Privacy Policy

The controller of personal data is:

SAS CLOE Share capital: 1 000 € SIREN : 899 119 192 Registered office: 54 rue Coriolis, 75012 Paris, France President: Said Lasmak Website: https://cloe-edu.fr Contact for personal data matters: privacy@cloe-edu.com

The data controller determines the purposes and means of the processing carried out on the CLOE platform.

This policy applies to any person using CLOE's services, in particular:

• students looking for housing;
• prospective students making a request before their arrival in France;
• guarantors;
• private landlords;
• student residences;
• partner educational institutions;
• visitors to the website;
• users of the CLOE personal area.

It also covers the processing carried out when:

• creating an account;
• submitting a rental application;
• using the integrated messaging service;
• making payments via the platform;
• submitting requests to support;
• browsing the website;
• taking part in webinars or events organized by CLOE.

For the purposes of this policy:

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, in particular collection, recording, consultation, transmission, retention, modification or deletion.
• User: any person using the services offered by CLOE.
• Data controller: the company CLOE, which determines the purposes and means of the processing.
• Processor: any natural or legal person processing personal data on behalf of CLOE.

CLOE undertakes to comply with the following principles:

• Lawfulness: each processing operation is based on a legal ground provided for by the GDPR.
• Transparency: users are clearly informed about how their data is used.
• Minimization: only the data strictly necessary is collected.
• Accuracy: users may request the rectification of inaccurate data.
• Storage limitation: data is retained only for the period necessary for the intended purposes or as required by regulation.
• Confidentiality: technical and organizational measures are implemented to ensure the confidentiality and security of the data.

As part of its activities, CLOE undertakes in particular to:

• never sell its users' personal data;
• disclose data only to the partners necessary to provide the services requested by the user;
• limit access to the data to authorized persons only;
• secure access to the platform;
• implement measures to prevent unauthorized access, data loss and fraudulent use;
• respect the rights of data subjects.

The processing carried out by CLOE may concern in particular:

• French students;
• international students;
• prospective students;
• guarantors;
• representatives of educational institutions;
• representatives of landlords or student residences;
• visitors to the website;
• persons contacting CLOE.

As part of the provision of its services, CLOE may collect various categories of personal data. The data collected varies depending on the service used and the user's profile.

7.1 Identification data

CLOE may collect in particular:

• Last name;
• First name;
• Gender (where necessary);
• Date of birth;
• Nationality;
• Country of residence;
• Preferred language.

This data is used in particular to create the user account, ensure the administrative follow-up of the application and facilitate exchanges with partners.

7.2 Contact details

Depending on the situation, CLOE may collect:

• email address;
• telephone number;
• postal address;
• country of residence.

This information is used to communicate with the user, keep them informed of the progress of their application and respond to their requests.

7.3 Data relating to studies

In order to support students in their search for housing, CLOE may process in particular:

• educational institution;
• campus;
• program of study;
• year of study;
• start date;
• student status;
• country of origin where relevant to the management of the application.

7.4 Data relating to the housing search

Depending on the user's preferences:

• city searched;
• maximum budget;
• desired move-in date;
• expected length of stay;
• type of housing sought;
• preferences expressed.

This information is used to propose housing matching the needs expressed.

7.5 Supporting documents

Where necessary to build a rental application, CLOE may process the documents voluntarily provided by the user, in particular:

• identity document;
• passport;
• residence permit;
• school certificate or proof of enrollment;
• proof of income;
• documents relating to the guarantor;
• any document requested by a landlord as part of an application.

These documents are used only to allow the review of the application and its transmission to the relevant partners.

7.6 Data relating to payments

When the user makes a payment via the platform, CLOE may process in particular:

• amount;
• date;
• transaction reference;
• payment status.

Complete banking data is not retained by CLOE. Payments are processed by Stripe Technology Europe Limited, a provider specializing in secure payment services. Stripe acts in accordance with its own privacy policy and applicable regulations.

7.7 Data relating to messaging

When the user uses the integrated messaging service, CLOE processes:

• the content of the messages;
• the date and time of the exchanges;
• the recipients of the messages;
• any attachments transmitted.

This processing is necessary for the proper functioning of the service and for tracking the exchanges between the various parties.

7.8 Connection data

When browsing the platform, certain technical information may be recorded, in particular:

• IP address;
• browser type;
• operating system;
• language;
• time zone;
• pages viewed;
• browsing duration;
• technical information necessary for the operation of the service.

This data contributes in particular to the security of the platform and the improvement of the user experience.

Personal data may be collected:

• directly from the user;
• from their educational institution when it transmits certain information as part of a partnership with CLOE;
• from landlords or student residences where necessary for the management of the application;
• automatically when browsing the platform.

Personal data is used only for specified, explicit and legitimate purposes. The main purposes are as follows:

• Creation and management of the user account: allow the creation of a secure personal area.
• Housing search: identify housing matching the criteria expressed by the user.
• Building the rental application: collect the information and supporting documents needed for the application.
• Transmission of applications: communicate the application to the landlords, student residences or partners selected by the user or necessary for the performance of the service.
• Payment management: process payments made via Stripe and ensure their administrative follow-up.
• Personalized support: enable CLOE's teams to support the user in their search for housing and respond to their requests.
• Platform security: prevent fraud, protect user accounts and ensure the proper functioning of the services.
• Compliance with legal obligations: meet applicable legal, regulatory and accounting obligations.
• Continuous improvement of services: analyze the use of the platform in order to improve the features offered and the quality of the services.

In accordance with Article 6 of the GDPR, the processing carried out by CLOE is based in particular on the following legal grounds:

• Account creation: performance of the contract.
• Housing search: performance of the contract.
• Building the application: performance of the contract.
• Transmission to landlords: performance of the contract.
• Payments: performance of the contract.
• User support: performance of the contract.
• Platform security: legitimate interest.
• Fraud prevention: legitimate interest.
• Compliance with accounting obligations: legal obligation.
• Response to competent authorities: legal obligation.
• Marketing communication (if applicable): consent or legitimate interest depending on the applicable regulations.

CLOE ensures that only persons who need to access personal data as part of their duties can do so. Personal data is never sold or rented to third parties. Depending on the services used by the user, data may be disclosed to the following categories of recipients.

11.1 Authorized CLOE staff

CLOE's employees, executives, service providers or internal processors may access certain personal data within the limits of their responsibilities. This access is strictly limited to the needs of providing the services offered.

11.2 Landlords and student residences

When the user submits an application for housing, CLOE transmits only the information necessary to process that request. Depending on the situation, this may include:

• identity;
• contact details;
• rental application;
• supporting documents;
• information relating to the housing search.

Each landlord remains responsible for the processing it carries out after receiving the application.

11.3 Partner educational institutions

When the housing search takes place as part of a partnership between CLOE and an educational institution, certain information may be exchanged where necessary to support the student. These exchanges are limited to the information strictly necessary for the proper performance of the partnership.

11.4 Payment providers

Payments made on the platform are processed by Stripe Technology Europe, Limited. CLOE does not retain complete bank card numbers. Payment data is processed directly by Stripe in accordance with its own privacy policy and applicable regulatory requirements.

11.5 Technical providers

In order to ensure the operation of the platform, CLOE relies on several specialized providers. These providers act only within the scope of the services entrusted to them. They are subject to contractual obligations of confidentiality and security. The main providers used are in particular:

• AWS (Amazon Web Services): hosting of certain infrastructure and storage.
• Laravel Cloud: hosting of the backend application.
• OVHcloud: hosting, DNS and email services.
• Stripe: secure payments.
• Mapbox: mapping and geolocation.
• Pusher: real-time messaging.
• Google Tag Manager: management of technical tags.
• Google reCAPTCHA: protection against bots.
• Meta Pixel: measurement of advertising campaigns.
• TikTok Pixel: measurement of advertising campaigns.
• Snap Pixel: measurement of advertising campaigns.

This list may change to reflect technical developments of the platform.

Some technical providers used by CLOE may process personal data outside the European Economic Area (EEA). Where such transfers take place, CLOE ensures that they are carried out in accordance with the requirements of the GDPR.

Depending on the case, these transfers are based in particular on:

• an adequacy decision adopted by the European Commission;
• the Standard Contractual Clauses (SCC) approved by the European Commission;
• any other appropriate safeguard provided for by the applicable regulations.

Users may obtain further information regarding these safeguards by sending a request to: privacy@cloe-edu.com.

Personal data is retained only for the period necessary to fulfill the intended purposes and to comply with legal obligations. As a guide, CLOE applies the following principles:

• Active user account: for the entire duration of use of the account.
• Rental application: during the processing of the request and then in accordance with legal obligations and evidentiary needs.
• Supporting documents: retention limited to the time needed to review the application, then archiving or deletion in accordance with applicable obligations.
• Payments: retention in accordance with accounting and tax obligations.
• Correspondence with support: for the period necessary to handle the request and then limited archiving.
• Technical logs: limited period compatible with security and operational needs.
• Cookies: for the durations indicated in the Cookie Policy.

At the end of the applicable periods, the data is deleted or anonymized, except where longer retention is required by law or necessary for the defense of CLOE's rights.

CLOE implements technical and organizational measures designed to ensure a level of security appropriate to the risks, in particular:

• encryption of communications between the browser and the servers via the HTTPS protocol;
• management of authorizations and control of access to the data;
• authentication of users;
• logging of technical events where necessary;
• regular data backups;
• monitoring of the infrastructure;
• protection against unauthorized access and fraud attempts;
• use of specialized providers for the hosting and security of the services.

Despite these measures, no computer system can guarantee absolute security. CLOE nevertheless undertakes to implement reasonable and appropriate means to protect the personal data entrusted to it.

In accordance with Regulation (EU) 2016/679 (GDPR) and applicable French regulations, every data subject has the following rights concerning their personal data. Subject to the conditions provided for by the regulations, you may exercise the following rights.

15.1 Right of access

You may obtain confirmation that personal data concerning you is being processed by CLOE, as well as a copy of that data.

15.2 Right to rectification

You may request the correction or updating of data that is inaccurate, incomplete or out of date.

15.3 Right to erasure

You may request the deletion of your personal data when:

• it is no longer necessary;
• you withdraw your consent where the processing is based on it;
• you object to the processing under the conditions provided for by the GDPR;
• its processing is unlawful;
• the law requires its deletion.

However, certain data may be retained where its retention is necessary to comply with a legal obligation or to allow the defense of CLOE's rights.

15.4 Right to restriction of processing

You may request that certain data no longer be used temporarily in the cases provided for by the GDPR.

15.5 Right to object

You may object to the processing of your data where it is based on CLOE's legitimate interest, subject to the existence of compelling legitimate grounds justifying the continuation of the processing. You may also object at any time to processing carried out for direct marketing purposes where applicable.

15.6 Right to portability

Where the processing is based on your consent or on the performance of a contract and is carried out by automated means, you may request the retrieval of your data in a structured, commonly used and machine-readable format.

15.7 Withdrawal of consent

Where certain processing is based on your consent (for example certain cookies or marketing communications), it may be withdrawn at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before that withdrawal.

15.8 Directives after death

In accordance with French law, you may set directives regarding the fate of your personal data after your death.

Any request relating to your personal data may be sent to:

SAS CLOE Data Protection Department 54 rue Coriolis, 75012 Paris, France Email address: privacy@cloe-edu.com

In order to protect the confidentiality of the data, CLOE may request proof of identity where necessary. Requests are handled within the time limits provided for by the applicable regulations.

CLOE implements appropriate technical and organizational measures to protect personal data against:

• unauthorized access;
• accidental loss;
• alteration;
• disclosure;
• destruction.

In the event of a data breach likely to result in a high risk to the rights and freedoms of data subjects, CLOE will apply the obligations provided for by the GDPR, in particular regarding notification to the CNIL and, where required by regulation, the information of the data subjects.

While you browse the website, CLOE may use cookies or similar technologies. These cookies are used in particular to:

• ensure the technical operation of the platform;
• secure the services offered;
• measure audience;
• improve the performance of the website;
• assess the effectiveness of communication and advertising campaigns.

Where required by regulation, non-essential cookies are only placed after your consent has been obtained. You may change your preferences at any time via the cookie management tool made available on the website. For more information, please refer to the Cookie Policy.

The website may contain links to sites or services operated by third parties. CLOE cannot be held responsible for the privacy practices implemented by these sites. Users are advised to consult the privacy policies of these services before providing them with any personal data.

This policy may be amended to take into account:

• regulatory changes;
• recommendations from the competent authorities;
• technical developments of the platform;
• the addition of new services or partners.

The version in force is the one published on CLOE's website. The date of the last update appears at the top of this document.

If you consider that the processing of your personal data does not comply with the applicable regulations, you may submit a complaint to the French Data Protection Authority (CNIL). The CNIL's contact details are available on its official website.

For any question relating to this privacy policy or to the processing of your personal data, you may contact CLOE:

SAS CLOE 54 rue Coriolis, 75012 Paris, France Email: privacy@cloe-edu.com Website: https://cloe-edu.fr