I Am :
Make a Donation
Make a Donation
Share this page :

ISAE-SUPAERO External Data Protection Policy

Last Updated On

ISAE-SUPAERO PRIVACY POLICY

1. Introduction

In the course of its activities, the Institut Supérieur de l’Aéronautique et de l’Espace (“ISAE- SUPAERO”, “we” or “the Institute”) may collect and process your personal data.

Consequently, ISAE-SUPAERO is keen to build a lasting relationship of trust based on respect for the rights and freedoms of individuals, and is committed to putting in place the technical and organisational means necessary to protect the personal data it processes.

The main objective of this policy, in accordance with the General Data Protection Regulation (“GDPR”), is to group together in a concise, transparent, comprehensible and easily accessible format the information concerning the data processing implemented by the Institute to enable you to understand the conditions under which your data is processed and what your rights are in this respect.

2. Who are we?

ISAE-SUPAERO is a public scientific, cultural and professional establishment (EPSCP-GE) whose head office is located at 10, avenue Marc Pélegrin BP 54032 – 31055 Toulouse CEDEX 4. ISAE-SUPAERO is registered in the SIREN register under number 130 004 278 and its SIRET number is 130 004 278 00011.

3. Data Protection Officer

ISAE-SUPAERO has appointed Altij & Oratio Avocats, 40 rue du Japon, 31400 Toulouse, as its Data Protection Officer (DPO). You can contact the DPO with any questions you may have about the processing of your personal data by e-mail at dpo@isae.fr.

4. Who are the data subjects of our data processing operations?

This privacy policy covers our processing of the personal data of people who are not part of our workforce, and in particular the following categories of people:

  • Users: Users of the https://www.isae-supaero.fr website (the “Site”),
  • Candidates: Candidates for employment with the Institute,
  • Potential students: Candidates for a course offered by the Institute and, more generally, people who are interested in the Institute’s courses and who come into contact with our teams at events or by subscribing to our communications,
  • Current students: Students from the institute and our partner institutions who come into contact with our services as part of their studies,
  • Students’ entourage: Tutors and family members of our students,
  • Alumni: Former students of ISAE-SUPAERO,
  • Partners and suppliers: Staff members of our institutional partners, as well as our suppliers and service providers.

5. What personal data do we process?

In the context of the processing of personal data, the purposes of which are presented below, ISAE-SUPAERO collects and processes the following categories of data in particular:

a. General framework :

  • Identification data: Identification or civil status data, such as the surname(s) and first name(s) of the persons concerned, their date of birth or their nationality,
  • Contact details: Your email address and telephone number (for example, if you enter them via the forms on the Site), your postal address,
  • Professional information: Your establishment or company, your job title and field of activity and, more generally, any professional information that you choose to communicate to us,
  • Connection data: When you visit our Site, we may collect connection data and information relating to your browsing of the Site (duration of consultation, your IP address, your browser type and version, etc.), using electronic tracers such as cookies.

b. Monitoring of schooling :

  • Admissions management : Details of the course in which you wish to enrol, your qualifications and specialities, notices and comments relating to your application,
  • Registration information: Administrative information required for registration, such as your student number, photograph, identity card and/or passport number and social security number;
  • Information about your studies: Information about your studies at ISAE-SUPAERO, such as the options you have chosen, your transcripts, attendance at courses and compulsory events.
  • Economic and financial information: Data relating to the financing of enrolment and training fees, applications for and management of grants.
  • Data on your family and friends: Data relating to family life (surname and first name of the student’s parents, their profession/socio-professional category, number of brothers and sisters).

c. Receipt of applications:

The data we process, i.e. your surname, first name, contact details, diplomas, experience, skills and competences, and other relevant information, and provided in your CV and covering letter, is collected through your direct application to a job offer or through your unsolicited application.

Where appropriate, we will collect any other personal data about you that is necessary to assess your suitability for the job in question, as part of the interviews organised with you during the recruitment process, and/or as part of a reference check with your professional environment, such as :

  • Professional references: Professional information about you provided by referees, such as former employers and educational establishments;
  • Online professional profile: Professional information about you that you have shared in online sources.

In general, we try to limit the personal information we process to what is strictly necessary.

When personal data is collected, you will be informed whether the data processed is mandatory or optional. In the case of obligation, we will warn you if your decision not to provide the data requested would have an impact on our ability to provide the services offered.

6. The sources of data we process

ISAE-SUPAERO may collect your personal data from various sources, including the following:

a. Data collected directly from you:

This concerns personal data that you provide as part of :

  • Your exchanges with ISAE-SUPAERO by email or post, in particular;
  • The contact forms on the Site;
  • Putting together your application file;
  • The creation of your registration file, the completion of forms by you and the provision of the various documents requested.

b. Personal data generated in the course of our interactions:

This is information about you generated in the course of :

  • Your browsing on our Site and the connection traces that are generated;
  • Your academic career, for example, statistics on course attendance, exam results, etc.

c. Personal data from third parties or other services:

This is personal data about you from third parties, such as:

  • Ministerial bodies and other public partner bodies such as the Rectorat – Académie ;
  • Higher education partners, for example, your home university as part of an internship or international delegation, members of research partnerships such as theInstitute for sustainable aviation ;
  • The ISAE-SUPAERO Foundation;
  • Student and alumni associations;
  • Recruiters, when they ask us to verify that a diploma has been obtained.

Please note that we are not responsible for the processing carried out by these third parties. We invite you to refer to their privacy policy to find out more about how they process your data.

7. The legal bases and purposes of our data processing operations

Our processing of personal data must pursue a specific and legitimate purpose and must be based on a legal basis provided for by the RGPD. Our processing of your data is therefore based on the following legal grounds in particular:

a. Necessity for the performance of a task in the public interest:

Pursuant to Articles R.3411-1 et seq. of the French Defence Code, ISAE-SUPAERO is a public establishment of a scientific, cultural and professional nature, placed under the supervision of the Minister of Defence, constituted in the form of a major establishment within the meaning of Article L. 717-1 of the French Education Code. The Institute’s main mission is to train highly qualified engineers, managers and doctors in the aeronautics and space sectors and related fields. Accordingly, the processing of personal data carried out for this purpose is based on the need to carry out a mission of public interest, and in particular the following:

  • Management of engineering training courses: Management of recruitment, enrolment and academic progress, teaching resources, etc. ;
  • Award of diplomas: The award of national degrees and diplomas for which the institute is accredited, alone or jointly with other higher education establishments, as well as establishment diplomas;
  • Research and development: The processing of personal data for the purpose of carrying out scientific research and technological development work, either in-house or in partnership;
  • Dissemination of knowledge: any processing of personal data for the purposes of promotion in the context of publications, scientific and educational productions, patents and operating licences and support for the creation of innovative companies;
  • Infrastructure management: the management of the institute’s infrastructure and logistics to enable the pursuit of the main mission, for example the management of the information systems used in this context, the management of authorisations to protect research and development work, etc.

b. Consent:

Processing for the following purposes is based on the consent of the data subject. You may withdraw this consent at any time by writing to dpo@isae.fr.

  • Canvassing: The sending of communications from the institute by e-mail, where consent is required (e.g. a subscription to our communications via a form on the Site or at a trade fair or event);
  • Publication of teaching resources: You may be asked to give your consent for the management of research and teaching resources, for example the publication of a doctoral student’s thesis online;
  • Cookies subject to your consent: When you use the Site, it may retrieve information about your device and your use of the Site by using electronic tracers subject to your consent, if you give your consent via the cookies banner that appears when you first connect.

c. Legal obligations:

We may process personal data in order to meet our legal or regulatory obligations, for the following purposes in particular:

  • QSE obligations: Management of quality, safety and the working environment (e.g. monitoring the completion of compulsory health and safety training in the workplace);
  • Accounting and budgetary obligations: Processing of personal data in order to comply with our budgetary, financial and accounting obligations;
  • Secrecy obligations: Processing of personal data carried out in order to protect the secrecy of national defence (for example, controlling access to certain information systems);
  • Data protection obligations: Where we process personal data as part of a request to exercise rights under the GDPR, or to meet our compliance documentation obligations more generally, the legal basis is the need for compliance with a legal obligation.

d. Contractual necessity:

Processing for the following purposes is based on the performance of a contract to which the data subject is a party or the performance of pre-contractual measures taken at the data subject’s request:

  • Consideration of applications: The receipt, recording and classification of your application for a job with the Institute are carried out on the legal basis of pre-contractual measures taken on your initiative, resulting from your application process;
  • Contracts with service providers: Processing of personal data for the purposes of managing contracts with external service providers and suppliers when the latter are natural persons.

e. Legitimate interest:

Processing for the following purposes is implemented in order to achieve the legitimate interests of ISAE-SUPAERO, in particular the management, smooth running and deployment of its activities:

  • Strictly necessary cookies: The use of certain electronic tracers, such as cookies, is strictly necessary for the operation of the Site and is therefore not subject to the user’s consent but is justified by the publisher’s legitimate interest in ensuring the proper operation of the Site;
  • Management of legal affairs: We may process the personal data of data subjects in order to respond to requests from legal authorities or to defend our legal rights. The legal basis for this processing is our legitimate interest in defending ourselves in court;
  • Purchasing management: Our processing of the personal data of our suppliers’ staff (management of contracts and contact lists, etc.) is based on our legitimate interest in monitoring our service providers and sub-contractors and our other professional partners;
  • Processing your requests for information: We analyse, sort and classify information about you when you contact us, in particular via the contact form on the Site, by e-mail, telephone or post. This processing is justified by our legitimate interest in processing requests relating to our services, in a professional context;
  • Statistical analysis: We carry out statistical analyses of various aspects of our student population (options taken, student nationality, number of grant holders, parents’ socio-professional category) in order to gain a better understanding of trends and the composition of our student population, and to make projections over several years or at the end of the year. This processing of personal data is based on our legitimate interest in analysing and improving our practices and the management of the institute.

8. With whom do we share the data we process?

We may share your personal data with the categories of recipients listed below. Given the number of personal data processing operations carried out by ISAE- SUPAERO, it is not possible to list all potential data recipients individually in this policy and the list below is therefore intended to provide you with an overview of the categories of such recipients, with some individual examples. If you have a question about the recipients in the context of a specific processing of your personal data, we invite you to write to our DPO at dpo@isae.fr.

  • Internal recipients: The various departments and services of ISAE-SUPAERO within the limits of their missions;
  • Suppliers and technical service providers: the companies and institutional partners who help us with hosting and IT maintenance, management of our website and telephony and, more generally, suppliers of platforms and software solutions used by our various business services;
  • Institutional and ministerial partners: The public bodies with which we work as part of our mission as a public scientific, cultural and professional establishment, such as the services of the Ministry of the Armed Forces and the Ministry of Higher Education and Research, the Crous Toulouse Occitanie, the Higher Education Bibliographic Agency, etc… ;
  • Academic partners: Other higher education establishments, in France and abroad, with which we collaborate on a variety of issues such as research projects, student exchange programmes, pooling of teaching or practical resources (including in particular in this context La Communauté d’universités et établissements de Toulouse and its members), etc. ;
  • Student or alumni associations: such as, in particular, the Fondation ISAE-SUPAERO and the Amicale ISAE- SUPAERO (ISAE SUPAERO ENSICA Alumni);
  • Professional advisors: such as our lawyers and other external advisors;
  • Recruiters / potential employers: When we receive requests to verify graduation from Instutut alumni;
  • Public authorities : if we are required to disclose or share your personal data in order to comply with a legal obligation,

We ensure that only authorised persons have access to your personal data and apply policies to authorise and protect access to our systems for this purpose.

9. Where is your data processed?

ISAE-SUPAERO will only transfer your data subject to the implementation of appropriate guarantees (such as the signature of standard contractual clauses based on those of the European Commission).

The components of the ISAE-SUPAERO information system are, for the most part, hosted on servers in France, either internally by the Institute, or by university partners or professional suppliers.

We also use software and applications that are hosted by third-party suppliers and/or are remotely maintained by these suppliers. In some cases, the use of such software allows access to personal data processed by parties based in third countries outside the European Union.

In particular, the Institute uses the following systems:

  • Office automation and communication tools offered by the Microsoft group, allowing access to personal data in third countries where Microsoft is present, in particular the United States.

When we use such tools, the transfer of data is governed by a mechanism provided for by the RGPD and in particular:

10. How long we keep your data

ISAE-SUPAERO ensures that data is only kept in a form which allows identification of the persons concerned for as long as is necessary for the purposes for which it is processed. Given the large number of personal data processing operations carried out by ISAE-SUPAERO, the storage periods specific to each type of processing operation and purpose are not listed individually in this policy. If you would like to know the details of the retention periods applicable in your case, please write to our DPO at dpo@isae.fr.

The general criteria applied to determine the retention periods are set out below:

  • The nature and purpose of the processing in question;
  • The categories of data processed;
  • the applicable civil and criminal statute of limitations
  • Any applicable contractual provisions
  • Industry standards;
  • The recommendations of the Commission Nationale de l’Informatique et des Libertés (CNIL);
  • Any archival purposes in the public interest, for scientific or historical research, or for statistical purposes;
  • The rules applicable to public archives (in particular articles L212-1 et seq. and articles R212-1 et seq. of the French Heritage Code).

11. What are your data protection rights?

ISAE-SUPAERO is particularly concerned about respecting the rights granted to you in the context of the data processing that it implements, in order to guarantee fair and transparent processing taking into account the specific circumstances and context in which your personal data is processed.

These rights are as follows:

The right to request:

  • access to your personal data and information about our processing of it (“right of access”);
  • to correct or complete your personal data if it is inaccurate (“right of rectification”);
  • the erasure of your personal data (“right to erasure” or “right to be forgotten”);
  • a restriction on the processing of your personal data (“right to restriction”);
  • The right to object to the processing of your personal data (“right to object”);
  • The right to request your personal data in a usable electronic format and/or the transmission of this data to another organisation (“right to data portability”);
  • The right to set out instructions for the retention, erasure and disclosure of your personal data after your death (“post-death instructions”);
  • The right to withdraw your consent to the processing of your data insofar as the processing is based on your consent. In this case, the lawfulness of the processing carried out prior to the withdrawal of consent will not be called into question.

If you wish to exercise your rights, please contact us by e-mail at dpo@isae.fr.

You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL). You can access the CNIL’s “Online complaints” section at https://www.cnil.fr/fr/plaintes.