TOTEM CPL PRIVACY CHARTER

Totem CPL is committed to protecting the privacy of its customers.

The purpose of this Charter is to set out our principles and actions for complying with applicable regulations on the protection of personal data.

1- Principles of personal data processing

Pursuant to Regulation (EU) 2016/679 of April 27, 2016 oǹ the protection of individuals with regard to the processing of personal data, the processing of your personal data carried out by Totem CPL is based on the following fundamental principles:

✓ Processing is lawful, fair and transparent
✓ The purposes of each processing operation are determined, explicit and legitimate
✓ The data collected is proportional tò the purposé of the processing
✓ The data collected is subject to organizational and technical security measureś

2- Data controller

The personal data collected is processed by the companý Totem CPL, SARL with capital of 8,100 euros, registered with the Paris RCS under no. B433121725, whose registered office is located́ at 24 rue de Surène 75 008 Paris.

3- Type of data collected

By personal data we mean any information relating tò an identified or identifiable person, in particular by reference to identifiers such as a name, an identification number, location data, an online identifier, one or more specific elements specific to physical, physiological, genetic, psychic, economic, cultural or social identitý as well as any other information that our customers decide to communicate to us.

We collect and process two main types of data:

✓ Data relating tò our customers: this data mainly concerns contacts in the training department, human resources department, purchasing department, sales, industrial or logistics department. The personal data collected and processed are obligatorily surnames, first names, email address, functions, and optionally postal address, telephone number any other information spontaneously communicated by the person if its content is relevant and proportional with regard to the purposé of the processing.

✓ Data relating to vocational training trainees: this data is collected either from the employer or from the trainee himself when registering. These data are: surnames, first names, employer, occupation, email and postal addresses, telephone number and any other information spontaneously communicated by the person if its content is relevant and directly related to the purposé of the processing.

Collecting trainee data from employers is in line with employers’ legal training obligations towards their employees, or as part of FNE (Fonds National pour l’Emploi) schemes based on voluntary employee participation.

The collection of data from the trainee him/herself meets the legal obligation referred to in the previous paragraph, or the performance of a professional training action as provided for in article L 6313-1 of the French Labor Code. In such cases, the data collected is necessary for the execution of the action. Where applicable, and solely for the purposes of organizing meal times during training courses, Totem CPL may spontaneously request or collect information from trainees concerning any food allergies they may have.

Similarly, in application of Article D 5211-3 of the French Labor Code, Totem CPL may collect information on any disability situations in order to provide for the adaptations necessary to the unfoldinǵ of the training.

4/ Purposes of collecting and processing personal data

The data collected is processed by Totem CPL for the following purposes:

✓ Data relating tò our customers in charge of purchasing professional training services are for the purposé of carrying out the employees’ professional training action.

✓ The purposé of data relating to vocational training trainees is the registration and processing of the training service, namely: registration of enrolments, sending of enrolment confirmations and legal vocational training documents, preparation of attendance lists, attendance and training certificates,trainee enrolment for face-to-face training, connection to LMS platforms accessible on the Internet. These purposes are defined in accordance with the provisions of article L 6353-9 of the French Labor Code.

5/ Recipients of personal data

The recipients of personal data are :

✓ Totem CPL’s internal departments in charge of training management. Only the staff of the departments in charge of processing operations related to the management of professional training have access to personal data.

✓ Subcontractors in charge of a service linked to the execution of the training action or Totem CPL partners. When personal data is processed́ by our partners or subcontractors, the processing is carried out́ for the sole purpose of providing the service or enabling access to the service. To this end, service providers and subcontractors are only authorized to collect information for the sole purpose of providing the service.

✓ Personal data may also be sent to public or other bodies, exclusively to meet our legal obligations (in particular to monitor and finance vocational training), court officers, ministerial officers and bodies responsible for debt collection.

Should data be exported outside the European Union, Totem CPL undertakes to comply with the conditions required by EU Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, and in particular to ensure a sufficient and appropriate level of data protection.

6/ Data retention period

Personal data collected and processed by Totem CPL for the performance of a training service is kept for the period strictly necessary to manage the training. They are then archived until̀ the expiry of the applicable legal prescription period (establishment of proof in contractual matters, supporting documents to be provided in the event of a State inspection).

Data concerning any food allergies or disabilities, as referred to in 2/ above, are only kept for the duration of the training course.

7/ Rights

In accordance with the regulations in force, everyone has the right to access and rectify their data, as well as the right to request its deletion, to opposè its processing and to obtain its limitation or portabilitý insofar as this is applicable, a right to lodge a complaint with the French Data Protection Authority (Commission nationale de l’informatique et des libertés). Any request for modification should be made via the following address: contact@totem-formation.fr