This English version is a translation provided for information purposes only. In the event of any discrepancy, the French version prevails.

In the course of its activities, the SMART service unit carries out processing of personal data relating to students, staff members, clients, prospects, partners and other persons with whom it has dealings.

These provisions aim to comply with Article 12 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, which requires that persons whose data is processed be informed in a concise, transparent, intelligible and easily accessible form about the nature of the processing and their rights regarding their data.

The General privacy policy describes how the SMART service unit complies with the provisions applicable to the processing of personal data.

In particular, the General Data Protection Regulation no. 2016/679 (GDPR), the French Data Protection Act no. 78-17 of 6 January 1978 as amended by Law no. 2018-493 of 20 June 2018 and Ordinance no. 2018-1125 of 12 December 2018, as well as any future provisions concerning such data.

It is supplemented by specific provisions relating to the use of certain applications, which are displayed when access to them is requested.

1 - Purpose of the general privacy policy

This General privacy policy aims to protect Personal data in cases where the SMART service unit is the Data controller.

2 - Applicable provisions

This General privacy policy is binding on:

  • the staff of the SMART service unit;
  • the service providers of the SMART service unit;
  • the recipients of Data to whom the service unit provides such Data;
  • the SMART service unit in its capacity as data controller.

Please refer to the tabs provided for each situation.

3 - General obligations

The SMART service unit undertakes to:

  • process Personal data only for the purposes described herein for each Processing operation, in particular the needs of the institution’s departments;
  • guarantee the confidentiality of the Personal data processed;
  • ensure that the persons authorised to process Personal data undertake to respect the confidentiality of such Data;
  • implement all technical, organisational and human resources needed to ensure the protection of Personal data.

4 - Data security and confidentiality

4.1 Commitments of the SMART service unit

The SMART service unit implements all appropriate physical, technical and organisational measures to ensure the protection of Personal data, and undertakes to develop these measures so that they always reflect the state of the art.

In particular, the SMART service unit puts in place logical and physical access restrictions and the network protections needed to ensure the security of Personal data, as well as any system needed to ensure the traceability of processing. It ensures the security of the data stored on its own servers, or on the servers of trusted service providers approved for the storage of activity data and documents produced and received by public bodies. The personal data collected through the website is stored on servers located in the European Union.

To ensure data security, the SMART service unit may call on any third party of its choice to carry out vulnerability tests whenever it deems necessary.

The SMART service unit ensures that the security and confidentiality of Personal data are respected by its officers, employees and temporary staff, as well as by external members of its deliberative bodies or boards.

The SMART service unit undertakes to inform its staff that any public officer or employee of the institution who becomes aware that they have received Data that should not have been sent to them, or who has access to Data they should not know about, must inform the institution’s Data Protection Officer without delay.

4.2. Data storage

The institution’s activity data and documents containing personal data are collected at the end of their primary use, classified, kept and disclosed in accordance with the provisions on public archives (contained in particular in Book II of the French Heritage Code). These texts, which incorporate the provisions of the GDPR, confirm the nature of “secondary purpose of collection” or “compatible purpose”. Archiving for legal purposes provides the time needed for individuals to exercise their rights. In addition, archiving for heritage or historical purposes is carried out in compliance with Article 89 of the GDPR. With regard to data archiving, the interaction between the GDPR and archive laws concerns in particular:

  • the possibilities of deletion and erasure: to protect rights, these possibilities are only available for data and documents not subject to archiving for legal purposes, which provides for all the measures needed to ensure their confidentiality;
  • the possibilities of anonymising and pseudonymising data, available exclusively for activity data and documents intended to become historical archives, and therefore falling under Article 89 of the GDPR.

The SMART service unit undertakes to inform the persons concerned, at the time of initial collection, of the possible archiving processing (for legal and/or historical purposes) of their data.

Through the contact form, your data is collected in order to respond to your requests and send you information about our services (brochures or explanatory documents). Through the contact form, we may collect the following information:

  • First and last name
  • E-mail address
  • Name of your organisation
  • Any other information you choose to send us in your message.

5 - Record of processing activities

In accordance with Article 30 of the GDPR, the SMART service unit keeps a record of all the personal data processing it carries out.

6 - Subcontracting

The SMART service unit reserves the right to use a subcontractor of its choice, including where this involves disclosing Personal data to the provider.

The SMART service unit expressly undertakes to require its Subcontractors, in particular in the written contracts concluded with them, to provide the same level of Personal data protection as that implemented by the SMART service unit, through appropriate technical and organisational measures, so that the intended processing meets the requirements of the applicable regulations.

The SMART service unit reserves the right to carry out, or have carried out, audits of its subcontractors to ensure compliance with the provisions on Personal data protection.

7 - Data Protection Officer

The SMART service unit has appointed a Data Protection Officer, who can be contacted:

8 - Rights relating to data processing

8.1 Statement of rights

In accordance with the regulations in force, the Data subject has the following rights:

  • right of access to Data (GDPR, art. 15): the right to obtain the information held by the SMART service unit;
  • right to rectification of Data (GDPR, art. 16): the right to request the correction of inaccurate or incomplete information;
  • right to erasure of Data (GDPR, art. 17) on one of the following grounds:
    • the Data is no longer necessary in relation to the purposes for which it was collected;
    • objection to the processing of the Data where there are no overriding legitimate grounds for continuing it;
    • the Data has been unlawfully processed;
    • the Data must be erased to comply with a legal obligation;
  • right to restriction of processing of Data (GDPR, art. 18);
  • right to portability of Data where it is processed by automated means based on consent or on a contract (GDPR, art. 20): obtaining the Personal data provided to the SMART service unit in a structured, commonly used and machine-readable format, for transmission to another data controller;
  • right to object to the processing of Data (GDPR, art. 21) at any time;
  • right to withdraw consent (GDPR, art. 13-2-c).

Please note that the deletion of Data and its anonymisation, which irreversibly prevent any identification, do not allow all of the above rights to be exercised.

8.2 Exercising your rights

The rights relating to the processing of Personal data carried out by the SMART service unit can be exercised by contacting the unit at smart@u-bordeaux.fr.

Please note that, as stated in Article 4.2 above, certain rules relating to public archives may limit the exercise of the rights of the persons concerned.

8.3 Lodging a complaint with the supervisory authority

A data subject who considers that Personal data has been processed in breach of their rights may lodge a complaint with the CNIL (the French data protection authority) at the following address: CNIL, 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online.

9 - Data breaches

The SMART service unit undertakes to notify the CNIL of any Personal data breach, under the conditions laid down by law.

Where such a breach is likely to result in a high risk to the Data subjects, the SMART service unit undertakes to inform them and to provide them with any useful recommendations.

10 - Requisition

Please note that the SMART service unit is required to disclose Data upon requisition by any authorised administrative, police or judicial authority.

11 - Specific provisions

Please note that the SMART service unit is bound by administrative rules on the periods of use and retention of Data, as well as by the rules on public archives applicable to higher education and research institutions and to national education services.

Ministerial instructions have established archiving tables: for each document, they specify the corresponding administrative use period (DUA), i.e. the period during which it may be kept on the institution’s premises as an archive necessary for its proper functioning, and what happens to the documents at the end of the DUA (destruction or transfer to the Departmental Archives). These instructions set the maximum retention periods that the SMART service unit of Bordeaux must observe.

12 - Changes

This General privacy policy may be amended at any time in the event of legislative or case law developments, as a result of decisions and recommendations of the CNIL, or of established practice.

The SMART service unit also reserves the right to make any amendments it deems useful to this General privacy policy.
Any amendment will result in an update of the validity date at the top of this General privacy policy.

Organisation responsible for data processing

SMART service unit
22 avenue Jean Babin - 33600 Pessac, France
smart@u-bordeaux.fr

Rights of data subjects

In accordance with the General Data Protection Regulation, users of this website may request:

  • to be informed of the nature of the personal data collected about them
  • access to the personal data concerning them
  • the rectification, restriction, portability or erasure of their data

These rights may be exercised with the Data Protection Officer and apply to all processing: smart@u-bordeaux.fr