Data protection policy

1. Purposes of the Processing of Personal Data 

The KEDGE BUSINESS SCHOOL GROUP Association (hereinafter “KEDGE BUSINESS SCHOOL”) and the KEDGE BS ALUMNI Association are required to process personal data to the extent as such data are necessary for the performance of the contracts they enter into, for compliance with regulatory obligations, or when they are collected in the legitimate interest of the Associations (in particular in the promotion and management of the Alumni Network).

When processing the personal data of data subjects assumes their consent, KEDGE BUSINESS SCHOOL shall put in place a mechanism to collect their consent in an unambiguous, specific, free, and informed manner.

The data subjects are graduates of KEDGE BUSINESS SCHOOL (alumni), students enrolled in a KEDGE BUSINESS SCHOOL programme, members of the KEDGE BS ALUMNI Association, as well as representatives of companies that offer internships and/or jobs.

The personal data of the data subjects are subject to being processed either electronically or on paper in order to monitor and manage contractual relations and all obligations arising therefrom, including but not limited to:

• The administrative management of members of the Professional Network;
• The administrative management of members of the KEDGE BS ALUMNI Association;
• The promotion and activities of the Professional Network;
• The creation and management of the KEDGE BUSINESS SCHOOL graduate directory;
• The linking of contacts for the purpose of internship and/or job search or mentoring;
• The management of access to the website https://www.kedgebs-alumni.com/fr;
• The carrying out of prospecting, in particular the sending of newsletters;
• The payment of subscriptions and donations made to the KEDGE BS ALUMNI Association;
• The monitoring of participation in events and services offered to the Network; and
• The conduction of surveys, polls, or statistical processing.

2. Recipients of the Processed Data 

The data are intended for the following:

A. Within KEDGE BUSINESS SCHOOL and KEDGE BS ALUMNI

• Persons in charge of Alumni management;
• Administrators of the KEDGE BS Alumni website https://www.kedgebs-alumni.com/fr (KEDGE BUSINESS SCHOOL staff); and
• Departments in charge of KEDGE BUSINESS SCHOOL's information systems.

B. Externally

Members of the Network can choose which data they want displayed in the online directory via the "Confidentiality" section of their private space: public access, access only to Members of the Network (students and graduates), access to Members of the Network and recruiters, or access to KEDGE staff.

Members of the Network can also, in the subscriptions section of their private space, choose to receive newsletters, information regarding services offered by the Network, or refuse to be contacted for surveys.

In general, data of the data subjects are transmitted to:

• Students and graduates of the Network;
• KEDGE staff - to enable them to manage the Network;
• KEDGE partners - to know: (i) graduates who run clubs and branches and to whom to send the lists of people registered for the events they run, (ii) recruiters who have chosen to pay access to the KEDGE Alumni database for recruitment purposes, and (iii) companies specialised in carrying out surveys and statistics (in particular with regard to educational establishment rankings); and
• Technical and IT subcontractors of KEDGE BUSINESS SCHOOL.

C. With Authorised Third-Parties and Administrations

When KEDGE BUSINESS SCHOOL and/or KEDGE BS ALUMNI must satisfy their legal obligations or at the request of any judicial or administrative entity having authority.

D. Outside the European Union

In the event that the data of the data subjects are transferred outside the European Union, KEDGE will ensure that:

• Personal data are transferred to countries recognised by the European Commission as offering an adequate level of protection, or
• Personal data are transferred to entities certified under the Privacy Shield, or
• He or she has recourse to mechanisms that will ensure the appropriate guarantees as provided for by applicable regulations, in particular the adoption of the standard contractual clauses drawn up by the European Commission.

Contact KEDGE BUSINESS SCHOOL’s Data Protection Officer for further information on these topics, as well as a copy of the relevant documents.

3. Categories of Data Collected

Data are collected by KEDGE BUSINESS SCHOOL directly from the data subjects, or have been received from partners specialising in recruitment and organisation of admission exams.

In general, the types of data processed by KEDGE BUSINESS SCHOOL are as follows:

• Civil status and identification data;
• Personal contact details - postal, telephone, and electronic;
• Personal and professional status;
• Data on membership payments;
• Degrees received from KEDGE BUSINESS SCHOOL;
• Academic background;
• Groups the data subject has joined;
• CV, etc.;
• Identification data and website connection data;
• The results of non-anonymous surveys and polls; and
• Other data.

4. Data Security

KEDGE BUSINESS SCHOOL uses physical, organisational, technical, and software security measures - such as registries of authorised access - to protect data against any alterations, destruction, or unauthorised access.

These provisions are detailed in the General Data Protection Policy of KEDGE BUSINESS SCHOOL

5. Data Retention Period

Personal data processed by KEDGE BUSINESS SCHOOL and KEDGE BS ALUMNI are stored in accordance with data protection regulations and for the duration required by law.

These provisions are detailed in the General Data Protection Policy of KEDGE BUSINESS SCHOOL.

6. Exercise of Rights by Data subjects

KEDGE BUSINESS SCHOOL has appointed a Data Protection Officer to the CNIL, under number DPO-8113.

Upon simple request, and without having to provide a reason, any data subject may obtain a copy of any data relating to him or her.

In general:

• Each data subject has the right to request access to and rectification of his or her personal data;
• Each data subject has the right to request a limitation on the processing of his or her personal data (i) if he or she disputes the accuracy of his or her data during the period in which we can verify their accuracy, (ii) if he or she believes that KEDGE is unlawfully processing his or her data and requires a limitation on the use of their data rather than an erasure, (iii) if KEDGE no longer needs the data for the purposes referred to above but that data are still necessary for the observation, exercise, or defence of its rights in court, or (iv) in the event of the exercise of its right of rebuttal during the verification period as to whether the legitimate grounds pursued by KEDGE prevail over its own;

• Each data subject has the right to request deletion of his or her personal data. In the event of such a request to delete said data, KEDGE may nevertheless keep it in the form of an intermediate archive for the period necessary to meet its legal, accounting, and tax obligations;
• Each data subject has the right to request, at any time, to exercise his or her right of rebuttal for reasons relating to his or her particular situation;

• Each data subject has, at any time and without reason, the right to object to commercial prospecting;
• Each data subject has the right to exercise his or her right to the portability of data, which gives him or her the right to obtain a copy of personal data concerning him or her, or to transfer them to a third-party in a structured and commonly used format that can be read by a machine;
• Each data subject has the right to not be the subject of a decision based exclusively on automatic processing and producing legal effects concerning him or her or affecting him or her in a significant manner.
• Each data subject has the right to withdraw his or her consent at any time.

• Each data subject has the right to assert specific directives concerning the storage, erasure, and communication of his or her personal data post-mortem.

The above-mentioned rights may be exercised:

by email to: protectiondesdonnees@kedgebs.com 

or

by mail to: DPO-Avocats, attn. DPO of the Association Kedge Business School, 11, rue Théodule Ribot - 75017 Paris

If the request made is acceptable, KEDGE will reply to it within one month of receipt of the complete request and provide the requested information or implement the rights invoked within the above-mentioned period.

If, given the complexity of the request or the number of requests received, the above-mentioned deadline cannot be met, KEDGE will inform, before the expiry of the deadline, of the extension of its decision by a maximum of two months.

In any case, if any each data subject he or she considers himself or herself to be wronged, he or she has the right to file a complaint with the CNIL.

For more information, see the "Need Help" section on www.cnil.fr. You can also call the CNIL legal office on 01 53 73 73 22 22, Monday, Tuesday, Thursday, and Friday from 1O am to 12 pm and from 2 pm to 4 pm.