Privacy policy
Data controller
Jeremy SEGALA, sole trader trading under the name Hors Programme, Malta. For any question about your data, write to bonjour@offthesyllabus.com.
Data processed, purposes and legal bases
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| First name, last name, email address, encrypted password, language, declaration of legal age | Create and manage your account, identify you | Performance of the contract | As long as the account exists. An account never confirmed is deleted after thirty days. |
| Purchases, access rights, consents given when ordering, withdrawals | Give you access to modules, apply the pack and the loyalty price, prove the order | Performance of the contract and legal obligations | As long as the account exists, then for the period required by law, up to ten years for accounting records and orders of 120 euros or more |
| Progress in the modules, passing the final assessment | Pick up where you left off, unlock The Method | Performance of the contract | As long as the account exists |
| Exam attempts: questions drawn, answers given, score and result | Mark the final exam on the server and issue the certificate | Performance of the contract | One year from the start of each attempt |
| Certificates of achievement: first name, last name, module title, date passed, verification code | Issue you a certificate and let anyone who holds its code check that it is authentic | Performance of the contract | As long as the account exists, unless the certificate is deleted at your request |
| Reviews: rating, comment, first name and initial of last name, date, module language; reports: reason, details, account identifier or fingerprint of the IP address | Publish reviews, moderate them, handle reports | Performance of the contract; for reports, legitimate interest and legal obligation | As long as the author's account exists; one year for reports |
| Email address, if you agreed | Tell you about new modules, one email a month at most | Your consent, which you can withdraw at any time | Until you withdraw consent |
| IP address and records of sign-in attempts | Protect accounts against intrusion attempts | Legitimate interest, the security of the service | Twenty-four hours |
| Pages viewed, course pages and families opened, clicks on Buy, link source, device type and language, attached to an anonymous fingerprint that changes every day | Measure site traffic and interest in each module, improve the offer | Legitimate interest, audience measurement of the service | Thirteen months |
| Record of payment events sent by Stripe: event identifier and type, payment session, account identifier, date | Process each payment only once | Performance of the contract | Ninety days |
Certificates of achievement. When you pass a module's exam, we issue a certificate in your name. Each certificate has a unique code and a public verification page, at /certificat/ followed by that code. This page shows your first and last name, the module title and the date you passed, without your score or your email address. It can only be reached by people who know the code, which you choose to share, for example by adding the certificate to your LinkedIn profile. Search engines are told not to index it. The name shown is the one on your account, which you can correct at any time in your account area. Certificates are kept for as long as your account exists. You can ask us to delete a certificate at our contact address; its verification page will then state that no certificate matches.
Your bank details are entered directly with Stripe. The site never sees or stores them.
Recipients
Only the seller has access to your data. For the strict needs of the service, it is entrusted to the following providers.
- O2SWITCH SAS, host of the site, its database and its backups, in France. The site's emails are sent by its server. Its technical logs, which contain visitors' IP addresses, are kept for the periods set by the host.
- Stripe, payment provider, which processes payments and issues receipts. Stripe Payments Europe, Limited is established in Ireland. Where Stripe transfers data outside the European Union, in particular to the United States, these transfers are covered by the EU-US Data Privacy Framework and by the European Commission's standard contractual clauses.
Your data is never sold or rented and is not used for any advertising.
Cookies and local storage
The site uses only two cookies and one local storage item, strictly necessary for it to work, which therefore require no consent. The hp_session cookie keeps you signed in for up to thirty days. The hp-lang cookie remembers your chosen language for one year. The module library also saves the language you choose there in your browser's local storage, under the name hp-lang; this stays on your device, with no expiry date, until you clear the site's data in your browser. Traffic is measured on the site's own server, with no cookie or tracker and no outside service. Your IP address is not stored. It is only used, mixed with a random value renewed every day and then deleted, to compute a fingerprint that can neither recognise you from one day to the next nor identify you. The site uses no social networks and no advertising. Fonts are hosted on the site itself, with no call to an outside service.
Your rights
You can ask to access, correct or erase your data, restrict its processing or receive it in a portable format, and you can object to processing based on legitimate interest. You can withdraw your consent to information emails at any time, through the link in each email or by writing to us. To exercise these rights, write to bonjour@offthesyllabus.com. You will receive an answer within one month.
If you believe your rights are not being respected, you can lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner, Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549, Malta, idpc.org.mt, or with the authority of your country of residence, such as the CNIL in France.
Security
Exchanges with the site are encrypted. Passwords are stored in an encrypted form that cannot be reversed. Modules and documents are only accessible to accounts entitled to them. The database is backed up every night at the host. Each backup is kept for thirty days, so erased data may remain in backups until then.