Passer les menus de navigation
Logo Acorn
PUMAPP

Rennes School of Business privacy policy

Privacy Policy of Rennes School of Business

1. Objective and Scope of the Policy

The Rennes School of Business association (Rennes SB) attaches great importance to the protection of your personal data, as well as to compliance with the provisions of the applicable Legislation.
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”) states that personal data must be processed lawfully, fairly, and transparently. Thus, this personal data protection policy (hereinafter the “Policy”) aims to provide you with simple, clear information regarding the processing of personal data concerning you, within the framework of your browsing and operations carried out on our website.

2. Data Controller

As part of your activity on the website www.rennes-sb.fr, we collect and use personal data relating to you, natural persons (hereinafter “Data Subject”).
For all processing, Rennes SB, an Association located at 2 rue Robert d’Arbrissel in Rennes (35000), determines the means and purposes of the processing.
Thus, we act as the Data Controller, within the meaning of the Personal Data Regulations, and in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

3. What Personal Data Do We Collect and How?

By using our website, you transmit a certain amount of information about yourself, some of which is of a nature to identify you (“Personal Data”). This is the case when you browse our site or when you fill out online forms.
The nature and quality of the Personal Data collected about you vary depending on the relationship you engage in with Rennes SB, the main ones being:
    • Identification data: This includes all information that would allow us to identify you, such as your last name, first name, and telephone number. We also collect your email address, as well as your postal address (in the event of payment, the postal address will be necessary to generate an invoice).
    • Connection data: This is all the information we need to access your personal account, such as the password, and other information necessary for authentication and access to an account. We also collect your IP address for maintenance and statistical purposes.
    • Financial data: This corresponds to bank data such as a RIB (Bank Account Details).
  • Documents of various natures (PDF, Office format, Image): With titles, content, folder names, or information related to a document, such as written comments in the documents, alert dates, and reminders.
  • Information related to your browsing: By browsing our website, you interact with it. Consequently, certain information related to your browsing is collected.
  • Data collected from Third Parties: Personal Data that you have agreed to share with us or on publicly accessible social networks and/or that we may collect from other publicly accessible databases.
  • Data related to academic and professional background: Diplomas obtained, validation of prior learning, languages spoken, curriculum vitae, disciplinary sanctions.

4. Why Do We Collect Your Personal Data and How?

We collect your Personal Data for specific purposes and on different legal bases.

Purposes Legal Basis
Recruitment of candidates for Rennes SB training programs: management of competitions and evaluation of candidates Performance of pre-contractual measures and our legitimate interest
Management of the training curriculum of learners (initial training, continuing education, intra-company training) Performance of contractual measures and our legitimate interest
Management of exams and learner evaluations Performance of contractual measures and our legitimate interest
Management of internships and work-study programs (apprenticeship/professionalization contracts) Performance of contractual measures
Management and monitoring of faculty assignments Our legitimate interest
Management of the specific needs of learners (particularly during exams and evaluations) Our legitimate interest or your consent if required by regulations
Management of disciplinary sanctions Performance of contractual measures and our legitimate interest
Management of specific schemes (tutoring, incubators, etc.) Our legitimate interest
Management of contracts concluded with data subjects, including management and monitoring of billing, payments, and potential disputes Performance of contractual measures
Management and monitoring of scholarships Performance of contractual measures and our legitimate interest
Management and animation of the alumni network Our legitimate interest
Monitoring of participation in events and services offered to alumni Performance of contractual measures and our legitimate interest
Management of research, publications, and chairs Performance of contractual measures and our legitimate interest
Carrying out promotional actions for Rennes SB and prospecting Our legitimate interest or your consent if required by regulations
Management of website operation and security Our legitimate interest
Management of internet browsing data (cookies on sites published by Rennes SB) Our legitimate interest or your consent if required by regulations
Conducting satisfaction surveys and polls Our legitimate interest or your consent if required by regulations
Management of resources made available by Rennes SB (classrooms, projection equipment, etc.) Our legitimate interest
Security of premises and people Our legitimate interest
Control of the use of IT resources made available by Rennes SB (including electronic messaging) Our legitimate interest
Monitoring and management of the collection of the apprenticeship tax Our legitimate interest and compliance with regulatory obligations
Management of school events Our legitimate interest
Provider management Our legitimate interest
Management of Rennes SB social networks Our legitimate interest

5. Who Has Access to Your Personal Data?

Your Data is mainly intended for authorized Rennes SB employees, notably the Pedagogical and Academic Directorate, the Information Systems Directorate, the Communication and Marketing Directorate, the Financial Directorate, as well as persons in charge of premises security and reception.
They are optionally transmitted for certain tasks related to the purposes, and within the limits of their respective missions and authorizations, to the following recipients:
  • Foreign educational institutions that are partners of Rennes SB and in which the learner would undergo training;
  • Partners of Rennes SB for contract management needs, such as unpaid debt collection agencies;
  • IT subcontractors of Rennes SB, such as hosting and IT maintenance providers;
  • Technical subcontractors of Rennes SB such as routers, partners involved in organizing events held by Rennes SB (gala evenings, etc.), etc.;
  • Organizations specialized in conducting surveys and statistics (notably for educational institution rankings);
  • The rectorate and, generally, any establishment under the supervision of the Ministry of National Education, notably for the purpose of conducting national surveys;
  • Organizations that cover all or part of the training cost, such as skills operators (OPCO);
  • The Rennes SB alumni association;
  • Partners of Rennes SB for the needs of managing academic accreditations of Rennes SB;
  • The European Commission for the management of scholarships awarded under the Erasmus program;
  • Partners of Rennes SB who run student associations, clubs, and other arrangements placed under the aegis of Rennes SB;
  • Any judicial or administrative entity when Rennes SB must satisfy its regulatory obligations;
  • Commercial partners, only when you have expressly consented through the cookie consent manager: Google, Facebook / Instagram, LinkedIn;
  • Providers and subcontractors we use to perform a set of operations and tasks on our behalf.

When your Data is communicated to our providers and subcontractors, they are also requested not to use the Data for purposes other than those initially planned. We make every effort to ensure that these Third Parties preserve the confidentiality and security of your Data.
In any case, only the necessary Data is provided. We make every effort to guarantee secure communication or transmission of your Data.
We do not sell your Data.

6. Is Your Personal Data Transferred to Third Countries?

Rennes SB strives to keep Personal Data in France, or at least within the European Economic Area (EEA).
In the event that data of the data subjects is transferred outside the European Union, Rennes SB will use one of the mechanisms ensuring appropriate safeguards as provided by applicable regulations, and in particular the adoption of standard contractual clauses drafted by the European Commission.
You can contact the Data Protection Officer of Rennes SB to obtain more information on these topics as well as a copy of the relevant documents.

7. How Long Do We Keep Your Personal Data?

Personal data processed by Rennes SB is kept for the time necessary to achieve the purpose for which we hold it, in order to meet your needs or for the duration necessary to fulfill the legal and contractual obligations of Rennes SB, in accordance with data protection regulations and according to legal prescription periods.
In general, data is kept in accordance with circular No. 2005-003 of February 22, 2005, from the Minister of National Education, Higher Education, and Research.
For example:
  • Data relating to the administrative and pedagogical file of learners is kept for 10 years;
  • Copies of exams/evaluations are kept for one year after the publication of results, except in case of litigation;
  • Invoices are kept for 10 years;
  • Attendance sheets of trainees and copies of internship certificates issued are kept for 5 years;
  • Data relating to disability management is kept for the duration of the disability if it is less than the duration of schooling or, otherwise, for the duration of schooling;
  • Data relating to unpaid debts is kept until the amicable settlement of the dispute or, failing that, until the prescription of legal action;
  • Contract management data is kept throughout the duration of the contract plus five years;
  • Data relating to commercial prospecting is kept for three years from the last contact;
  • Survey questionnaires are kept for 5 years and results (summaries, dashboards, etc.) are kept for 10 years.

8. How Do We Guarantee the Security of Your Personal Data?

Rennes SB undertakes to protect the Personal Data we collect, or that we process, against loss, destruction, alteration, unauthorized access, or disclosure.
Thus, we implement all appropriate technical and organizational measures, according to the nature of the Data and the risks that their Processing entails. These measures must preserve the security and confidentiality of your Personal Data. They may include practices such as limited access to Personal Data by authorized persons based on their duties, pseudonymization, or encryption.
In addition, our practices, policies, and/or physical and/or logical security measures (secure access, authentication process, backup copies, software, etc.) are regularly checked and updated if necessary.

9. What Are Your Rights?

The GDPR provides Data Subjects with rights that they can exercise. Thus, the following are provided:
  1. Right to information: The right to obtain clear, precise, and complete information on the use of Personal Data by Rennes School of Business.
  2. Right of access: The right to obtain a copy of the Personal Data that the Data Controller holds about the applicant.
  3. Right to rectification: The right to have Personal Data rectified when it is inaccurate or obsolete and/or to complete it when it is incomplete.
  4. Right to erasure (right to be forgotten): The right, under certain conditions, to request the erasure of Personal Data, except when Rennes School of Business is required to keep it or has a legitimate reason justifying its retention.
  5. Right to object: The right to object, under certain conditions, to the Processing of Personal Data for reasons relating to the applicant’s particular situation or, at any time, to the processing of data for prospecting purposes.
  6. Right to withdraw consent: The right to withdraw consent at any time when the processing is based on it, without this withdrawal affecting the lawfulness of the processing carried out before this withdrawal.
  7. Right to restriction of processing: The right, under certain conditions, to request the temporary suspension of a processing of Personal Data.
  8. Right to data portability: The right to receive the Personal Data provided to Rennes School of Business in a structured, commonly used, and machine-readable format, or to request its transmission to another data controller when technically possible.
  9. Right not to be subject to a decision based solely on automated processing, including profiling, producing legal effects or significantly affecting the data subject, except in cases provided for by regulations.
  10. Right to define directives regarding the fate of your Data after your death, in accordance with applicable legislation.

Additional rights may be recognized for Data Subjects by applicable national regulations.
To this end, Rennes School of Business has implemented a procedure for managing the rights of Data Subjects in compliance with the requirements of applicable regulations. This procedure defines in particular:
  • The modalities of information for Data Subjects;
  • The applicable legal requirements;
  • The modalities for submitting requests to exercise rights;
  • The processes allowing these requests to be processed within regulatory timeframes;
  • The roles and responsibilities of the various stakeholders.

To exercise your rights, you can contact the Data Protection Officer (DPO):
  • By email: dpo@rennes-sb.com
  • By post: 2 rue Robert d’Arbrissel in Rennes (35000)

When you send us a request to exercise rights, we invite you to specify, as far as possible, the right concerned, the targeted processing, as well as any element facilitating the investigation of your request. In case of reasonable doubt about your identity, proof of identity may be requested.
You can also object to receiving our commercial electronic communications or withdraw your consent at any time by using the unsubscription link or the mechanism provided for this purpose in each email. When our communications use tracking pixels subject to consent, you can also object to their use or withdraw your consent according to the same modalities. This withdrawal does not affect the lawfulness of the processing carried out before its exercise.
If, despite our exchanges, you feel that your rights are not respected, you can file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) – 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 or via its website.

10. Update of This Policy

This Policy may be regularly updated to reflect changes in Personal Data Regulations.
Date of last update: 25/09/2026