1. Data controller
Studeva, a société par actions simplifiée with a share capital of €1,000.00, 173 rue de Courcelles, 75017 Paris, RCS Paris 131 961 583, is the controller of the processing described here. For any question about your data: contact@studeva.fr.
2. What this policy covers
It covers the data Studeva processes on its own behalf: visits to studeva.fr, trial space requests, the relationship with its customers, support, platform security and payment.
You are a learner, trainer or administrator in an organisation's space
The data of your account, enrolments, progress and certificates is processed on behalf of the organisation that gave you access to Studeva. That organisation is the controller: Studeva acts as processor, on its instructions (article 16 of the terms of sale and data processing agreement). To exercise your rights over that data, contact your organisation; if you write to Studeva, we forward your request to it.
3. Data processed, purposes and retention
Visiting studeva.fr
- Data
- Pages viewed, referring site, browser and device type, country, as statistics. The measurement tool sets no cookie and does not keep your IP address; server logs do record it (see “Security” below).
- Purpose
- Measuring the website's traffic and spotting broken links.
- Legal basis
- Studeva's legitimate interest in knowing its website's audience.
- Tool
- Umami, operated by Studeva on its own servers: no data is shared with a third party.
Trial space request
- Data
- Email address, first name, last name, organisation name; phone number and job title if provided.
- Purpose
- Opening the requested space and, where relevant, contacting you about it.
- Legal basis
- Pre-contractual steps taken at your request.
- Retention
- A request that is not confirmed, or has been processed, is deleted thirty (30) days after it expires or is decided. Once the space is open, the data follows the account (below).
Customer accounts, contract and support
- Data
- Identity and business contact details of the customer's administrators and contacts, billing details, subscription and invoice history, exchanges with support.
- Purpose
- Performing the contract: access to the service, subscription, invoicing, assistance, information about the service.
- Legal basis
- Performance of the contract; legal obligations, in particular accounting.
- Retention
- For the duration of the contractual relationship, then three (3) years to follow up the relationship. Invoices and accounting records are kept for ten (10) years. An account with no sign-in for fifty-six (56) weeks is anonymised, after two email reminders.
Payment
- Data
- Payment method (card or IBAN), amounts, payment status.
- Purpose
- Collecting subscriptions and handling failed payments.
- Legal basis
- Performance of the contract.
- Tool
- Stripe. Card data is entered at Stripe and Studeva never has access to it; Studeva only receives the information needed to follow payments (amount, date, status, payment method type).
Security and operation of the website and the platform
- Data
- Technical logs (IP address, date, request, error), account sign-in log.
- Purpose
- Securing the website and the platform, detecting abuse and diagnosing outages.
- Legal basis
- Studeva's legitimate interest in protecting its service and its customers' data.
- Retention
- Technical logs: thirty (30) days; diagnostic traces: seven (7) days; sign-in log: twelve (12) months.
4. Recipients and processors
Your data is only accessible to the Studeva staff who need it, and is never sold or rented. Studeva uses the following providers, bound by a contract requiring them to protect your data:
- Scaleway SAS (France): server hosting, file storage, backups and email delivery, in data centres located in the European Union;
- Stripe: subscription payments. For European customers, the contract is with Stripe Payments Europe, Ltd. (Ireland).
Audience measurement and technical monitoring are operated by Studeva itself, on its own servers.
5. Transfers outside the European Union
The data hosted by Studeva stays in the European Union. Stripe may transfer some payment data to the United States: such transfers rely on the EU–US Data Privacy Framework, to which Stripe adheres, and on the European Commission's standard contractual clauses.
7. Security
Studeva protects your data with appropriate technical and organisational measures: encrypted communications (HTTPS), encryption of secrets at rest, isolation of each customer's data, restricted access, regular encrypted backups.
8. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to give instructions on what happens to it after your death. Where processing relies on Studeva's legitimate interest, you may object to it on grounds relating to your particular situation.
To exercise them, write to contact@studeva.fr. We reply within one (1) month, and may ask you to prove your identity in case of reasonable doubt.
If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
9. Changes
This policy may change, in particular when the service does. The date of the last update is shown at the top of the page; customers are informed by email of any significant change.