Privacy policy

The Institut de l'Engagement, in its capacity as Data Controller, is particularly attentive to the protection and respect of your privacy.
The purpose of this privacy policy is to tell you how it collects, uses and shares your Personal Data, via the website and/or through any digital or paper medium, in accordance with the French Data Protection Act of 6 January 1978, as amended, and the General Data Protection Regulation, in force since 25 May 2018.

More specifically, the Institut de l'Engagement undertakes to respect the following principles:

your personal data is processed lawfully, fairly and transparently
your personal data is collected for specified, explicit and legitimate purposes and is not further processed in a way incompatible with those purposes
your personal data are stored in an appropriate and relevant manner and are limited to what is necessary for the purposes for which they are processed
your personal data is accurate, kept up to date and all reasonable measures are taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is deleted or rectified without delay.

To ensure compliance with these rules and principles, the Institut de l'Engagement has appointed a Data Protection Officer (DPO), who is the main contact for the Commission Nationale de l'Informatique et des Libertés (CNIL) and the organisation's point of reference on data protection issues.

1 - Definitions

"Personal data or "Data means any information relating to an identified or identifiable natural person. An "identifiable natural person" is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, Location Data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
"Sensitive data means Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of Genetic Data, Biometric Data for the purpose of uniquely identifying a natural person, Data concerning health or Data concerning the sex life or sexual orientation of a natural person. The Institut de l'Engagement does not process any sensitive data.
"Data controller means the Institut de l'Engagement, which, alone or jointly with others, determines the purposes and means of the processing. In this case, it is the Institut de l'Engagement.
"Regulations means Regulation No. 2016/679 of the European Parliament and of the Council of 27 April 2016, in force since 25 May 2018, on the protection of individuals with regard to the processing of Personal Data and on the free movement of Data (RGPD) and the Data Protection Act No. 78-17 of 6 January 1978 as amended.

2 - The data we collect

Through our website and any discussions we may have, we may collect and process the following Data:

The data we collect from applicants during the orientation and admission procedure for the purpose of processing applications:
- Identification data: first name, surname, email address, postal address, telephone number, date, town and country of birth;
- Data relating to the application: educational background, professional or voluntary experience, values and interests, personal project and motivations, contact details of referees (tutor and witness).

The data we collect as part of the mentoring programme from candidates, then mentees and mentors:
- Identification details: first name, surname, email address, postal address, telephone number
- Application details: educational background, qualifications, professional experience

The data we collect from VolunteersAll volunteers, whether they are examiners, members of the jury, sponsors or moderators, must register on our website partenaire.engagement.fr (identification data, or other data depending on the type of assignment requested, in order to meet the needs of the Institut de l'Engagement and the wishes of the volunteers).
The information we collect when you make a donation :
Donations support our commitment to young people. In order to receive donations, send tax receipts and inform you of the use made of our resources, in particular those coming from public generosity, we are required to process identification data: email, title, first name, surname, address, town, postcode, country and date of birth.
The Data we collect via cookies and other trackers :
The engagement.fr website uses cookies subject to the user's consent. They are installed on the user's computer during browsing. A cookie is an electronic file placed on a terminal (computer, tablet, smartphone, etc.) and read, for example, when a website is consulted, an e-mail is read, software or a mobile application is installed or used, regardless of the type of terminal used (source).
When browsing this site, cookies from the Institut de l'Engagement website and/or third-party companies may be placed on your terminal.
When browsing this site for the first time, a banner explaining the use of cookies will appear. By continuing to browse the site, Internet users will be deemed to have accepted the use of cookies. The consent given will be valid for a period of six (6) months. The user may deactivate cookies using their browser settings.
All the information collected will be used solely to monitor the volume, type and configuration of traffic using this site, to develop the design and layout of the site and for other administrative and planning purposes and, more generally, to improve the service we offer you. The lifetime of these cookies is six months.
For more information on the use, management and deletion of "cookies", for any type of browser, please consult this link.
Sensitive data :
The Institut de l'Engagement does not process any sensitive data.

3 - Conservation periods

Data from candidates, their witnesses and tutors : current year + 2 years from the date of application.
Data from mentoring candidates : 6 months after the end of the mentoring programme.
Data from mentees and mentors : 6 months after the end of the mentoring programme.
Data on employees of the Institut de l'Engagement and prize-winners: 13 years from the date of departure of the Institute's employee or the end of the support provided to the winner, i.e. 3 years for the duration of the project and 10 years following the end of the project, in accordance with the data control and conservation obligations imposed by European regulations, as the support provided by the Institut de l'Engagement is co-financed by the European Social Fund (ESF) or may be so at any time with retroactive effect. It should be noted that this data is also recorded in the "Ma démarche FSE" information system and will be kept for 13 years from the date of departure of the employee or the end of the support provided to the winner.
Trainee data : It is then archived until the expiry of the applicable legal limitation period (establishment of proof in contractual matters, evidence to be provided in the event of an inspection by government departments).
Data from volunteers, examiners, jury members, sponsors or presenters: current year + 2 years from their departure. After this period, the data will be anonymised for statistical purposes.
Donor data : 3 years after the year of the last donation, or the current year + 2 years and 10 years for tax receipts in order to be able to respond to requests from the authorities in the event of an audit. During this period, your email address may be used to inform you of the latest news from the Institute, to appeal for your generosity and to invite you to events.
Partner data : current year + 5 years from the last agreement.
Contact data : current year + 3 years from the last contact from the person concerned.
Visitor navigation data: 6 months

4 - The purposes and legal basis of our processing operations

Each data processing operation serves a specific purpose and has a legal basis.

Purposes of the processing operations referred to in Article 2

Provision of the registration platform and its services
Collecting applications from the Institut de l'Engagement
Registering the reference persons: guardian and witness
Mentoring programme (applicants - mentees - mentors)

Legal basis for the processing operations referred to in Article 2

Performance of a contract between the user and the platform
The legitimate interest of the Institut de l'Engagement

Gathering applications from volunteers: examiners, jury members, sponsor of a prize-winner or moderator
Consultation of preparation files for the future project by staff, volunteers and partners who are members of the juries
Examiners and chairmen of selection boards enter assessments of applications and oral feedback forms
User support
Matching the sponsor with the winner using an artificial intelligence tool (profiling)

The legitimate interest of the Institut de l'Engagement and the performance of the contract between them
Performance of a contract between the user and the platform

Collecting data from donors in order to receive their donations
Processing donations and sending tax receipts
Soliciting new donations
Charitable canvassing operations
Sending information on news and events from the Institut de l'Engagement.

The legitimate interest of the Institut de l'Engagement, to which consent may be added

5 - Recipients of Personal Data

The information and documents communicated are for the exclusive use of the Institut de l'Engagement.

The recipients of Personal Data may include, but are not limited to:

employees, volunteers and partners taking part in the examination committees and juries of the Institut de l'Engagement, who undertake to use them only in the context of actions carried out with the Institut de l'Engagement
employees, volunteers, facilitators and sponsors in charge of following up the winners
employees in charge of the database of candidates, prize-winners, donors and partners, to send you news and newsletters
the staff responsible for supporting the winners and helping them realise their projects
the partner schools and universities responsible for training the winners

Personal data may be shared with service provider companies exclusively in the European Union, when the Institut de l'Engagement uses the services of service providers to provide assistance to users and communication. These service providers have limited access to user data for the purposes of providing these services, and are contractually obliged to use it in accordance with the provisions of the applicable regulations on the protection of personal data.

If required by law, the Institut de l'Engagement may transmit data in order to follow up claims made against the platform and to comply with administrative and legal procedures.

No personal data is passed on to service providers for commercial or canvassing purposes.

6 - Data transfers

The Institut de l'Engagement does not transfer your Data outside the European Union. Exceptionally, your Data may be transferred to countries outside the European Union.
In this case, the Institut de l'Engagement undertakes to take all necessary measures to preserve the integrity and security of your Data so that it is :

located in a country considered suitable by the European Commission;
sent to entities offering sufficient guarantees as to the protection of Personal Data by implementing and signing standard contractual clauses approved by the European Commission.

7 - Data processing security

The Institut de l'Engagement ensures that your Data is processed confidentially and securely, by implementing the technical and organisational measures necessary to preserve its security, confidentiality and integrity under optimum conditions.

Only persons strictly authorised by L'Institut de l'Engagement will have access to your Data. No unauthorised third party will have access to it, except under the legal obligation incumbent on the Data Controller.

8 - Your rights

In accordance with the Data Protection Act and the RGPD, you have the following rights at all times:

Right to information and access to find out what personal data we hold about you
Right of rectification : to request that personal data held by the platform be updated.
Right to have data deleted : to request the restriction of the processing of personal data, in accordance with the provisions of the RGPD.
Right to object : to object to the processing of your data, in accordance with the assumptions set out in the RGPD.
Right of withdrawal and deletion (or "right to be forgotten") : to ask for your personal data to be erased or deleted
Right to portability : to ask the platform to hand over your personal data so that they can be transferred to a new platform.

All requests must be accompanied by a photocopy of a valid identity document and state the address at which the Institut de l'Engagement can contact the applicant.
The response will be sent within one month of receipt of the request. This one-month period may be extended by two months if the complexity of the request and/or the number of requests so requires.

You can exercise your rights by writing to dibbdpo@dibb.fr
If you are not satisfied with the processing of your Data or the exercise of your rights, you may refer the matter to the CNIL.
In addition, and since Law no. 2016-1321 of 7 October 2016, people who so wish have the option of organising what happens to their data after their death. For more information on this subject, you can consult the CNIL website.

9 - Updates

This policy may be updated by the Institut de l'Engagement in the event of new processing operations, in particular on the basis of :

significant changes in legislation and/or case law as well as technical standards applicable to the Information System;
risk assessment ;
adjustments suggested by the implementation of internal information management procedures.

10 - Liability

The Institut de l'Engagement may not be held liable in the event of :

where the Personal Data is incorrect or has not been updated by the persons concerned;
non-compliance with the obligations of data subjects under Applicable Regulations, this Privacy Policy and/or other contractual documents applicable to you.