Data protection policy

1.1 - Compliance

LSTI collects personal data in compliance with the rules laid down by international standards relating to conformity certification, in particular ISO/IEC 17024 - "General requirements for certification bodies operating personnel certification systems" (Auditor ISO/IEC 27001, Implementor ISO/IEC 27001, Risk Manager ISO/IEC 27005), the rules issued by ANSSI for the assessment of PASSI auditors, PRIS analysts and other experts and the requirements of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

With this policy, we wish to present in a concise, clear, transparent and easily accessible format, the processing of personal data that we carry out as part of our services.

LSTI's personal data protection strategy is integrated and aligned with that of the Group to which it is affiliated: Apave. This strategy is based on the privacy management system audit conducted and the requirements imposed by the Information Systems Department (DSI). The aim of this strategy is to ensure the Group's compliance with data protection laws worldwide, and to integrate a security culture in line with our risk management values.

Consequently, the general principles of our actions are based on the Privacy Management System, organized into 14 key areas:

• Governance
• Awareness and training
• Data mapping
• Sharing, transfer and disclosure
• Lawfulness of processing
• Information and rights of data subjects
• Privacy by design and by default
• Accountability
• Data breach management and incident response
• Legal aspects
• Technical and organizational security measures
• Managing audits and compliance checks
• Relations and control with authorities
• Continuity and improvement

 

1.2 - Some definitions

Personal data

Personal data is "any information relating to an identified or identifiable natural person". A natural person may be identified directly (by surname, first name) or indirectly (by identifier).

 

Processing of personal data

The processing of personal data is "an operation, or set of operations, relating to personal data, regardless of the process used (collection, recording, organization, storage, adaptation, modification, retrieval, consultation, use, communication by transmission or dissemination or any other form of making available, alignment)". Processing may be computerized or paper-based.

Data Protection Officer

The Data Protection Officer (hereinafter "DPO" or "DPD") is "responsible for implementing compliance with the European Data Protection Regulation within the organization that has appointed him or her in respect of all processing carried out by that organization".

LSTI has appointed a personal data protection delegate whose contact details are as follows:

• Email: dpo@apave.com
• By post: 6 Rue du général Audran, 92400 Courbevoie, France

2.1 - Governance

LSTI's privacy management system is supervised by the DPO, who reports to the Apave Group General Secretariat.

The DPO coordinates compliance in each Group entity with the help of DPO Correspondents for each legal entity and Apave delegates. The DPO Correspondents are appointed by each General Manager and play an active role in ensuring the compliance of their reporting entity through the Privacy Management System and the monitoring of action plans. DPO Correspondents liaise with the Group DPO to ensure strategic alignment and effectiveness of global data protection and privacy compliance.

 

2.2 - Awareness and training plan

Awareness-raising and training for all LSTI employees is managed at Apave Group level and is a key element of the Privacy Protection Management System. Each year, an awareness-raising and training plan is drawn up with these objectives in mind:

• Improving knowledge to reduce risks and apply best practices
• Development of a security culture
• Compliance with personal data protection obligations.

To this end, a variety of communication tools are employed to achieve a real multi-channel impact: e-learning training courses for employees and managers, phishing simulation campaigns, intranet communication, awareness-raising in small groups, etc.

These communications, which can be national or international in scope, highlight the possible risks to LSTI's Information System. They also provide information on how to remedy these risks in the event of an incident, and above all on the simple methodologies to be applied to ensure the protection of personal data.

3.1 - Nature of processing

The processing of personal data carried out by us covers a wide range of operations, including: collection, recording, organization, structuring, storage, adaptation or modification, extraction, use, limitation, erasure or destruction.
The persons concerned by such processing are Customers, their employees and Customers of our Customers.
We undertake to collect and use only personal data that is strictly necessary and relevant to the purposes of our processing operations. We implement control procedures to ensure this, and we regularly adapt our services to minimize data collection.

 

3.2 - Purposes and legal basis of data processing

Each processing of personal data that we implement is based on a precise, legitimate and explicit purpose, as well as on a legal basis that complies with the regulations in force (RGPD).

We collect personal data directly from you, your employer or a duly authorized person, for the following purposes:

• Fulfillment of the contract or general terms and conditions: follow-up of the certification contract, preparation and execution of certification training courses, assessment, quality control, certification assessment, communication of observations, issue of the certification attestation.
• Legal and regulatory obligations: compliance with the legal and regulatory obligations to which we are subject.
• Consent: fulfillment of specific purposes after having obtained your explicit and positive consent.
• Legitimate interests: personalization of our offers according to your needs, security of our information system.

 

3.3 - Details of processing and data collected

We undertake to collect and use only the personal data strictly necessary for the administrative management, organization and completion of certification.

 

a) Processing of examination registration data :

We store personal data for the duration of the certification's validity (3 years):

• On our website: candidates agree to provide us with the following personal data: surname, first name, e-mail address, telephone number, information shared voluntarily, cookies, economic and financial data.
• Through a training organization: we collect the following data: surname, first name, e-mail address of the candidate, position, signature, additional time required to pass the exam, history of certifications already obtained.
• Through the candidate's company (ANSSI skills assessment): the company sends us the candidate's surname, first name, date and place of birth, CV, diplomas and employer's certificate. Candidates also provide their signature and e-mail address.
• Through the candidate's company (skills certification): we collect the following data: candidate's surname, first name, e-mail address, job title, signature, additional time required to pass the exam, history of certifications already obtained.

 

b) Processing of examination data:

We store personal data for the duration of the certification's validity (3 years):

• Identity verification: we consult the identity documents presented by candidates to verify their identity before the exam. The data is consulted by our external or internal assessors.
• Remote examinations via a remote surveillance platform: we collect the candidate's first and last name, connection data, remote surveillance images and video, and the candidate's assessment.
• Face-to-face exams : we collect the candidate's first and last name and assessment.
• Certification: we use the personal data generated following certification: date of certificate issue, assessment, certification. The identity of the certified candidate may be published on the LSTI website under a COFRAC obligation.

c) Data processing for customer relations and business management purposes

We retain personal data for the duration of the contract, as well as for 2 years after the end of the contract.

We use your contact data (surname, first name, business details, job title) to monitor and manage the contract and related services. This also enables us to plan interventions and prepare reporting elements, if necessary.
We also store your consent to receive information (e.g. for news to which you subscribe), as well as your withdrawal of consent to processing and opposition to commercial prospecting.

 

d) External recruitment

As part of our external recruitment process via our website, we collect and process the personal data you voluntarily provide to us. This data includes :

• Identification data: surname, first name, e-mail address, telephone number, etc.
• Data relating to your professional life: Curriculum vitae, covering letter, diplomas, professional experience, skills, etc.

The collection of this information is necessary in order to evaluate your application and offer you job opportunities that match your profile. We keep your personal data for a period of two years from the date of your application, so that we can contact you again for future opportunities. At the end of this period, your data will be deleted, unless you authorize us to keep it for a further period.

 

3.4 - Recipients of personal data

The personal data we collect is intended for LSTI's internal departments in charge of providing services. We ensure that only authorized persons, within the scope of their functions, have access to data, either temporarily or permanently.
We may need to share personal data to comply with legal, regulatory or administrative obligations, or to detect, prevent or deal with fraudulent activities, security breaches or technical problems.
LSTI employees authorized to access personal data are subject to an obligation of confidentiality, in particular through their employment contract, the IT Charter and internal regulations.
We also transmit data to trusted third parties who process it on our behalf, according to our instructions, in compliance with the RGPD and in compliance with any appropriate security and confidentiality measures. In particular, we use the services of:

• Service providers to ensure data backup and hosting ;
• External assessors authorized by LSTI ;
• Service providers for online exams;

The current list of recipients is available on request.

 

3.5 Data transfers outside the EU

All personal data processed by LSTI and its subcontractors is hosted in France or in the European Union. Depending on the services provided and the customer's location, data may be transferred outside the European Union.

In the event that LSTI is required to transfer personal data to a third country or to an international organization, by virtue of EU law or the law of the Member State to which it is subject, we ensure that we use a legal transfer mechanism (standard contractual clauses or adequacy decision) making the transfer lawful. These clauses, supplemented by reinforced technical and organizational security measures, enable us to guarantee a level of data protection equivalent to that of the European Union, whatever the local legislation in the country of the subcontractor or service provider.

 

3.6 Privacy by design and by default

The Apave Group's project methodology includes an initial summary analysis of data protection impacts for all new projects. This first step ensures our responsibility. In line with the notion of accountability presented by the RGPD, the Apave Group undertakes, beyond its compliance, to be able to prove this compliance as well as the implementation of the processes necessary to control personal data. This means applying two key principles:

• Protecting data from the outset of a project (privacy by design)
• Protection of data taken into account by default (privacy by default).

Where necessary, a data protection impact analysis (DPIA) is carried out in greater depth. This analysis will make it possible to build a processing operation that complies with the RGPD and respects privacy. Recourse to this type of risk analysis is only made when a processing operation is likely to give rise to a high risk for the rights of your data as well as for the freedoms of the data subjects, taking into account the nature, scope, context and purposes of the processing operation.

Persons concerned by the processing of their personal data by LSTI have the right to retain control of their data. To this end, we undertake to respect :

• The right to clear, fair and transparent information on data processing.
• A right of access to transmitted data: the data subject may obtain from LSTI confirmation of whether or not his or her data is being processed, the purposes of the processing, the recipient of the data, any transfer of the data and a copy of the data.
• A right to rectify inaccurate or incomplete data: the data subject may obtain from us the rectification of his/her data if it proves to be erroneous or inaccurate.
• the right to object to certain processing operations, in particular those aimed at commercial prospecting
• the right to withdraw consent to data processing, without the effects of such withdrawal being retroactive
• A right to erase unlawfully processed data: the data subject has the right to be forgotten, but only if the data processing does not concern the performance of the contract and the contract has been terminated.
• A right to portability, enabling the data supplied to be received in a usable format for transmission to another service provider. Data portability applies only to data concerning the individual, to data transmitted directly, and only if processing is based on consent or contract.
• The right to restrict processing
• A right to give instructions concerning the retention, erasure and communication of data after death.

To exercise your rights, simply contact our DPO:

• Using the following form
• At the following address: dpo@apave.com
• or by post to the attention of the DPO at the following address: APAVE, 6 Rue du Général Audran, 92400 Courbevoie.

It is also possible to lodge a complaint with a Data Protection Supervisory Authority. In France, this is the CNIL.

We implement the necessary and appropriate organizational and technical security measures against any unauthorized access, modification, disclosure or destruction of the data we store. The Information System Security Policy (ISSP) can be consulted for details of these measures. The purpose of the ISP is to define the fundamentals of the Apave Group's information security, in order to preserve the confidentiality, integrity and availability of our information assets (personal data, customer & partner data, operational and strategic data, etc.), with the constant aim of maintaining a secure, high-quality service for our customers.

These measures include the following:

• We only collect the data required for the specific, explicit and legitimate purposes declared.
• LSTI employees, subcontractors, service providers and contacts who need access to personal data in order to carry out their roles, functions and responsibilities are
  • They are authorized to do so and have access that is strictly reserved for them
  • They have been sensitized and/or trained, depending on their roles, functions and responsibilities
  • They have signed a confidentiality agreement, and have been informed of the risks and penalties involved in breaching this obligation.
• We encrypt data when necessary

In the event of a breach of the data subject's personal data, likely to give rise to a risk to his or her rights and freedoms, our DPO will notify the CNIL of the breach as soon as possible, and if possible no later than 72 hours after becoming aware of it. LSTI will also inform the data subject, as soon as possible, in accordance with the provisions of Article 34 of the RGPD.