3.1 – Nature of processing

The processing of personal data that we carry out includes a wide range of operations, including: collection, recording, organization, structuring, storage, adaptation or modification, extraction, use, limitation, erasure or destruction.

The data subjects concerned by these processing operations are Customers, their
employees and the Customers of our Customers.

We are committed to collecting and using only the personal data that is strictly necessary and relevant to the purposes of our processing.

We implement control procedures to ensure this and regularly adapt our services to minimize data collection.

3.2 – Purposes and legal bases of processing

Each processing of personal data that we implement is based on a specific, legitimate and explicit purpose, as well as on a legal basis in accordance with the regulations in force (GDPR).

We collect personal data directly from you, your employer or a duly authorized person, for the following purposes:

• Execution of the contract or general conditions : monitoring of the certification contract, preparation and delivery of certification training, evaluation, quality control, certification assessment, communication of observations, delivery of the certification certificate.
• Legal and regulatory obligations : compliance with the legal and regulatory obligations to which we are subject.
• Consent : carrying out specific purposes after obtaining your explicit and positive consent.
• Legitimate interests : personalization of our offers according to your needs, security of our information system.

3.3 – Details of processing and data collected

We are committed to collecting and using only the personal data strictly necessary for the administrative management, organization and execution of the certification.

a) Processing of data relating to registration for an exam :

We keep personal data for the duration of the certification’s validity (3 years).

• On our website: candidates consent to provide us with the following personal data: last name, first name, email address, telephone number, information shared voluntarily, cookies, economic and financial data.
• Through a training organization: we collect the following data: candidate’s last name, first name, email address, job title, signature, additional time required to take the exam, history of certifications already obtained.
• Through the candidate’s company (assessment of skills on ANSSI repositories): the company provides us with the last name, first name, date and place of birth, CV, diplomas, as well as the employer’s certificate. Candidates also provide their signature and email address.
• Through the candidate’s company (skills certification): we collect the following data: candidate’s last name, first name, email address, job title, signature, additional time required to take the exam, history of certifications already obtained.

b) Processing of data relating to taking the exam :

We keep personal data for the duration of the certification’s validity (3 years).

• Identity verification: we consult the identity documents that candidates present to verify their identity before the exam. The data is consulted by our external or internal evaluators.
• Online exams : we collect the last name, first name, login data, surveillance images and videos, as well as the candidate’s evaluation via our Tixeo tool.
• In-person exams : we collect the candidate’s last name, first name and evaluation.
• Issuance of certification : we use the personal data generated following the certification: date of issuance of the certificate, evaluation, certification. The identity of the certified candidate may be published on the LSTI website under a COFRAC obligation.

c) Data processing for customer relationship and business management

We keep personal data for the duration of the contract, as well as 2 years from the end of the contract.

We use your contact data (last name, first name, professional contact details, job titles) to ensure the monitoring and management of the contract and the services related to it. This also allows us to plan interventions and prepare reporting elements, if necessary.

We also store your consents to receive information (for example, for the news to which you subscribe), as well as your withdrawals of consent to processing and opposition to commercial prospecting actions).

d) External recruitment

As part of our external recruitment process via our website, we collect and process the personal data that you provide to us voluntarily. This data includes:

• Identification data: Last name, first name, email address, telephone number, etc.
• Data relating to your professional life: Curriculum vitae, cover letter, diplomas, professional experience, skills, etc.

The collection of this information is necessary to evaluate your application and offer you job offers corresponding to your profile. We keep your personal data for a period of two years from your application, in order to be able to contact you again for potential opportunities. At the end of this period, your data will be deleted, unless you authorize us to keep it for an additional period.

3.4 – Recipients of personal data

The personal data we collect is intended for the internal LSTI departments responsible for carrying out the services.

We ensure that only authorized persons, within the scope of their duties, have access to the data, either temporarily or permanently.

We may be required to share personal data to comply with legal, regulatory or administrative obligations, or to detect, prevent or address fraudulent activities, security breaches or technical problems.

LSTI employees authorized to access personal data are subject to an obligation of confidentiality, in particular through their employment contract, the IT Charter and the internal regulations.

We also transmit data to trusted third parties who process it on our behalf, according to our instructions, in accordance with the GDPR and in compliance with all appropriate security and confidentiality measures.

In particular, we use:

• service providers to ensure data backup and hosting;
• external evaluators authorized by LSTI;
• service providers to ensure the taking of online exams;

The updated list of recipients is available on request.

3.5 Data transfers outside the EU

All personal data processed by LSTI and its subcontractors is hosted in France or the European Union.

Depending on the services and the location of the customer, data may be transferred outside the European Union.

In the event that LSTI is required to transfer personal data to a third country or an international organization, under Union law or the law of the Member State to which it is subject, it will inform the Client or the data subject of this legal obligation before each transfer, unless the law concerned prohibits such information for important reasons of public interest.

3.6 Privacy by design and by default

The Apave Group’s project methodology includes in its processes an initial summary analysis of the impacts relating to data protection for any new project.

This first step ensures our accountability. In line with the notion of accountability presented by the GDPR, the Apave Group is committed, beyond its compliance, to being able to prove this compliance as well as the implementation of the processes necessary for the control of personal data.

This involves the application of two key principles:

• Data protection from the design of the project (privacy by design)
• Data protection taken into account by default (privacy by default)

Where applicable, a data protection impact assessment (DPIA) is carried out in more detail. This analysis will make it possible to build a processing operation that complies with the GDPR and respects privacy. The use of this type of risk analysis is only done when a processing operation is likely to create a high risk to the rights of your data as well as to the freedoms of the data subjects, taking into account the nature, scope, context and purposes of the processing.