Privacypolicy

Who is the data controller?

This Privacy Policy does not apply when we process data as a processor or service provider on behalf of our customers. That processing is governed by our agreements with those customers, including our Data Processing Addendum (DPA). Any descriptions of that processing in this Policy are for context only; the applicable agreements with our customers govern it.

Updated on 21 October 2026. This document replaces and merges the former "GDPR" page.

Our website and our applications collect certain Personal Data from our Visitors and Users. To protect your data, Edusign ensures its compliance with Regulation (EU) 2016/679 (the GDPR) and with the amended French Data Protection Act, so that your data is processed responsibly and securely.

Edusign as data controller

Edusign (hereinafter "Edusign", "we") is the data controller for the following activities:

• Operation of its websites (edusign.com, edusign.fr, trust.edusign.com, edusign.app for public pages), audience measurement and commercial prospecting.
• Management of the commercial relationship and of support.
• Management of the platform's administrator accounts (account creation, billing, security, assistance, service improvement).

Edusign as processor

For "service" data generated in the Edusign application by our customers (e.g. data relating to learners, trainers, external contacts/guests, attendance records, absence supporting documents), the Customer is the data controller and Edusign acts as a processor within the meaning of Article 28 of the GDPR. This processing is governed by our Trust Center and our Data Processing Agreement (DPA).

For any question, you may contact our Data Protection Officer (DPO): dpo@edusign.fr.

Personal data

The information collected through our websites and, where applicable, through the application, is used to improve the experience of Users and Visitors, to manage enquiries and communication, to ensure security and to provide our services. The recipients of the data are Edusign and its duly authorised partners.

This framework covers in particular Learners, Trainers and External contacts (for example: prospects, partners, guests), in accordance with the processing described above.

In accordance with the French Data Protection Act and the GDPR, you have a right of access, rectification, erasure, objection, restriction and portability, and the right to give post-mortem instructions. Exercise your rights at dpo@edusign.fr. Should you encounter any difficulty, you may refer the matter to the CNIL: www.cnil.fr.

Types of Data collected

Data collected through our websites

The categories of data collected through our websites and, where applicable, through the application:

• Identity and contact details: surname, first name, email, telephone, organisation/company.
• Content exchanged: messages sent to support or via forms.
• Browsing and device data: IP address, browser/OS information, cookie identifiers, pages visited, clicks, timestamps.
• Necessary, analytics and advertising cookies (see the "Cookies" section).
• Any other data you choose to send us through a form.

Data collected through the application

The categories of service data (learners, trainers, signatures, supporting documents, etc.) are described in our Trust Center and are governed contractually by our DPA when we act as a processor.

Sensitive data

Edusign does not process sensitive data by default. Only certain absence supporting documents provided by users may, where applicable, contain such data: specific consent is then required and recorded.

Cookies

What is a cookie?

A cookie is a text file placed by your browser when you visit a website. It can only be read back by the server that placed it.

Types of cookies

Necessary cookies (session/technical)

They allow the site to function. Deleting them may degrade the user experience.

Audience measurement cookies

To improve our websites, we use analytics tools (e.g. Google Analytics, Amplitude). They measure visits, page views and interactions. The IP address may be collected in order to determine the city of connection. This data is pseudonymised and used for statistical purposes.

Advertising and social media cookies

To offer relevant content, partners (e.g. Google Ads, Facebook Ads, LinkedIn Insights) may place advertising cookies.

Testing cookies

Edusign may use testing services (e.g. Google Optimize) that capture anonymised data only. Anonymised data may be shared with partners in order to improve the user experience.

Subprocessors (where Edusign is the data controller)

Important: The list below concerns only the activities for which Edusign acts as data controller (websites, prospecting, support, administrator accounts). For processing where Edusign acts as a processor (use of the application by our customers), please refer to the dedicated list in our Trust Center and/or our DPA.

This list is provided for information purposes, may change and is not contractual. For the most up-to-date list of subprocessors relating to service data (app), please consult the Trust Center.

Method and place of processing of the Data

Processing methods

The Data Controller processes the Data appropriately and implements technical and organisational measures to prevent unauthorised access, disclosure, modification or destruction (access rights management, encryption, backups, internal procedures).

Processing is carried out using IT tools, following procedures related to the purposes described. Access may be granted to categories of persons in charge of operations (administration, sales, marketing, legal, IT, support) and to third-party providers (hosting providers, technical solutions, communication agencies) acting as processors. The up-to-date list may be requested at dpo@edusign.fr.

Place and retention period

Data is mainly processed in France (hosting in the EU). Where necessary, certain data may be transferred to third countries (e.g. the USA) with appropriate safeguards (adequate countries, Standard Contractual Clauses, DPA, supplementary measures).

Data is retained for as long as necessary for the purposes pursued and for legal obligations. Data collected through audience measurement tools is retained for a maximum of 13 months, unless consent is explicitly renewed.

You may request the deletion or suspension of your data at dpo@edusign.fr.

Purposes of processing

Data relating to the User is collected in order to provide our services, personalise and improve the experience, ensure support, security, billing and prospecting (in accordance with your choices), and to carry out internal analyses.

Data security

The security measures implemented are both organisational and technical. They are described on our Security page. Edusign makes its choices with the protection of your data as a priority (encryption, logging, access controls, testing, etc.).

The infrastructure and the database supporting Edusign products and services are located in France. Transfers outside the EU may occur for certain providers; they are governed by the instruments provided for by the regulations (adequate countries, SCCs, appropriate safeguards).

CNIL audit

All our practices have been validated. Following an audit by the CNIL (April 2025), only two minor adjustments were requested; they have already been implemented:

• Encryption enabled on 100% of employees' mobile devices.
• DPO appointed with no conflict of interest (contact: dpo@edusign.fr).

In the interest of transparency, you may consult the document:

View the document (PDF)

Exercising your rights / Accessing, modifying, deleting

Edusign customers

You may access, modify, add, export or delete your data from your administrator or trainer area. To exercise your rights, write to dpo@edusign.fr.

External users

Where Edusign acts as a processor on behalf of its customers, we are not authorised to respond directly to your access/rectification/deletion requests. Please contact the client organisation using Edusign. We cooperate with our customers in handling such requests.

Rights of data subjects

• Access to your personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restriction of processing
• Objection to processing (including to prospecting)
• Portability
• Setting post-mortem instructions

Exercise your rights at dpo@edusign.fr. If our response is unsatisfactory, you may lodge a complaint with the CNIL.

Definitions

Personal data (or Data)
Any information relating to an identified or identifiable person.

Usage data
Information collected automatically (IP addresses, device identifiers, URIs, timestamps, response status, browser/OS characteristics, time spent, browsing paths, etc.).

User
The person using our websites/applications, corresponding to the data subject or authorised by them.

Data subject
The natural person (or legal person for certain business contacts) to whom the data relates.

Processor
An entity processing data on behalf of the data controller, following its instructions.

Data controller
The entity determining the purposes and means of the processing of personal data.

Trust Center and contact

For detailed information (security measures, list of subprocessors on the application side, DPA, certifications, policies), please consult our Trust Center.

For any question relating to this Policy or to your data: Data Protection Officer (DPO), dpo@edusign.fr.

You may also consult our GDPR page or our Help Centre.

Changes to this policy

Edusign may amend this Policy and will inform users on this page. We invite you to consult it regularly and to refer to the date of last update shown at the top of the page. Should you object, please stop using the services and request the deletion of your data.

This policy is established pursuant to Regulation (EU) 2016/679 and applicable legislation (Directive 2002/58/EC as revised, the French Data Protection Act). It applies to the websites and services operated by Edusign, subject to the applicable contractual documents (Terms of Service, DPA).

Legal information

Personal Data may be used for legal purposes by Edusign, in particular in the event of misuse or dispute. Public authorities may require its disclosure in that context.

System logs and maintenance

For operating and maintenance purposes, our services and providers may collect logs or use Personal Data such as the IP address.

Payments

We neither collect nor store full payment card details. Payments are processed securely (e.g. Stripe). We only receive confirmation of the payment outcome.

Microsoft Teams Application Privacy Notice

Edusign ("EDUSIGN," "we," or "us") issues this Notice to describe how we handle personal information for the use of our Microsoft Teams Application.

This Notice informs you about:

• the personal information that we collect and process about you,
• the purposes of the processing,
• and the rights that you have in connection with it.

Only data useful for the proper functioning of edusign.fr, edusign.app and the EDUSIGN application are used. If your Edusign account is connected to Microsoft Teams, the following data may be transferred to ensure the operation of the app.

Student data

• Last name, First name, Email, Phone number, Training center, Course attended
• IP address, Device identifier/model, Timestamp, Signature
• Analytics data, Any additional data added by the user

Trainer data

• Last name, First name, Email, Phone number, Training specialty
• IP address, Device identifier/model, Signature, Analytics data
• Any additional data added by the user

External contact data

• Last name, First name, Email, Analytics data

Data are retained no longer than necessary and may be shared with essential subcontractors.

Appropriate technical, physical, and administrative safeguards protect your data.

Exercise your rights at support@edusign.fr or dpo@edusign.fr. We may verify your identity.

You may also:

• Object to processing,
• Request restriction,
• Request portability.