Last updated: 18/03/26
1. Identity of the data controller
The data controller for personal data collected on this website is:
Conservatoire national des arts et métiers (Cnam)
on behalf of the Centre national d’étude des systèmes scolaires (Cnesco)
Address: 41 rue Gay-Lussac, 75005 Paris, France
Email: cnesco@lecnam.net
Telephone: +33 1 44 10 78 19
Joint liability
For the purposes of website hosting and technical administration, the Cnam and the University of Limoges act as joint controllers within the meaning of Article 26 of the GDPR.
A partnership agreement defines the allocation of responsibilities between the parties, in particular regarding hosting, technical administration and the functional management of the website.
Data subjects may exercise their rights by contacting the Cnam (contact details above), which centralises the processing of requests.
Data Protection Officer (DPO)
The Conservatoire national des arts et métiers has a Data Protection Officer you can contact:
Email: ep_dpo@lecnam.net
2. Purposes of Data Processing
The personal data collected on this website is processed for the following purposes:
| Purpose | Description |
|---|---|
| Newsletter | Management of subscriptions to the Cnesco newsletter. Link to the registration form.. |
| Audience measurement | Statistical analysis of website traffic and improvement of the services offered. |
Requests sent by email:
Requests sent by email to Cnesco (cnesco@lecnam.net ) are processed in the context of its activities. The data contained in these emails is retained for as long as necessary to process the request and in accordance with applicable legal obligations.
3. Legal basis for processing
In accordance with Article 6 of the GDPR, the processing of personal data on this website is based on the following legal grounds:
| Processing | Legal basis | Justification |
|---|---|---|
| Newsletter | Consent (Art. 6.1.a) | Voluntary registration via form |
| Audience measurement (Matomo) | Legitimate interest (Art. 6.1.f) | Website improvement, in line with the CNIL’s recommendations for Matomo configured under the consent exemption |
| Embedded content (YouTube, OpenStreetMap) | Consent (Art. 6.1.a) | Display is conditional on the user’s explicit consent |
| Handling of requests | Legitimate interest (Art. 6.1.f) | Responding to requests received |
4. Recipients of the data
Personal data is intended for the following categories of individuals:
Internal recipients
- Cnesco departments responsible for handling contact requests and newsletter management.
Processors
| Subcontractor | Purpose | Country | Warranties |
|---|---|---|---|
| University of Limoges (IT Dept) | Website hosting and technical administration | France | [TO BE CONFIRMED: GDPR processing agreement being finalised / in place with the University of Limoges] |
| University of Limoges (IT Dept) | Technical hosting of the Matomo tool | France | Acts as processor for this processing activity |
| Brevo (formerly Sendinblue) | Newsletter delivery | France / European Union | Brevo acts as a processor within the meaning of the GDPR. Privacy Policy: https://www.brevo.com/legal/privacypolicy/ |
Third-party content
When you consent to the display of embedded content:
| Service | Content type | Privacy Policy |
|---|---|---|
| YouTube / Google | Videos | https://policies.google.com/privacy |
| OpenStreetMap | Mapping | https://osmfoundation.org/wiki/Privacy_Policy |
YouTube/Google servers are located in the United States. A data transfer may occur if you consent to the display of this content.
5. Data transfers outside the European Union
The following may involve transfers outside the EU:
- YouTube / Google : If you consent to the display of YouTube videos, data may be transferred to the United States. Google LLC is certified under the Data Privacy Framework (EU-US framework), subject to the validity of that mechanism.
- Google Fonts : If the website uses Google Fonts, these are hosted by Google. If used, a data transfer to the United States may occur. Google LLC is certified under the Data Privacy Framework: https://policies.google.com/privacy
- Autres services : Matomo (hosted by the University of Limoges), Brevo and website hosting appear to be located in France/EU.
6. Retention periods
Personal data is retained for a limited period of time, determined based on the purpose of the processing and applicable legal obligations:
| Processing | Duration | Justification |
|---|---|---|
| Newsletter | 3 years from last interaction (click or opening). | Communication management and tracking of subscriber interactions |
| Connection data (logs) | [To be confirmed with the hosting provider] | Website security and administration |
| Session cookies | Duration of the session | Until browser is closed |
| Cookies de préférences | 13 months | CNIL recommendation |
Data is deleted or anonymised upon expiry of the indicated retention periods.
7. Rights of data subjects
In accordance with Articles 15 to 22 of the GDPR and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right of access | Obtain confirmation that your data is being processed and receive a copy |
| Right to rectification | Request the correction of inaccurate or incomplete data |
| Right to erasure | Request the deletion of your data (within legal limits) |
| Right to restriction | Request the temporary suspension of processing |
| Right to data portability | Receive your data in a structured, machine-readable format |
| Right to object | Object to processing on legitimate grounds |
| Right to withdraw consent | At any time, for processing based on consent |
How to exercise your rights
To exercise these rights, please send your request to:
Email: cnesco@lecnam.net
Postal address:
Centre national d’étude des systèmes scolaires (Cnesco)
41 rue Gay-Lussac
75005 Paris
France
You may also contact the Cnam’s DPO: ep_dpo@lecnam.net
Right to lodge a complaint
If you consider that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with:
Commission nationale de l’informatique et des libertés (CNIL)
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
Site web : https://www.cnil.fr
8. Whether the provision of data is mandatory or optional
| Processing | Character | Consequences of failure to provide |
|---|---|---|
| Newsletter | Optional | Unable to receive the newsletter |
| → Field “Email address” | Required (marked with an asterisk) | Unable to register |
| → Fields “Last name” and “First name” | Optional | Registration possible without this information |
9. Automated decisions and profiling
The cnesco.fr website does not carry out any automated decision-making or profiling of users’ personal data.
10. Cookies and trackers
For more information on the use of cookies and trackers on this website, please consult:
- Cookie management: accessible via the “Manage my cookies” link at the bottom of each page.
- Politique de cookies : accessible via the “Cookie policy” link at the bottom of each page.
11. Data Security
[To be confirmed with the University of Limoges]
Cnesco and Cnam implement appropriate technical and organisational measures to protect personal data against any unauthorised access, modification, disclosure or destruction.
These measures include, in particular:
- Access protection measures (access control, authentication);
- Data protection measures (encryption of communications via HTTPS protocol);
- Monitoring and logging measures.
12. Changes to this statement
This privacy policy may be updated at any time in the event of legislative, regulatory or processing changes.
The date of the last update is indicated at the top of this document.
