you create also applies to comments you leave on the Site.

5. Data related to orders and delivery

The Services allow you to order and have various products delivered, such as educational kits and electronic equipment.

To do so, we will ask you to provide your postal address (for billing and delivery purposes) and your phone number (to facilitate delivery).

This data processing is justified as being necessary for the performance of a contract between you and VITTASCIENCE, namely the Terms of Service, in accordance with Article 6.1.b) of the GDPR.

We will also retain this data after delivery, in order to handle any potential claim on your part, for the applicable civil limitation period. This long-term retention is justified by VITTASCIENCE's legitimate interest in preserving evidence useful in anticipation of possible legal proceedings, in accordance with Article 6.1.f) of the GDPR.

6. Data collected via the contact form

Using the contact form on the "about" page of the vittascience.com website requires you to provide your first name, last name, email address and the reason for your contact, in addition to your message, so that we can respond to you if needed.

We will generally retain this information for as long as necessary to process your message, i.e. to respond to it (if a response from VITTASCIENCE is warranted), and then archive it for the legally applicable limitation period for an action before civil or criminal courts (in principle, 5 years).

The collection and retention of this information are justified by VITTASCIENCE's legitimate interest in properly managing its relationships with its users in general, and in preserving the evidence needed to defend its rights over the long term where applicable, in accordance with Article 6.1.f) of the General Data Protection Regulation (GDPR).

However, if the message you send via the form is found to be clearly unlawful (for example, in the case of defamation or insult), or if our exchanges lead to legal proceedings on your part or ours, the corresponding information may be retained for a longer period, as the applicable limitation period may be longer (for example, in criminal matters, depending on the nature of the offense alleged), or may even be suspended or interrupted during the proceedings, as applicable.

This long-term retention is once again justified by VITTASCIENCE's legitimate interest in preserving and producing evidence useful for asserting its rights in the context of legal proceedings, in accordance with Article 6.1.f) of the General Data Protection Regulation (GDPR).

7. Data related to newsletter sign-up

Signing up for our newsletter requires you to provide your email address. This address is used solely to send you Vittascience newsletters. You can unsubscribe at any time using the unsubscribe link included in the newsletter. The data is retained from your sign-up until your unsubscription.

This data processing is justified as being necessary for the performance of a contract between you and VITTASCIENCE, namely the Terms of Service, in accordance with Article 6.1.b) of the GDPR.

Who has access to your data? Who is it shared with?

We have implemented technical and organizational security measures to ensure the security, integrity and confidentiality of all your personal data.

All of our website's data is stored on servers located in the European Union by OVH (hereinafter: the "Host"). To learn about our Host's privacy policy, please refer to the following page: Personal Data Protection at OVH.

In addition, your personal data is encrypted and secured whenever it is transmitted to the servers on which our website is hosted, thanks to the HTTPS protocol. As no security measure is foolproof, VITTASCIENCE cannot guarantee absolute security of your personal data.

This data is accessible to VITTASCIENCE employees as needed for their duties.

Besides the Host and VITTASCIENCE employees, the only persons or organizations likely to receive or view this personal data are:

• the User who invited you to use the Services and who has agreed to supervise your use of these Services, in particular the Content you create (for Learners)
• the persons with whom you choose to share your Content
• technical service providers who may be responsible for the maintenance and development of the services
• VITTASCIENCE's legal counsel, in order to obtain legal advice or assistance in defending VITTASCIENCE's rights
• French, European, international or foreign courts or authorities that order VITTASCIENCE to disclose the data to them, or to whom VITTASCIENCE chooses to voluntarily disclose it in order to defend its rights.

It cannot be ruled out that some of these courts or authorities may be located in countries outside the European Union (or that they are, by nature, international organizations), although the likelihood of such a scenario is a priori relatively low. In such a situation, we will take appropriate measures to ensure that the court or authority concerned guarantees sufficient protection for the data disclosed. These measures will involve a thorough analysis of the validity of the order received, and, if necessary, consultation with the relevant French authority (the CNIL), prior to any disclosure of data.

Important: You are solely responsible (or, for Learners, the User who invited you) for choosing the people with whom you share your Content, and for the practical or legal consequences that may result. VITTASCIENCE's role is limited to providing you with a feature enabling the creation of Content and its publication on the Internet.

It is worth recalling here that VITTASCIENCE's business model is not based on advertising or on the sale or exchange of User data. Accordingly, Users' Personal Data will not be transferred to commercial or advertising actors.

What rights do you have to control the processing of your own data?

You have a number of rights provided for by the applicable regulations; you will find the details below.

You can exercise these rights simply by writing directly to the following email address: contact@vittascience.com. Be sure to indicate in your email the nature of the right you wish to exercise and the reasons justifying your request, where applicable.

1. Right of access

You have the right to ask us for a copy of the personal data we hold about you, in an easily understandable format, as well as a copy of this policy on a durable medium.

2. Right to rectification

You have the right to ask us to correct, complete or update the data we hold about you, if it seems inaccurate, incomplete or outdated.

In that case, please provide us, as far as possible, with the new information needed to carry out the requested correction, completion or update.

3. Right to object

Insofar as some of the data processing listed above is justified by VITTASCIENCE's legitimate interests (retention of certain data as evidence; collection of technical information when you connect to the site; data related to the contact form), you have the right to object to it for reasons relating to your particular situation.

In other words, you can ask VITTASCIENCE to stop one or more of these processing activities with respect to you, by explaining the particular reasons that justify this request from your point of view.

However, VITTASCIENCE may refuse to grant your request if the continuation of this processing is necessary for compelling reasons from our point of view (for example: if the data concerned is necessary for the protection and defense of VITTASCIENCE's rights in court).

Important: An objection (if based on valid grounds and if no compelling reason opposes it) will result in the processing being stopped going forward, but not necessarily in the deletion of the data concerned: to obtain that deletion, you must exercise your right to erasure under the conditions described below, it being specified that this right is itself subject to limitations, for example, again, the need to retain data for the protection and defense of VITTASCIENCE's interests in court.

4. Right to erasure

You may ask us to delete all or part of the data we hold about you, provided that at least one of the following conditions is met:

• You have objected to the continuation of this processing and further wish VITTASCIENCE to destroy the data concerned.
• The data concerned no longer appears necessary for any of the purposes set out above.
• You believe that VITTASCIENCE has collected and/or processed the data concerned unlawfully.
• The erasure of the data concerned is required by a legal obligation.
• The data concerned relates to a person who was under fifteen (15) years of age at the time it was collected.

Please note, however, that VITTASCIENCE is entitled to object to the deletion of certain data when its retention is necessary for particularly important reasons, such as the protection and defense of its interests in court (for example: in the case of a defamatory or insulting message received via the contact form).

Please also note that we may choose, instead of deleting the data, to fully and irreversibly anonymize it. In this way, we will be entitled to retain this data in a format that no longer allows you to be identified (for example: for statistical purposes).

5. Right to restriction of processing

If you do not wish to exercise your right to erasure, for example, you can also ask VITTASCIENCE to "set aside" certain data about you, i.e. to keep this data separately, without using it further (except for legal obligations).

You can make such a request when at least one of the following conditions is met:

• The data concerned seems inaccurate to you, and you would prefer VITTASCIENCE to stop using it while it is verified and corrected if necessary.
• You have exercised your right to object (see above), and you would prefer VITTASCIENCE to stop using the data concerned while the validity of your objection is being verified.
• You believe that VITTASCIENCE has collected and/or processed the data concerned unlawfully, but you would nevertheless prefer that we retain the data rather than delete it.
• The data concerned is no longer necessary for any of the purposes set out above, but you wish VITTASCIENCE to retain it nonetheless for the purposes of defending your interests in court.

In these cases, we will place the data "in quarantine" for the necessary period, for example by marking it "Do not use – Right to restriction".

6. Right to data portability

You can ask us to provide you with the data related to your use of the Services in a standard, structured, machine-readable format, in particular for the purpose of reusing this data with another service. You can also ask us to transmit this data directly to another service provider, to make it easier for you to switch services.

Important: The data provided under the right to portability will be machine-readable, but not necessarily readable by you; if you wish to access your data in a format that you yourself can read and understand, we invite you instead to exercise your right of access (see above).

7. Right to set guidelines for what happens to your data after your death

Finally, you have the right to tell us how you would like us to handle your data in the unfortunate event of your death.

In particular, you can ask us to destroy all of your data (subject to any compelling need we may have to retain it, for example for the purpose of defending VITTASCIENCE's rights in court), or to send a copy of all this data to a person of your choosing.

You can also designate any person of your choosing as responsible for carrying out these "last wishes"; this person does not necessarily have to be one of your heirs or even the executor in charge of your estate.

Changes

This personal data protection policy may be amended in line with any changes to the Services. Such changes may take place at any time and without notice. If this personal data protection policy is amended, Users with an Account will receive an alert by email.

The date this personal data protection policy was last updated is shown at the bottom of this page.

Contact

If you have any questions or complaints regarding VITTASCIENCE's compliance with this Policy, or if you would like to share recommendations or comments to help improve the quality of this policy, you can contact VITTASCIENCE by email at contact@vittascience.com.

If you wish, you also have the right to lodge a complaint with the competent data protection authority in France, namely the Commission Nationale de l'Informatique et des Libertés (CNIL), via its website cnil.fr or by post at the following address: CNIL – 3, place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07.

This right may be exercised at any time and at no cost to you, other than any postal mailing costs, and any assistance or representation costs if you choose to be assisted in this process by a third party.