Impressum & Privacy Policy

Impressum

Disclaimer

The website https://susfoods.eu/ is edited by ISARA.

ISARA
23 rue Jean Baldassini
69 007 Lyon, France

Editorial content

Responsible for the content: Isara / Université Cattolica del Sacre Cuore

e-mail: susfoods@isara.fr

Web hosting

This website is hosted by ISARA, 23 rue Jean Baldassini, 69007 Lyon, FRANCE

Creation / Web development

Géraldine Woerner, 3PIX

Data Protection Policy

Preamble

ISARA recognizes the importance of processing personal data in accordance with the provisions of Regulation 2016/679 of 27 April 2017 on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”) and on the free movement of such data, as well as applicable national and European laws and regulations.

Accordingly, this Policy is intended to provide data subjects, visitors, and users of the susfoods.eu website with all information relating to the personal data processing carried out by ISARA, thereby ensuring compliance with the transparency requirement under the GDPR.

Definitions

To be as transparent and clear as possible regarding the information ISARA provides to visitors and users of its website, below is a set of definitions to help you understand this Policy:

“Personal data”: refers to any information relating to a natural person who is identified or identifiable, directly or indirectly, based on such data. For example, a name, an email address, an identification number, location data, or an online identifier are all considered personal data.

“Processing” or “data processing”: refers to any operation or set of operations performed on one or more items of personal data. For example, collecting, recording, storing, using, modifying, extracting, simply consulting, erasing, or destroying data all constitute processing.

“Data controller”: refers to any natural or legal person who processes personal data using means and for purposes (objectives) that they themselves determine.

“Data processor” or “sub-processor”: refers to any natural or legal person who processes personal data on behalf of the data controller, in accordance with the instructions, means, and purposes (objectives) defined and set by the data controller.

“Lead”: any prospective candidate or contact who has shared their personal data with ISARA (e.g. via a brochure request, contact form, event registration, or partner platform), without necessarily having submitted a formal application.

Article 1 – The Data Controller

ISARA, an association registered with the Prefecture of the Rhône under number W691054501, with its registered office at 23 Rue Jean Baldassini, 69007 Lyon, registered with INSEE under number 779 845 056 00042, a higher education institution acting through its website.

Article 2 – Legal Bases and Purposes of Processing

The susfoods.eu website implements several personal data processing operations intended to ensure communication and the exchange of information with users.

The legal bases for ISARA’s data processing operations are: the individual’s consent, the performance of a contract or pre-contractual measures requested by the individual, ISARA’s legitimate interest, or compliance with a legal obligation.

The following processing operations are based on your consent:

Responding to written requests submitted via the contact form
Responding to applications submitted via the application forms
Responding to brochure requests submitted via dedicated forms
Sending marketing/promotional emails to leads

The following processing operations are based on compliance with a legal obligation imposed by legislation:

Retention of data relating to legal security and tax obligations

The following processing operations are based on ISARA’s legitimate interest:

Managing requests for information/enrollment submitted by website visitors
Measuring website audience (via the “Matomo” tool)

Article 3 – Categories of Personal Data Collected

The data processed by ISARA is primarily collected via the forms available on our susfoods.eu website, with the exception of certain data relating to visitors’ connections (IP addresses), which are automatically recorded by our systems in server logs and by Matomo’s systems.

ISARA is committed to complying with the data minimization principle set out in Article 5.1 of the GDPR, which consists of only collecting data that is strictly necessary for processing and accurate. Accordingly, the data collected by ISARA is as follows:

Category of Personal Data	Personal Data
Data relating to the identification of the individual	– Last name – First name – Date of birth
Data relating to the individual’s contact details	– Email address – Phone number – Address – Postal code – City – Country
Other personal data	– Level of education – Current or previous educational institution – Nationality
Technical data	– Visitors’ IP addresses – Browsing data – Connection data (logs) – Cookies
Lead engagement data	– Source of the lead – Marketing preferences/ consent status – Email open/click history

Article 4 – Recipients of Personal Data Collected on the Website

The recipients of data collected via the forms available on the susfoods.eu website are ISARA employees authorized to process your request within the ISARA team. ISARA guarantees that its employees are trained to process personal data in compliance with the legal obligations imposed by the GDPR.

Data collected through the portal site is for strictly internal use and is not communicated, transferred, or disclosed to third parties, other than as authorized by ISARA to its data processors.

The MSc in Sustainable Food Systems is delivered as a European Double Degree Programme offered by ISARA (Lyon, France) in collaboration with Università Cattolica del Sacro Cuore (Cremona, Italy).

For the purposes of managing your enrolment, academic records and related administrative activities, your personal data will be shared with Università Cattolica del Sacro Cuore.

For full details on how Università Cattolica del Sacro Cuore processes your personal data, please consult their Privacy Policy: https://www.unicatt.it/en/privacy.html

Article 5 – Sub-processing of Personal Data

ISARA may use data processors to properly carry out its services (for example: processors specializing in IT hosting, processors specializing in emailing, etc.).

ISARA guarantees to website users and visitors that its processors comply with the legal obligations imposed by the GDPR regarding personal data. Accordingly, ISARA ensures, both prior to and throughout the performance of the contract, that its processors comply with the technical and organizational security measures essential to the personal data processing carried out by ISARA.

ISARA uses the following categories of data processors to carry out its services

Purpose	Type of processor	Name
Website hosting	Hosting provider	WordPress
Email marketing/Lead nurturing	CRM/emailing tool	Studizz
Audience measurement	Analytics tool	Matomo, Google Analytics
Application management	Admissions software

Article 6 – Transfer of Personal Data Outside the European Union

ISARA does not transfer any personal data outside the European Union. Personal data collected by ISARA is hosted within the European Union.

Should ISARA need to transfer data outside the European Union, ISARA undertakes to take all necessary and essential measures to ensure the protection of such data in accordance with applicable European legislation.

Article 7 – Retention Period for Personal Data Collected

In accordance with the storage limitation principle set out by the GDPR, personal data collected and processed by ISARA is retained only for as long as necessary for the purpose of the processing.

Data Categories	Retention Period
Data relating to website visitors and users	For the time necessary to process the user’s request, then 2 years after the last visit to the site
Data relating to applications	From the applicant’s last interaction, unless the applicant objects: – 2 years
Data relating to leads	– 3 years
Data relating to enrolled students	– duration of the MSc program + 2 years
Technical data (logs)	6 months from collection, unless otherwise required by law
Cookies	13 months from the collection of the individual’s consent to the deposit of cookies

ISARA guarantees the confidentiality of information recorded on the website. The addresses and personal data of registered users never appear there.

Lastly, ISARA undertakes to immediately delete and erase data collected when a website user requests this from ISARA via its website or in writing at the following address: AGRAPOLE – ISARA 23 rue Jean Baldassini 69364 LYON 07

Regarding the retention of data collected by our audience measurement tool “Matomo,” please refer to the privacy policy at: https://fr.matomo.org/privacy-policy/

Article 8 – Cookies and other tracers

Cookies, or other similar identifiers, are files used by a server to interact with the browser. Cookies are used to send status information when a user visits a site. Examples of status information include a session ID, language, expiration date, response domain, etc. Cookies can be used to store status information when a browser accesses different pages of a Web site or when the browser returns to the site at a later time. Only the sender of a cookie can read or modify the information contained in it. There are different types of cookies:

session cookies, which disappear as soon as you leave the browser or the site
permanent cookies that remain on your terminal until their lifetime expires (maximum 12 months) or until you delete them using your browser’s functions.

You can access your cookie management panel in order to configure the deposit and reading of cookies.

How do I disable cookies?

Cookies or tracers allow you to take full advantage of the Site’s features. If your browser is configured to refuse all cookies or trackers, this may prevent you from using some of our services, for which ISARA cannot be held responsible.

Article 9 – Exercising Your Rights

In accordance with national Law No. 78-17 of 6 January 1978 (known as the “Data Protection Act”) and the European General Data Protection Regulation (“GDPR”), you have the following rights with respect to the processing carried out on your personal data:

– A right of access and copy: This right allows you to obtain confirmation from the data controller as to whether or not personal data concerning you is being processed and, where it is, to review that data. In such cases, ISARA will provide you with a copy of the personal data being processed. ISARA is entitled to charge a reasonable fee based on administrative costs for any additional excessive copy requests you make.

– A right of rectification: This right allows you to obtain, as soon as possible, the correction of inaccurate personal data concerning you from the data controller. You have the right to have incomplete personal data completed, including by providing a supplementary statement.

– A right of erasure: This right allows you to obtain, as soon as possible, the erasure of personal data concerning you from the data controller.

– A right to restriction of processing: This right allows you to obtain from the data controller a restriction on the use of your data when:

You contest the accuracy of the personal data. This restriction will apply for as long as necessary for ISARA to verify the accuracy of your personal data;
The processing is unlawful and you wish ISARA to restrict the use of your data rather than delete it;
ISARA no longer needs your personal data for the purposes of the processing, but you consider that the data is still necessary for the establishment, exercise, or defense of legal claims;
You have objected to the processing of your data (in accordance with your right to object). This restriction will apply for as long as necessary for ISARA to verify whether its legitimate grounds override the grounds you have invoked.

– A right to object: This right allows you to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where such processing is based on ISARA’s legitimate interest, or where the processing is carried out for prospecting or profiling purposes.

– A right to data portability: This right allows you to receive the personal data you have provided to ISARA in a structured, commonly used, and machine-readable format, or to have that data transmitted to another data controller without hindrance from ISARA, provided that:

The processing is based on your consent or on a contract;
The processing is carried out by automated means.

– A right to lodge a complaint with a supervisory authority: This right allows you to lodge a complaint with the French Data Protection Authority (CNIL), either directly via its website (see https://www.cnil.fr/fr/plaintes) or at the following address: CNIL – Complaints Department – 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07.

You may exercise these rights by contacting us in writing at the following email address: contact@isara.fr, or at the following address:

AGRAPOLE-ISARA Attention: Christian PINEAU 23 RUE JEAN BALDASSINI 69364 LYON 07

Please note that we will take the precaution of verifying your identity before granting you access to your personal data or acting on your correction requests.

Article 10 – Third-Party Links and Social Media

Our website may contain links to third-party websites or integrate social media features (e.g. sharing buttons). These third parties have their own privacy policies, which we encourage you to review. ISARA is not responsible for the privacy practices of third-party websites.

Article 11 – Security Measures

ISARA undertakes to implement all necessary technical and organizational security measures to ensure the protection of personal data collected, thereby preventing any personal data breach.

Article 12 – Updates and Amendments to the Personal Data Policy

Due to legislative and regulatory developments regarding personal data protection, this Policy may be amended and updated by ISARA at any time. Accordingly, the most recent version of this Policy shall prevail over any prior version.