Privacy
Policy

The data controller is the GIE Forum CentraleSupélec.

Name: GIE Forum CentraleSupélec
SIRET: 524 920 220 00026
Registered office: 3 rue Joliot-Curie, 91190 Gif-sur-Yvette, France
Contact: contact@forum-cs.fr

• Account: your e-mail address. Sign-in uses a one-time code sent by e-mail, with no password.
• Profile: your display name and, for students, your programme and year of study (optional, editable at any time).
• CVs: the CVs (PDF files) you upload in the app.
• Satisfaction survey: your answers, linked to your account (they are not anonymous).
• Notifications: a technical notification identifier specific to your device. On Android it is created on first launch of the app; it is linked to your account only if you enable notifications.
• Location (Forum staff only): if you enable it, your location, read repeatedly while you are using the app — at most once every 2 minutes, never in the background — for event-day logistics and for the feedback given to staff members.

We do not collect your phone number, your date of birth or your postal address.

We use your data solely to run the Forum: connecting students and companies, uploading and sharing CVs, event-day logistics, and improving the event through the satisfaction survey.

Recipients: participating companies receive the CVs and information you choose to share with them. This is the very purpose of the Forum (connecting people), not a sale of data.

No resale, no advertising, no profiling.

A CV you upload is only visible to a company when you choose to share it: sharing is explicit and revocable at any time from the CV tab. A company never sees a CV you have not shared with it.

When you share a CV, the company receives that CV along with your name and e-mail address. A company may add annotations to your CV and may choose to make one visible to you.

Location sharing only concerns staff members and is never enabled by default. It relies on your explicit consent and can be disabled at any time.

When enabled, your location is read repeatedly while you are using the app — when you open it and on certain actions, at most once every 2 minutes. It is never read in the background: if the app is closed or asleep, no location is sent.

These locations are kept as a history and serve two purposes: logistics on the day of the event, and the feedback given to staff members afterwards. They are deleted 3 weeks after the event.

Once enabled, sharing stays on: it does not stop when you close the app, and your last known location remains visible to the Forum organisers. It only stops when you turn it off yourself.

The camera is used only to scan QR codes; the app takes no photos and records no sound.

Your app data (account, profile, CVs, survey answers, locations) is hosted in France (Scaleway, Paris region) and does not leave the European Union. It is encrypted in transit (HTTPS/TLS) and at rest.

Two technical functions are an exception and go through providers established outside the European Union: checking for app updates and delivering notifications (see "Technical service providers" below). These exchanges carry only technical metadata and a device identifier — never the content of your personal data.

On your device, your session is stored in the system's secure vault (iOS Keychain / Android Keystore). It holds your sign-in tokens together with basic profile information (e-mail address, display name, role, and for students programme and year), cached to speed up app start-up.

To function, the app relies on a few technical service providers, without passing them the content of your personal data:

• Expo (EAS) — delivery of app updates (technical metadata: version, platform, installation identifier, IP address).
• Apple (APNs) and Google (FCM), via Expo — notification delivery. On Android, Google's notification component is part of the app: it creates a technical device identifier on first launch, even if you never enable notifications. That identifier is used only for delivery and is linked to your account only if you enable notifications.

These providers are established outside the European Union.

Your data is kept for as long as necessary for the purposes described, for a maximum of 2 years, then deleted or anonymised. Location data for Forum staff is an exception and is kept for far less time: it is deleted 3 weeks after the event.

You can delete your CVs directly in the app, and delete your account at any time — from the app (Settings → Delete my account) or from our dedicated page, without having to write to us. For a company account or a Forum staff account, request deletion at contact@forum-cs.fr (handled within one month at most).

Under the GDPR, you have the right to access, rectify, erase, object to and port your data. To exercise these rights, write to contact@forum-cs.fr.

The right to erasure can also be exercised directly, without writing to us: see Delete my account (immediate for student accounts; by e-mail, within one month, for the others).

You may also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.