Privacy Policy & Personal Data Protection
Effective date: August 24, 2026.
This Privacy Policy informs visitors to the website https://apertascientia.io, applicants, learners, and partners about how Aperta Scientia collects, uses, protects, and retains their personal data in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
1. Data Controller
The personal data controller is:
- Aperta Scientia — French simplified joint-stock company (SASU)
- Share capital: €1,000
- Registered office: 24 rue de Saint-Nom, 78100 Saint-Germain-en-Laye, France
- Registration: Versailles RCS — SIREN 104 023 361 (SIRET 104 023 361 00017)
- Legal representation: Represented by its President
- General contact:
[email protected]— +33 1 85 39 02 26 - Data Protection / Privacy contact:
[email protected]
2. Personal Data We Collect
We strictly observe the principle of data minimization, collecting only data necessary for processing purposes:
- Identity and contact data: First name, last name, email address, phone number, postal address.
- Application and professional background data: Curriculum Vitae (CV), academic level, educational background, professional experience, employment status, career goals, training expectations, funding plans.
- Pedagogical tracking and assessment data (Learners): Student identifier, attendance logs and synchronous electronic sign-in records, lab project assignments, capstone project deliverables, intermediate and final assessments, Red Hat Learning Subscription (RHLS) platform identifiers, official Red Hat certification examination results.
- Billing and contractual data: Corporate billing details, signed training agreements, funding approval letters (OPCO subrogation), quotes, invoices, payment records (no credit card details are stored on our servers).
- Accessibility & accommodation data (Disabled persons / PSH): Strictly non-medical functional details regarding required technical or pedagogical accommodations, processed exclusively on the basis of explicit consent.
- Technical and browsing data: Anonymized IP address, server connection and security logs, browser type, and operating system.
3. Processing Purposes and Legal Bases
Each processing activity is based on a legitimate legal basis pursuant to Article 6 and Article 9 of the GDPR:
| Purpose | Data Categories | Legal Basis (GDPR) |
|---|---|---|
| Handling contact and information requests | Identity, contact details, message | Legitimate interest / Consent (Art. 6.1.a & f) |
| Processing candidate applications and selection | Identity, CV, background, prerequisites, motivation | Pre-contractual measures (Art. 6.1.b) |
| Administrative and pedagogical delivery of training (399h) | Identity, training agreements, attendance, evaluations, exams | Contract performance (Art. 6.1.b) |
| Provisioning official Red Hat lab and RHLS accesses | Name, email address | Contract performance (Art. 6.1.b) |
| Disability accommodations & accessibility support | Pedagogical adjustment details | Explicit consent (Art. 9.2.a) |
| Invoicing, OPCO subrogation, and statutory accounting | Billing contacts, agreements, invoices | Legal obligation (Art. 6.1.c - Commercial Code) |
| Regulatory compliance for vocational training (Qualiopi, DREETS) | Proof of attendance, evaluation records, certifications | Legal obligation (Art. 6.1.c - Labour Code) |
| Website security, fraud prevention, and system maintenance | Technical logs, anonymized IP | Legitimate interest (Art. 6.1.f) |
4. Data Recipients and Processors
Collected data is primarily intended for authorized internal personnel at Aperta Scientia (academic management, admissions, administration).
Within the strict scope of delivering our services and meeting statutory compliance requirements, data may be shared with trusted processors and institutional partners:
- Vercel Inc.: Website infrastructure and hosting (https://vercel.com).
- Google LLC (Google Workspace): Corporate email, secure application forms, collaborative tools, and cloud document storage.
- Red Hat, Inc.: Red Hat Learning Subscription (RHLS) provisioning, access to virtual lab environments, and official certification examination management.
- Olinda SAS (Qonto): Banking administration and invoicing management.
- Funding bodies and competent authorities: Skills operators (OPCOs), French public employment service (France Travail), regional employment and labor directorates (DREETS), and accredited Qualiopi quality auditors.
Strict Commitment: Aperta Scientia does not sell, lease, or commercialize personal data to third parties under any circumstances.
5. International Data Transfers
Aperta Scientia prioritizes hosting and processing data within the European Union.
Where technical processors or partners (including Vercel, Google, Red Hat, Discord) operate in third countries outside the European Economic Area (such as the United States), transfers are safeguarded through:
- Adequacy decisions adopted by the European Commission (including the EU-US Data Privacy Framework);
- Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring equivalent GDPR data protection safeguards.
6. Data Retention Periods
Aperta Scientia applies proportionate retention schedules aligned with statutory requirements:
| Data Category | Active Retention Period | Statutory Archive / Reference |
|---|---|---|
| Contact inquiries / Prospective clients | 3 years from the last contact | Permanent deletion thereafter |
| Unsuccessful candidate applications | 2 years from notification | Permanent deletion (or upon immediate request) |
| Learner records & educational proofs | Duration of the 399h program | 5 years post-training (Qualiopi / DREETS / OPCO audits) |
| Invoices, agreements, accounting records | Current financial year | 10 years (French Commercial Code L.123-22) |
| Disability accommodation records | Duration of training | Immediate deletion upon program completion |
| Server and connection logs | 1 year maximum | Statutory log retention requirements |
7. Your Statutory Rights
In accordance with Articles 15 to 22 of the GDPR and applicable privacy legislation, you hold the following rights:
- Right of access (Art. 15 GDPR): Obtain confirmation of whether your data is processed and receive a complete copy.
- Right to rectification (Art. 16 GDPR): Correct inaccurate, obsolete, or incomplete personal information.
- Right to erasure / Right to be forgotten (Art. 17 GDPR): Request deletion of your data when retention is no longer justified (subject to statutory audit and accounting requirements).
- Right to restriction of processing (Art. 18 GDPR): Temporarily restrict the processing of your data under statutory conditions.
- Right to object (Art. 21 GDPR): Object at any time, on legitimate grounds, to the processing of your personal data.
- Right to data portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
- Post-mortem directives: Define instructions regarding the retention, erasure, and communication of your personal data after your death.
How to Exercise Your Rights
To exercise your statutory rights or submit any inquiry regarding personal data protection:
- By email:
[email protected] - By postal mail:
Aperta Scientia SASU — Data Protection
24 rue de Saint-Nom, 78100 Saint-Germain-en-Laye, France
Aperta Scientia will respond within a maximum period of one (1) month following receipt of your request.
8. Right to Lodge a Complaint
If you consider that your statutory rights are not being respected after contacting us, you have the right to lodge a complaint with the French Data Protection Authority:
- Commission Nationale de l’Informatique et des Libertés (CNIL)
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Phone: +33 1 53 73 22 22
- Website: https://www.cnil.fr
9. Requirement to Provide Personal Data
When applying for or enrolling in our programs (AS200 DevOps, AS300 AI), providing required data is necessary to evaluate entry prerequisites, prepare the formal training agreement, and provision official vendor lab environments. Failure to provide such information prevents Aperta Scientia from processing your enrollment.
10. Cookies & Audience Analytics (Zero-Cookie Policy)
Aperta Scientia strictly adheres to a Privacy by Design standard:
- Zero tracking or advertising cookies: the website https://apertascientia.io sets no third-party cookies, no advertising trackers, and no commercial pixels on your device.
- Privacy-compliant & anonymized audience measurement (Vercel Web Analytics): website traffic and performance metrics are collected through an anonymous, cookie-less analytics solution (no cookies set, no cross-site tracking, and no raw IP address retention). In full compliance with CNIL guidelines and European GDPR standards, this privacy-preserving audience measurement is strictly exempt from prior consent requirements.
- Temporary technical session storage: a single session variable (
sessionStorage) may be used temporarily to preserve your language preference during navigation. It is automatically deleted as soon as your browser tab is closed.
11. Data Security Measures
Aperta Scientia implements appropriate technical and organizational measures to ensure security proportionate to risks:
- Systematic encryption of data in transit via HTTPS / TLS;
- Role-based access control (RBAC) and strong authentication protocols for authorized personnel;
- Hosting on audited, certified cloud infrastructure;
- Redundant data backups and disaster recovery protocols;
- Regular team training on data privacy and security best practices.
12. Automated Decision-Making and Profiling
Aperta Scientia does not engage in any automated decision-making or profiling producing legal or significant effects. Every program application is subjected to individual human and pedagogical review.
13. Policy Updates
This Privacy Policy may be updated periodically to reflect evolutions in our pedagogical services, technological infrastructure, or statutory regulations. The effective date at the top of this document will indicate the latest revision.
For any questions, reach out to [email protected].