TBS’s commitment, in terms of personal data protection, goes beyond simply respecting a legal constraint. First of all, it proceeds from our will to work with our clients in a relationship guided by respect and trust. In accordance with this philosophy, the protection of your personal data is essential to us. 

When you use TBS products, services and websites, you entrust your personal data to us. This protection and confidentiality policy was designed to explain why and how we collect and process your data.

DATA Controller

The data controller of personal data is the Toulouse Business School EESC, located at 20 Boulevard Lascrosses, 31000 Toulouse, represented by its Director General, Mrs. Stéphanie Lavigne. TBS is responsible for the collection, use and protection of your personal data, in accordance with this policy and the applicable regulations.

I. Definitions

Personal data: any information relating to an identified or identifiable human being. This person is called “concerned person”.

Data subject: a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

Processing of personal data: any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes (the “why?”) and the means (the “how?”) of the processing.

Processor: a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

Recipient: a natural or legal person, public authority, agency or any other body that receives communication of personal data, whether or not it is a third party.

Prospect: Anyone interested in a TBS training or event.

II. Scope and applicable regulations

The privacy of your data is very important to us. This Privacy Policy applies to all data collected and processed by TBS through our interactions with you across all of our products, services and websites. Our commitments and transparency are consistent and, therefore, valid regardless of how the data is collected or processed.

Our policy sets out TBS’s main principles and guidelines for the protection of privacy without being limited to them. TBS undertakes to comply with all applicable regulatory obligations, in particular European Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and Law No. 78-17 of 6 January 1978 on information technology, files and freedoms.

III. What data do we collect and how do we use IT?

All data processed by TBS meets the regulatory requirements in terms of compliance, in particular, with the purposes, retention periods, recipients and security of the data.

TBS specifically informs you about the processing carried out on the basis of your data prior to its implementation, for example via legal clauses inserted in our tools and contracts. However, you will find below some general information about the data we process:

  • Identification data: surname, first name, email address;
  • Contact data: country of residence, zip code, phone number, communication preference;
  • Data relating to your professional situation and professional experience;
  • Data relating to your project, your products and your interests;
  • Data from online forms: specific requests, date of request, program of interest, free message, as well as any information provided in the context of a request for a brochure, contact or registration for an event;
  • Login and browsing data: usernames and passwords, login information, pages viewed, browser type and language, approximate location data, etc.

In accordance with the regulations in force, any act of commercial canvassing carried out by TBS, regardless of the channel (WhatsApp, email, SMS/MMS, automated dialling, etc.), is only carried out with your prior consent.

Once you have placed your trust in us and your agreement to provide relevant information about our products and services, in line with your needs, you retain the ability to reconsider your decision at any time.

IV. How do we collect your PERSONAL data?

We collect your personal data in a variety of ways, including:

  • When you fill out a form on our website, such as a request for information, an event registration or a brochure request;
  • During your exchanges with our teams (by e-mail, phone or in person at an event);
  • When you browse our website, via cookies or trackers, subject to your consent;
  • When you interact with our marketing content;
  • Through our partners as part of promotional operations if you have consented to this sharing.

V. Why do we collect your personal data?

TBS processes your data for the following purposes:

  • Respond to your requests for information, documentation (brochure) or contact;
  • To support you in your application process and to guide you towards the courses best suited to your profile;
  • Manage your registration for our events;
  • To send you personalised communications, by email, SMS or telephone about our programmes, news or events, if you have consented to this or if you have expressed an interest in our offers;
  • To analyse browsing data (via cookies) in order to improve our website and measure the effectiveness of our marketing actions (subject to your consent for cookies);
  • To carry out internal statistics and anonymised analyses on the profiles of visitors and prospects for the purpose of continuous improvement of our services;
  •  To analyse the profiles of our prospects and customers in order to adapt our communication and training offers to their specific needs.

VI. What are the legal bases for this processing ?

The processing of your personal data is based on different legal bases, depending on its purpose:

  • Consent: when you fill in a form, register for an event, contact us with a request for information, request a brochure or agree to receive marketing communications, or when you agree to the use of non-essential cookies;
  • TBS’s legitimate interest: to analyse the profiles of our prospects, to improve our marketing communications actions, or to ensure the proper functioning of the site.

VII. How long is your data stored ?

Your personal data is kept for the time necessary to achieve the purposes for which it was collected, in compliance with legal and regulatory obligations.

  • For requests for information and documentation: your data is kept for the duration of the processing of your request and, if applicable, for a period of 3 years from your last contact;
  • To manage your registration for our events: your data is kept for the duration of the event and, if applicable, for 3 years to keep you informed of our future initiatives;
  • For data related to prospecting and marketing: your data is kept for 3 years from your last contact or consent, unless you exercise your right of withdrawal before this period;
  • For cookies: the data collected via cookies is kept for a maximum of 3 months;
  • For newsletters: your data is kept until you unsubscribe.

VIII. AUTOMATED PROCESSING AND ALGORITHMIC SCORING: HOW ARE THEY USED?

As part of its prospecting actions, TBS uses the ByRatings solution to carry out algorithmic scoring of profiles, based on artificial intelligence technologies. In accordance with Article 22 of the General Data Protection Regulation (GDPR), no decision will be taken solely on the basis of automated processing producing legal or significant effects concerning you. All important decisions, in particular those relating to orientation, will be subject to human validation.

In accordance with Article 22 of the GDPR and recital 71, you have appropriate safeguards, including the right to obtain an explanation of the decision taken, to contest this decision and to request the involvement of a human being in the context of direct marketing.

IX. Do we use cookies and other trackers?

“Cookies” refers to a set of information stored on the user’s terminal when the user browses a website. This is a file that contains, among other things, an identifier in the form of a number, the name of the server that deposited it and, if applicable, an expiry date. Cookies store information about your visit, including your preferred language and other settings. This can make it easier for you to visit this website again and make it more useful for you.

To improve your experience, we use cookies to store certain login information and provide safe navigation, collect statistics to optimize the site’s functionality, and tailor content to your interests.

Below is a list of the cookies used from our corporate website:

  • Google Analytics
  • Google Tag Manager
  • Google Ads / DoubleClick
  • Google Remarketing Tag
  • Google Fonts
  • Linkedin Analytics
  • Facebook Connect
  • Facebook Custom Audience
  • Matomo Cloud
  • Microsoft Clarity
  • ClickDimensions

You can also consult the CNIL website to learn how to configure your browser to control the deposit of cookies on your device.

For more information about the cookies we use, please contact:

X. Where do we host your personal data?

The data is mainly hosted in France (almost all of it at TBS and part at OVH), however TBS may have to transfer part of your data outside the country of initial collection, or even in some limited cases (mainly technical) to countries that are not members of the European Economic Area and whose legislation on the protection of personal data differs from that of the European Union, in order to optimize the quality of its products and services.

TBS undertakes to ensure, before transferring your data, that entities outside the European Union and the conditions of the transfer offer an adequate level of protection in accordance with the European regulations in force (self-regulatory mechanisms such as the Data Privacy Framework, standard contractual clauses, CNIL authorisations, etc.).

Apart from the cases of supervised data transfers mentioned above, TBS does not transfer or share any personal data about you.

XI. How do we protect your personal data ?

TBS takes care to protect and secure your data to ensure its confidentiality and prevent it from being distorted, damaged, destroyed or disclosed to unauthorized third parties.

The measures taken are of the following order:

  • Organizational: authorisations, data processing procedures to ensure that only people who need your data in the context of their missions have access to it (these people being subject to an obligation of confidentiality);
  • Physical/material: protection of our premises, choice of a hosting provider whose security is recognized worldwide;
  • Logic: implementation of security tools (antivirus, firewall, anti-intrusion systems, etc.), securing computer workstations and network devices.

VIII. How to exercise the rights you have over your data?

In accordance with the regulations, you have a right of access, a right of rectification, a right of erasure, a right to limit processing and a right to object for legitimate reasons. You can also define post-mortem directives relating to your data in the event of death. Finally, you have the right to object, free of charge, to the processing of data concerning you for prospecting purposes, in particular commercial purposes, by TBS.

You can exercise these rights by contacting the Data Protection Officer:

  • By email at [email protected]
  • By mail, specifying your contact details, to Toulouse Business School – Service DPO – 1 Place Alfonse Jourdain 31068 Toulouse cedex 7.

You also have the right to lodge a complaint with the CNIL, the authority in charge of compliance with personal data obligations.

XIII. Updating this Policy

This privacy policy may be updated or modified at any time, depending on legislative or jurisprudential developments or current practices.