
1. Introduction
Toulouse School of Aviation and Aerospace Engineering (TSAAE) is a joint trademark registered by ENAC and ISAE-SUPAERO, with the aim of jointly offering international higher education programmes covering a wide range of needs in the aerospace and air transport sector.
When you contact the TSAAE teams, they may collect, process, store and protect your personal data.
The purpose of this Privacy notice is to outline the organisation’s data processing and the legal basis for it and to explain your rights in this regard.
2. Data controllers and data protection officers
ENAC, 10 avenue Edouard Belin BP 54032 – 31055 Toulouse Cedex 4, France, Public Scientific, Cultural and Professional Institution (Établissement Public à caractère Scientifique, Cultural and Professional – EPSCP) SIRET no. 193 112 562) and ISAE-SUPAERO 7, Avenue Marc Pelegrin, 31055 – Toulouse Cedex 4, France, EPSCP, SIRET n°130 004 278 00011 (together, the « institutions »), are joint data controllers.
Each institution has appointed a data protection officer (DPO), whose contact details are below:
For ENAC: dpo@enac.fr
For ISAE-SUPAERO: dpo@isae-supaero.fr
For any specific request relating to the processing of personal data within the TSAAE programme, or to find out more about the joint controller agreement between ENAC and ISAE-SUPAERO, please write to contact@tsaae.fr
3. Description of the processing of your personal data
There are two possible scenarios: you are a prospective student interested in TSAAE courses (first scenario) or you are applying for a course (second scenario).
First case
Handling your request about the course(s) in which you are interested, or other TSAAE events and services, requires the processing of personal data ENAC and ISAE-SUPERO.
Purpose of data processing – Purposes
The purpose of processing is to provide information about the course(s) and/or events offered by the TSAAE. This may involve communication relating to a specific request or the sending of newsletters about TSAAE, if you consent.
Legal basis
This data processing is based on the consent of the user, collected via a form at the time of collection of their personal data. You may withdraw your consent at any time by writing to contact@tsaae.fr or by clicking on the unsubscribe links at the bottom of TSAAE email communications.
In the context of email or telephone exchanges to respond to a request you have submitted to TSAAE, the processing of your personal data is justified by the legitimate interest of the institutions in ensuring the efficient processing of requests for information received concerning the training courses offered.
Data processed – Categories of data processed
Personal and contact data:
· Title
· Surname
· First name
· Nationality
· Gender
· Home address and main address
· Personal mobile phone number
· Personal email address
· Affiliated organisation (potentially several)
· Work address
· Faculty or department
· Direct telephone number
· Work mobile phone number
· Work email address
· Scholarship
Marketing data:
· Type of contact: prospect, influencer, etc.
· How did you hear about us: phone call, email, trade show, application site, referral, teacher, website, events, etc.
· Any additional information about yourself that you choose to provide in your communications with the TSAAE.
Data source
The data is provided by the user via:
a meeting at a forum or trade fair
a telephone call initiated by a person interested in TSAAE courses
the TSAAE website via a form
contacts from the databases of the establishments (ENAC or ISAE-SUPAERO)
Mandatory nature of data collection
Not all information is mandatory; the information that must be provided is indicated on the forms and may include, namely, the surname, first name and contact details.
Automated decision-making
The processing does not involve automated decision-making.
Individuals concerned by processing
Data processing concerns individuals who contact the TSAAE for information about one or more educational courses and/or who agree to be contacted by the TSAAE about other courses or upcoming events.
Recipients of the data – Categories of recipients
The recipients of the data are:
· the TSAAE marketing departments (which include the ENAC and ISAE-SUPAERO marketing departments)
· TSAAE’s education and admissions departments (which include the ENAC and ISAE-SUPAERO admissions departments)
· the IT departments of ENAC and ISAE-SUPAERO
· technical suppliers supporting the software and IT systems used.
Second case
The processing of your application by the TSAAE is a personal data processing operation managed by the TSAAE.
Purpose of data processing – Purposes
The purpose of the processing is to process personal data in order to process your application for one or more educational courses offered by the TSAAE.
The institutions may also carry out statistical studies on the number and sources of applications received, especially to better understand trends and the composition of applications or to make multi-year or end-of-year projections. These analyses involve the processing of raw data relating to applications, including personal data of applicants necessary to establish the data sets used.
Legal basis
This data processing is based on its necessity for a task carried out in the public interest. In this regard, each institution, in its capacity as a public scientific, cultural and professional institution, has an educational mission (ISAE-SUPAERO’s mission is to train highly qualified engineers, managers and PhDs in the fields of aeronautics space and related fields, and ENAC’s mission is to train professionals in the field of air transport).
Thus, the processing of personal data to manage applications for the educational courses offered is based on its necessity for the performance of tasks in the public interest pursued by the institutions. The statistical analysis of the data mentioned above is based on the legitimate interest of the institutions in analysing and improving their practices within the framework of the TSAAE.
Data processed – Categories of data processed
· Title
· Surname
· First name
· Nationality
· Date of birth
· Email
· Address
· Postcode
· City
· Country
· Country of birth
· Country of your original institution
· Original institution
· Date of graduation
· Year of graduation
· City of birth
· Telephone number
· Scholarship awarded
· Comments and feedback from the admissions team and selection panels
· Admissions panel decisions
Data sources
The data is submitted by the user via a software solution for managing applications, available via an online interface.
Mandatory nature of data collection
The information marked as mandatory on the application platform is mandatory, as it must be provided in order for the application to be considered.
Automated decision-making
The processing does not involve automated decision-making.
Data subjects
The data processing concerns persons who apply to the TSAAE.
Recipients of the data – Categories of recipients
The recipients of the data are:
· the TSAAE admissions department (which includes the ENAC and ISAE-SUPAERO admissions departments)
· TSAAE marketing teams (including the ENAC and ISAE-SUPAERO marketing departments)
· ENAC training managers and study inspectors and ISAE-SUPAERO programme directors
· The training directors for ISAE-SUPAERO and the Director of Studies and Research
· Members of the admissions panel during the application phase
· ENAC and ISAE-SUPAERO IT departments
· Technical subcontractors who support the tools used.
4. Data transfers outside the EU
The processing of personal data in the contexts described above is performed using IT tools hosted on servers within the European Union. In particular, the application management platform is hosted on servers in France.
Institutions may also use office automation and communication tools provided by the Microsoft group, which involve the processing of certain limited information concerning prospects and candidates. The use of these tools may allow access to personal data in third party countries where Microsoft is present, in particular the United States.
When the institutions use these tools, data transfers are governed by a mechanism provided for by the GDPR, namely the signing of standard contractual clauses (SCCs) with Microsoft, combined with additional measures. You can view the text of the SCCs via the following link:
https://commission.europa.eu/law/law-topic/data-protection/international-dimension-dataprotection/standard-contractual-clauses-scc_en
In addition, Microsoft is certified as compliant with the EU-US Data Privacy Framework. See https://www.dataprivacyframework.gov/list
5. Data retention periods
Data is retained for the purpose of communicating with the applicant for a period of 3 years from the date of collection or the last contact with the data subject.
Data relating to applications is kept for the time necessary to process the application and may then be archived for an additional period, taking into account the applicable statutory limitation periods, the recommendations of the French Data Protection Authority (CNIL) and the applicable rules on public archives (in particular Articles L212-1 et seq. and Articles R212-1 et seq. of the French Heritage Code).
6. Security
Security measures are implemented in accordance with the information system security policies (PSSI) of ENAC and ISAE-SUPAERO, derived from the French State’s PSSI.
7. Your rights regarding your personal data
You may access and obtain a copy of your personal data (« right of access »), object to the processing of such data (« right to object »), have it corrected (« right to rectification ») or deleted (« right to erasure »). You also have the right to restrict the processing of your data, the right to request your personal data in a usable electronic format and/or the transfer of this data to another organisation (« right to portability »).
If the processing of your data is based on your consent, you have the right to withdraw your consent. In this case, the lawfulness of the processing carried out before the withdrawal of consent is not affected.
You also have the right to define guidelines for the storage, erasure and communication of your personal data after your death.
Exercising your rights
The ENAC Data Protection Officer (DPO) and the ISAE-SUPAERO DPO are your contacts for any requests to exercise your rights regarding this processing.
ISAE-SUPAERO: dpo@isae-supaero.fr
ENAC: dpo@enac.fr
Complaints to the CNIL
If, after contacting us, you feel that your rights regarding your data have not been respected, you can submit a complaint to the CNIL. You can access the CNIL’s « Online complaints » section at https://www.cnil.fr/fr/plaintes.
For any specific requests relating to the processing of personal data within the framework of the TSAAE, you can also write to contact@tsaae.fr