Legal document Privacy Policy — Version 2.0

Version 2.0 — Updated May 21, 2026

Preamble

This Privacy Policy describes how ENERLAB ACADEMY collects, processes, retains and protects the personal data of Candidates, Students, website visitors and partners, in accordance with EU Regulation 2016/679 (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

This policy fully incorporates the provisions of Article 29 — Data Protection and Archiving, Article 30 — Electronic Communications and Digital Evidence and Article 33 — Claims, Mediation and Competent Jurisdiction of Enerlab Academy's Terms and Conditions (CGV) Version 2.0, which is the source legal reference.

In case of discrepancy, the French CGV Version 2.0 prevails (binding legal version).

Data Controller

Item	Information
Legal name	ENERLAB ACADEMY
Legal form	Société par Actions Simplifiée (SAS)
Registered office	4 Rue Sarah Bernhardt, 92600 Asnières-sur-Seine, France
SIREN	903 047 611
UAI	0923177D
Data Protection Officer (DPO)	Contactable via the School's official channels (see Article 33 below)

Article 29 — Data protection and archiving

29.1. Principles. The School processes personal data of candidates and students in accordance with the GDPR, the loi Informatique et Libertés, and any applicable regulations on personal data protection.

29.2. Purposes. Processing purposes may include admissions management, academic monitoring, billing, legal and regulatory obligations, communications, file archiving, traceability, security, and continuous improvement of training.

29.3. Data subject rights. Data subjects benefit from rights of access, rectification, erasure (within legal limits), restriction, opposition, and portability, exercisable with the School's DPO at .

29.4. Retention periods. Data may be retained for periods variable according to their nature and applicable regulatory obligations, in particular up to 50 years for academic documents.

29.5. Recipients. Data may be transmitted, within limits authorized by regulation, to internal teams, competent authorities, certifiers, partners, technical service providers, or third parties involved in the operation of services.

29.6. Security. The School implements reasonable technical and organizational measures to ensure data security, in accordance with applicable regulations and standards in force.

29.7. Subcontracting. The School may use authorized subcontractors, under conditions guaranteeing compliance with applicable regulations on personal data protection.

29.8. International transfers. International data transfers, where they occur, are framed by appropriate guarantees in accordance with applicable regulations.

29.9. Archiving. The School ensures appropriate archiving of academic, administrative, contractual, and financial documents, in accordance with applicable regulatory obligations.

Article 30 — Electronic communications and digital proof

30.1. Electronic communications. Communications between the School and candidates or students may be made by email, ERP, electronic notifications, digital platforms, or any equivalent digital channel.

30.2. Acknowledgment of receipt. Email, ERP, or digital platform exchanges are deemed received within reasonable time frames, in accordance with applicable regulations.

30.3. Digital proof. Digital exchanges, electronic signatures, validations, traces, logs, and digital documents may be used as means of proof in case of dispute, in accordance with applicable regulations.

30.4. Convention of proof. These GTC constitute a convention of proof between the parties, recognizing the probative value of digital exchanges, electronic signatures, and traceability elements retained by the School, in accordance with article 1356 of the French Civil Code.

30.5. Conservation. The School retains, for reasonable durations, the digital exchanges, electronic signatures, validations, and traceability elements useful for managing contractual relationships.

Article 33 — Complaints, mediation, and competent jurisdiction

33.1. Prior complaint. Any complaint must be addressed primarily to the School's departments via the Quality channel () or by registered mail to the registered office. The School acknowledges receipt within 5 business days and provides a reasoned response within 2 months of receipt of the complete complaint.

33.2. Mediation. In the event of failure of amicable resolution, the candidate or student may, within one (1) year from their written complaint, refer free of charge to the consumer mediator designated by the School: MCP — Médiation de la Consommation & Patrimoine, 12 square Desnouettes 75015 Paris, , mcpmediation.org.

33.3. Online dispute resolution platform. The European online dispute resolution platform is accessible at ec.europa.eu/consumers/odr.

33.4. Competent jurisdiction. In the absence of amicable or mediated resolution, any dispute relating to the formation, performance, interpretation, or termination of these GTC falls under the jurisdiction of competent French courts, in accordance with applicable rules in consumer law and civil law.

33.5. Applicable law. These GTC are governed by French law, subject to applicable mandatory provisions.

33.6. Class action. Consumers benefit, where applicable, from the possibility of class action under the conditions provided by the French Consumer Code.

Applicable law and supervisory authority

This privacy policy is governed by French law. Affected users may lodge a complaint with the CNIL (French Data Protection Authority) — 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 — or online at www.cnil.fr, when they believe their rights have not been respected.

Privacy Policy ENERLAB ACADEMY — Version 2.0 — Updated May 21, 2026 — Aligned with CGV Version 2.0 (articles 29, 30, 33). French version is the binding legal version.