Privacy Policy

Last updated: June 5, 2022

Preamble

The purpose of this Privacy Policy is to inform you about how your personal information may be collected and processed by STRATX SIMULATIONS.

STRATX SIMULATIONS publishes a proprietary website (the "Software"), and an e-commerce platform (the "Platform") on which Users acquire licenses to use the Software, by means of a contract signed between STRATX SIMULATIONS and the Supervisor(s).

Respect for privacy and personal data is a priority for STRATX SIMULATIONS, which is why we are committed to processing them in strict compliance with the French Data Protection Act of January 6, 1978, as amended and the General Data Protection Regulation (EU) of April 27, 2016 (hereinafter "GDPR").

Under all circumstances, we will comply with these two (2) essential principles:

• You remain in control of Your Personal Data;

• Your Data will be processed in a secure manner with transparency and confidentiality.

Article 1. Definitions

Software:

means the proprietary website or software published by STRATX SIMULATIONS for which Users acquire licenses to use through the Platform.

Data:

means all types of information and/or data to which STRATX SIMULATIONS has access, regardless of the format or medium, whether Personal Data or not (e.g.: metadata, financial data, operators, customers, partners, strategic, technical, professional, administrative, commercial, legal, accounting ...).

Personal data:

means any data that directly or indirectly identifies a natural person.

Data subjects or You:

means the persons concerned by the processing operations carried out by STRATX SIMULATIONS as Data controller. For the purposes of this Policy, the Data subjects are the Supervisors and their personnel.

Supervisors:

means the university or company that is party to the contract with STRATX SIMULATIONS to make the Software available to the Users.

Services:

means the services provided by STRATX SIMULATIONS through the Platform, including the Software.

Users:

means any person acquiring a license to use the Software through the Platform, pursuant to an agreement between STRATX SIMULATIONS and the Supervisor. Users may include, but are not limited to, Supervisor’s personnel and students.

Article 2. Identity and contact details of the data controller

STRATX SIMULATIONS as Data controller:

Your Personal data are collected and processed by STRATX SIMULATIONS SAS (hereinafter « STRATX SIMULATIONS »), a simplified joint-stock company with a capital of 605 184 euros, having its registered office at 2, Rue Jean Lantier, 75001 Paris, registered in the Paris Trade and Companies Register under number 331 302 851, in its capacity as Data controller.

For any question, You can contact STRATX SIMULATIONS:

• By mailing a letter, to STRATX SIMULATIONS, 2, Rue Jean Lantier, 75001 Paris ;

• By email, at dpo@StratXsim.com.

STRATX SIMULATIONS as Data processor:

STRATX SIMULATIONS will act as a data processor for the processing operations for which the Supervisors are considered as data controllers:

• Student registration for Services;

• Sending emails to students for enrollment in and performance of Services.

It is specified that as a data processor, STRATX SIMULATIONS only processes the Data according to the instructions of the data controller and is therefore prohibited from reusing these media or the data they contain.

This Privacy Policy concerns only the data processing carried out by STRATX SIMULATIONS in its capacity as data controller.

If you wish to obtain information on the processing operations carried out by STRATX SIMULATIONS on behalf of the Supervisors, we invite you to contact them and to refer to their privacy policy.

Legal reminder:

According to the Data Protection Act and the GDPR, the Data controller is the person who determines the means and purposes of the processing of Personal data. When two or more Data controllers jointly determine the purposes and means of the processing, they are called Joint Data controllers.

The Data processor processes Personal data on behalf of the Controller and acts under the Controller’s authority and on the instructions of the latter.

Article 3. Contact details of our DPO

Our Data Protection Officer (hereinafter « DPO ») is available to respond to all requests, including the exercise of rights, relating to your Personal data.

You can reach our DPO:

• Either by mail at the following address: dpo@stratxsim.com

• Or by mailing a letter to: STRATX SIMULATIONS – Data Protection Officer, 2, Rue Jean Lantier, 75001 Paris

The Data Protection Officer's mission is to inform, advise and control the compliance of STRATX SIMULATIONS in the performance of the various processing operations.

In accordance with data protection regulations, the DPO acts as a contact point:

• Towards Data subjects for all matters relating to the processing of Data carried out by STRATX SIMULATIONS or the exercise of your rights;

• Towards the CNIL in the context of its cooperation mission. The DPO may also contact this authority to request an opinion or prior consultation on all matters concerning the protection of personal data;

• Towards the other DPOs appointed by the participating data processors or data controllers.

Article 4. Data collection

As part of its activity, STRATX SIMULATIONS collects and processes Personal data about You. Such Data may come directly from You or may have been collected from third parties in the processing operations.

In all cases, You are informed of the purposes for which your Data are collected by us via the various online data collection forms or the emails which would be addressed to You.

Your Data collected by STRATX SIMULATIONS are processed in accordance with the purposes for which it was collected.

When necessary, we undertake, depending on the case, to obtain your consent and/or to allow you to oppose the use of your Data for certain purposes, such as, for example, the possibility of sending You commercial prospecting.

Article 5. Prospecting

Within the framework of prospecting operations addressed only to professionals, STRATX SIMULATIONS ensures that :

• The persons solicited have received sufficient information on the prospecting operations carried out;

• The persons solicited can object in a simple and free manner to the prospecting operations ("opt-out"); and

• The solicitation is related to the solicited person's profession.

When commercial prospecting operations are addressed to professionals, it is possible for STRATX SIMULATIONS to proceed with this processing without obtaining the prior consent of the Data subject insofar as the latter has been previously informed and is able to object to the processing according to the recommendations formulated by the CNIL.

Article 6. Purposes and legal bases of the processing

When the legal base used for the processing operations carried out by STRATX SIMULATIONS relies on the pursuit of a legitimate interest, you have the possibility, upon simple request, of obtaining information on the balancing of interests.

Your various data may be collected by STRATX SIMULATIONS for:

The management, the proper functioning and continuous improvement of the Services;

Details of the processing

The processing related to the management, the proper functioning and the continuous improvement of the Services includes the following purposes:

• Managing the security of the Services;

• Communication on the status of the Services;

• Management of Users’ requests for assistance made via our contact forms.

Legal base

Our legitimate interest in providing you with quality and secure Services to meet your needs.

Your consent when required.

The management of relations with the Supervisors;

Details of the processing

The management of relations with the Supervisors covers the following purposes:

• Management of the commercial relations with the Supervisors;

• Management of the invoicing of the Services.

Legal base

The contract concluded with the Supervisors, and our legitimate interest in providing them with the best possible commercial relations and ensuring the best quality of our Services.

The management of marketing operations;

Details of the processing

The performance of marketing operations includes the following purposes:

• The realization of BtoB prospecting campaigns by e-mail;

• The sending of offers and information to the Data subjects;

• On-line surveys and polls.

Legal base

Our legitimate interest in proposing commercial offers to our BtoB prospects.

Your consent when necessary, in particular for sending offers and other commercial information and for conducting surveys.

The management of accounting and related operations;

Details of the processing

Our processing related to the management of accounting operations includes:

• The edition of invoices;

• Follow-up and reminder of invoicing;

• Management of unpaid bills;

• The general accounting of the company.

Legal base

Our legal obligation under Articles L102 B et seq. of French tax procedures Handbook (“Livre des procedures fiscales”)

Our legitimate interest in ensuring the proper conduct of accounting operations.

The management and response to claims of rights granted By the GDPR and the Data Protection Act as amended.

Details of the processing

This processing covers all the operations necessary to the follow-up of the requests of rights addressed to STRATX SIMULATIONS (qualification of the request, investigations, realization of specific technical operations...). It concerns only the cases where STRATX SIMULATIONS acts as data controller.

Legal base

Legal obligation arising from articles 15 et seq. Of the GDPR and articles 48 et seq. Of the Data Protection Act.

Article 7. Processed Data

The mandatory or optional nature of the Personal data collected and the possible consequences of a lack of response in your regard are specified at the time of their collection.

You can refer to the details of the Personal data we may have about You below.

Details of the Data collected

NB: the detailed information provided below is not intended to be exhaustive and aims above all to inform Data subjects about the categories of Data that STRATX SIMULATIONS is likely to process.

For the proper functioning and continuous improvement of the Services, the Data that may be processed are the following:

• Data relating to your identity: name, surname, address, phone number, email, role, company/university;

• Data relating to the use of our Services, including Data communicated to our teams throughout your requests;

• Your logs and connection data.

For the management of Supervisors:

• Data relating to your identity: name, surname, business contact details (email and phone number), role, company/university;

• Data relating to the use of our Services: details of the subscribed offer, requests for assistance in using our Services, account manager;

• Data related to the payment of invoices: discounts, receipts, balances, outstanding payments, billing information.

For the management of marketing operations:

• Data relating to your identity: name, surname, contact details (email and phone number), company/university, role;

• If You are a Supervisor, the offer to which you have subscribed;

• Data related to our BtoB prospecting actions: date of the first contact, date of the last contact.

For the management of accounting and related operations:

• Data relating to your identity: name, surname, business contact details (email and phone number), company/university, role;

• Transaction Data: transaction number, details of the corresponding offer;

• Payment Data: information on the nature of the operations carried out, details of the offer subscribed by the Supervisor;

• Data related to the payment of invoices: discounts, receipts, balances, outstanding payments, billing information.

For the management of your requests to exercise your rights:

• Data relating to your identity: civility, name, surname, address, phone number, email, birth date. A copy of an identity document or equivalent may be kept as proof of the exercise of a right of access, rectification, or opposition or to meet a legal obligation. In this respect, we are obliged to verify your age at the time of a request, and we must therefore collect a copy of an identity document.

• Data related to your request to exercise your rights.

In any event, ACOME undertakes to process all Data collected in accordance with the GDPR and the Data Protection Act as amended.

Article 8. Recipients

As part of their respective responsibilities and for the purposes recalled above in Article 6, the key persons who may have access to your Data are the following:

• Authorized personnel of the different departments of STRATX SIMULATIONS;

• Companies in charge of the management of our websites;

• Authorized personnel of our processors;

• Regulatory bodies;

• If applicable, the relevant jurisdictions, mediators, accountants, auditors, attorneys, bailiffs, debt collection companies.

Your Data are not shared, exchanged, sold, or loaned to anyone other than those mentioned above without your prior express consent in accordance with applicable legal and regulatory provisions.

The purposes for which we may disclose your Personal Data to processors may include Data storage.

These processors are permitted to use your Personal data only as necessary to provide these services to us and such use is strictly controlled. In this case, STRATX SIMULATIONS will also ensure that the processors adopt appropriate confidentiality and security measures.

Certain categories of processors have access to the Data:

• STRATX SIMULATIONS LLC (Storage location: USA)

• Microsoft Azure (Storage location: USA)

• Avalara (Storage location: USA)

• Hubspot (CRM hosting) (Storage location: USA)

• Bluenote systems (CRM hosting) (Storage location: France)

• Scaleway (e-commerce web hosting) (Storage location: France)

• DoList (transactional emailing system) (Storage location: France)

To obtain more information on our processors, you can send a request to our DPO by e-mail to dpo@stratxsim.com or by mail to STRATX SIMULATIONS – Data Protection Officer, 2, Rue Jean Lantier, 75001 Paris.

Article 9. Data transfers outside the European Union

Given the nature of our business, in some cases, we may transfer your Data outside the European Union.

This is particularly the case when we transfer information to StratX Simulations LLC, Microsoft Azure, Avalara et Hubspot, located in the United States.

In this case, these transfers are accompanied by suitable safeguards in accordance with the regulations. We have taken appropriate measures to ensure that your Data are kept secure via the contractualization of standard contractual clauses approved by the European Commission (art. 46 GDPR).

You may request access to documents ensuring appropriate contractual guarantees by sending a request to our DPO.

Article 10. Data retention period

We only retain your Personal data for as long as it is necessary for the purposes as described in Article 6.

As an indication, click below for more details on the legal retention periods.

For the management, the proper functioning and continuous improvement of the Services

The Data allowing your identification are respectively kept during all the time necessary to the execution of the contract concluded with the Supervisor, and then for a period of five years in intermediate archiving (Art. 2224 of the Civil Code).

Connection logs are kept for a maximum of six months except when they are necessary to prove the commission of an offence, a misdemeanor or a crime.

For the management of business relations with the Supervisors

The Data used in the framework of the management of the commercial relations with the Supervisors are kept during all the time necessary for the execution of the contracts concluded with the latter.

These data are then archived for a period of 5 years for evidentiary purposes (Art. 2224 of French Civil Code).

For the management of marketing operations

The Data used in the framework of BtoB marketing operations are kept for a maximum of 3 years from the end of the commercial relations if you have concluded a contract with STRATX SIMULATIONS or from your last contact if you are a prospect.

Data used for sending newsletters are kept for a period of 3 years from the date of your last contact.

The Data used in the framework of the realization of surveys and polls are preserved for all the time necessary to the analysis of the answers.

For the management of accounting and related operations

The invoices and issued accounting data are kept for 10 years from the date of issue.

The accounting trace of payments is kept for a period of 10 years in intermediate archiving as of the effective realization of the payment (Art. L123-22 of French Commercial Code).

As part of the management of a pre-litigation, the Data are deleted as soon as the dispute is settled amicably or, failing that, as soon as the corresponding legal action is time-barred. The Data collected and processed in the context of a dispute must be deleted when the ordinary and extraordinary remedies are no longer available against the decision rendered.

For the management of your requests to exercise your rights

The data relating to the management of requests for rights are kept for as long as necessary to process the request.

Data are then archived for the duration of the applicable criminal statute of limitations, i.e., six years, in intermediate archiving (Art. 8 of the Code of Criminal Procedure).

Article 11. Your rights

Pursuant to the Data Protection Act and the GDPR, you have the following rights:

• A right to access (article 15 GDPR), rectify (article 16 GDPR), update, and complete your data;

• A right to lock or erase (« right to oblivion ») your Personal data (article 17 GDPR), if it is inaccurate, incomplete, dubious, obsolete or is prohibited from being collected, used, shared or retained;

• A right to withdraw your consent at any time (article 7 GDPR);

• A right to restrict the processing of your data (article 18 GDPR);

• A right to object to the processing of your data (article 21 GDPR);

• A right of portability of the data you have provided us, when your Data have undergone automated processing based on your consent or a contract (article 20 GDPR);

• A right not to be subject to a decision based exclusively on automated processing (article 22 GDPR); no such decision making is currently applied by STRATX SIMULATIONS;

• A right to determine what happens to your Data after your death and to choose whether we should send your Data to a third party whom you designate (article 85 Data Protection Act). In the event of death, and in the absence of any instructions from you, we undertake to destroy your Data unless it proves necessary to retain it for evidentiary purposes or to comply with a legal requirement.

These rights can be exercised, by simple request by e-mail to dpo@stratxsim.com or by mailing a letter to: STRATX SIMULATIONS – Data Protection Officer, 2, Rue Jean Lantier, 75001 Paris.

Finally, You can also file a claim with the supervisory authorities, specifically the CNIL (https://www.cnil.fr/fr/plaintes).

Article 12 – Security

STRATX SIMULATIONS and its processors undertake to implement appropriate technical and organizational measures to ensure the security of the processing of Personal data and the confidentiality of Your Data, in accordance with the Data Protection Act and the GDPR.

In this respect, we take all useful precautions, regarding the nature of your Data and the risks presented by the processing, to preserve its security and, in particular, to prevent the Data from being distorted, damaged or accessed by unauthorized parties.

To this end, in a non-exhaustive way, the following measures have been taken: access to data and databases is restricted to authorized STRATX SIMULATIONS employees only; all authorized STRATX SIMULATIONS employees have access protected by login and password; firewall and IP control for access to SQL databases.