Figure 1 –Table showing the relationship between categories of collected data, purposes, legal bases, and retention periods: Learners and users of the LégiSchool platform
Relevant assumptions:
You are a LégiSchool student who is currently participating in or has participated in a training course organized by LégiSchool, whether in-person, remote, or via e-learning, through the https://formations.legischool.com platform
You are any person who has created a user account on the platform and has such an account
Data categories
Objectives
Legal Basis
Shelf life
Training contracts or training agreements
👩🎓👨🎓Student identification information: last name, first name, mailing address
📞 Phone numbers
📆 📅📍Date, time, and, if applicable, training location
📧 Email addresses
📝 Date and time of signature
📜 🎓If applicable, diplomas and professional qualifications
Allow learners to enroll in LégiSchool's training programs
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
5 years following the signing of the contract or training agreement (statute of limitations)
Then destruction (no archiving)
♿️ If applicable, whether you have a disability, information about the nature of the disability, and information about the accessibility measures implemented by LégiSchool
Enable learners with disabilities to benefit from specific accommodations to ensure accessibility
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
Legal basis for exceptions regarding "special categories" or "sensitive data":
The processing is necessary for the purposes of fulfilling the obligations and exercising the rights of the controller or the data subject in the field of labor law, social security, and social protection, to the extent that such processing is authorized by Union law, by the law of a Member State, or by a collective agreement concluded under the law of a Member State which provides for appropriate safeguards for the fundamental rights and interests of the data subject (Article 9(2)(b) of the GDPR)
5 years following the signing of the contract or training agreement (statute of limitations)
Then destruction (no archiving)
Using the LégiSchool e-learning platform (https://formations.legischool.com)
User account
👩🎓👨🎓/👩💻 👨💻 Learner or user identification information for the platform: last name, first name, mailing address (optional)
📧 Email addresses, if applicable, and information regarding consent to receive electronic communications
📞 Phone numbers (optional)
📷 Photo (optional)
🎓 💻Online courses available to learners
Enable the learner or user of LégiSchool to have a user account on the LégiSchool e-learning platform
The processing is necessary for the performance of a contract to which the learner or user is a party (Article 6(1)(b) of the GDPR)
3 years after the user account was created,
Then irreversible anonymization (no archiving)
Learner/user passwords
Enable learners or users to have a secure user account on the e-learning platform
The processing is necessary for the performance of a contract to which the learner or user is a party (Article 6(1)(b) of the GDPR)
No access by LégiSchool or its service provider (passwords hashed with a cryptographic salt)
Learner or user tracking forms (for each training course to which the learner has access):
📆 📅 Enrollment date , course start date, last access date, course completion date
⌛ Total time spent on each course, course completion rate (in %), lessons completed
❌✅ Quiz and multiple-choice test scores, training completion rate (in %)
Enable LégiSchool to track the progress of learners and users
Enable LégiSchool to prevent learners and users from dropping out (anti-dropout system)
The processing is necessary for the performance of a contract to which the learner or user is a party (Article 6(1)(b) of the GDPR)
3 years after the user account was created,
Then irreversible anonymization (no archiving)
Learner or user login credentials
💻📍 History of recent logins to the platform, login date and time, IP address, login location, browser type, device type
Allow LégiSchool to ensure the security of connections to user accounts
Preventing the hijacking of your learners’ or users’ accounts
The processing is necessary for the performance of a contract to which the learner or user is a party (Article 6(1)(b) of the GDPR)
The necessity arising from a legal obligation imposed on LégiSchool (Article 6.1(d) of the GDPR)
6 months after the collection of connection data,
Then destruction
Information on abandoned shopping carts (regarding the purchase of online e-learning courses)
🧺 Abandoned shopping carts, date and time of abandonment
Enable LégiSchool to handle the business management of its services
Allow LégiSchool to generate statistics on purchases of its training courses
The processing is necessary for the legitimate interests of LégiSchool (Article 6(1)(f) of the GDPR)
3 years after the user account was created,
Then irreversible anonymization (no archiving)
Online payments via Stripe
💶💳 Information required for online payment: last name, first name, email address, billing address (optional), credit card number, expiration date, security code
Allow prospective students to pay for training courses online via Stripe and gain immediate access to the e-learning modules
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
No access via LégiSchool
No data retention (immediate deletion once the transaction is complete)
Qualiopi Surveys
👩🎓👨🎓Student identification information: last name, first name, mailing address
📞 Phone numbers
📆 📅📍 Date, time, and, if applicable, location of the training session
📧 Email addresses
📜 🎓 If applicable, diplomas and professional qualifications
Enable LégiSchool to meet transparency and quality requirements and obtain Qualiopi certification
Enable learners to access training tailored to their needs
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
5 years following the signing of the contract or training agreement (statute of limitations)
Then destruction (no archiving)
⭐⭐⭐⭐
Results of satisfaction and positioning surveys (pre-training, post-training, immediate feedback, delayed feedback)
Enable LégiSchool to meet transparency and quality requirements and obtain Qualiopi certification
Enable learners to access training tailored to their needs
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
5 years following the signing of the contract or training agreement (statute of limitations)
Then destruction (no archiving)
♿️ If applicable, whether you have a disability, information about the nature of the disability, and information about the accessibility measures implemented by LégiSchool
To enable people with disabilities who wish to enroll in a training program at LégiSchool to benefit from specific accommodations to ensure accessibility
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
Legal basis for exceptions regarding "special categories" or "sensitive data":
The processing is necessary for the purposes of fulfilling the obligations and exercising the rights of the controller or the data subject in the field of labor law, social security, and social protection, to the extent that such processing is authorized by Union law, by the law of a Member State, or by a collective agreement concluded under the law of a Member State which provides for appropriate safeguards for the fundamental rights and interests of the data subject (Article 9(2)(b) of the GDPR)
5 years following the signing of the contract or training agreement (statute of limitations)
Then destruction (no archiving)
☝️Claim forms:
Personal information: last name, first name, email address, phone number
Nature of the complaint
Date of the claim
Allow learners to submit complaints to LégiSchool
The processing is necessary for the performance of a contract to which the learner is a party (Article 6(1)(b) of the GDPR)
No data retention: information is fully anonymized
Communication
Mailing lists
📧 Last name, first name, and email addresses of customers and former customers who have not opted out of receiving electronic communications, along with their category (former customer, former student, etc.)
Enable LégiSchool to keep its former students informed about its training offerings
Enable learners to stay informed about LégiSchool’s course offerings
The processing is necessary for the legitimate interests of LégiSchool (Article 6(1)(f) of the GDPR)
3 years after the completion of the last training course, and then
Destruction
Statistics
📊 📈 📉 Statistical data
Allow LégiSchool to compile statistics on its learners and courses
Enable LégiSchool to assess customer satisfaction and meet its quality standards (Qualiopi)
The processing is necessary for the legitimate interests of LégiSchool (Article 6(1)(f) of the GDPR)
3 years from the date of data collection, and then
Irreversible anonymization
Accounting
📒 Accounting data (if applicable, customer identification information if the customer is an individual)
Enable LégiSchool to meet its accounting obligations
The necessity arising from a legal obligation imposed on LégiSchool (Article 6.1(d) of the GDPR)
10 years from the end of the fiscal year