Privacy Policy
This is a translation of the French Politique de confidentialité. In the event of any discrepancy, the French version prevails.
1. Data controller
SOCIÉTÉ DE L’ÉCOLE NOUVELLE, a société anonyme with a board of directors, share capital EUR 28,876,346.43, registered with the Évreux trade register under number 573 651 197, registered office at Pullay Verneuil-sur-Avre, 27130 Verneuil d’Avre et d’Iton, operating École des Roches, is the controller for the processing described in this policy.
2. Scope
This policy covers data collected through www.ecoledesroches.com, its forms, the OpenApply admissions portal and the resulting correspondence.
Processing relating to enrolled pupils is governed by the contractual documents and school rules provided to families at enrolment. This policy applies in addition to those.
3. Contact
For any question about this policy, or to exercise your rights:
contact@ecoledesroches.com
SOCIÉTÉ DE L’ÉCOLE NOUVELLE, 295 avenue Edmond Demolins, 27130 Verneuil d’Avre et d’Iton, France
+33 (0)2 32 60 40 00
Data protection requests are passed internally to the relevant department and handled within the timescales set out in section 11.
4. Data we collect
4.1 Families and applicants
- Identity: names of the pupil and of their legal guardians
- Contact details: email address, telephone number, country of residence
- Education data: intended year group and programme, previous school, reports and documents submitted with the application
- Languages spoken and nationality, where needed to identify the appropriate programme
- Correspondence with the admissions office
4.2 Boarding data
Where an application concerns boarding, health-related information may be provided — allergies, dietary requirements, ongoing treatment, support needs. This is special category data under Article 9 GDPR.
It is collected only with the explicit consent of legal guardians or, in an emergency, to protect vital interests. Access is restricted to health and boarding staff who need it in the course of their duties, and it is never used for communications or marketing purposes.
4.3 Job applicants
Data submitted through the Careers page: name, contact details, CV, employment history and education.
4.4 Site visitors
Connection and browsing data: IP address, browser type, pages viewed, date and time. This is collected for audience measurement only after your consent, as described in section 12.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to an enquiry or visit request | Pre-contractual steps taken at your request (Art. 6.1.b) |
| Processing an admissions application | Pre-contractual steps (Art. 6.1.b) |
| Running open days and campus visits | Pre-contractual steps (Art. 6.1.b) |
| Processing boarding-related health data | Explicit consent (Art. 9.2.a) or protection of vital interests (Art. 9.2.c) |
| Sending information about programmes and events | Consent (Art. 6.1.a), withdrawable at any time |
| Publishing photographs and video of pupils | Consent of legal guardians (Art. 6.1.a) |
| Processing a job application | Pre-contractual steps (Art. 6.1.b) |
| Measuring site audience | Consent (Art. 6.1.a) |
| Site security and proper functioning | Legitimate interest (Art. 6.1.f) |
| Meeting legal and accounting obligations | Legal obligation (Art. 6.1.c) |
6. Minors
Under Article 7-1 of French Law no. 78-17 of 6 January 1978, where processing is based on consent, a minor under the age of fifteen may consent only jointly with their legal guardians. Note that the threshold in France is fifteen, not sixteen.
The site’s forms are reserved for legal guardians and adults. Prospective pupils who are minors are asked to involve their legal guardians in any enquiry, visit request or application.
Where we identify that a form has been completed by a minor under fifteen, no consent-based processing is undertaken — including any sending of information — until guardian approval has been obtained. Failing that, the data is deleted.
7. Recipients and processors
Your data is neither sold nor rented. It is accessible to authorised École des Roches staff — admissions, leadership, pastoral, health, communications and human resources — within the limits of their duties, and to the following processors within the meaning of Article 28 GDPR:
| Recipient | Role |
|---|---|
| Faria Education Group (OpenApply) | Application portal and admissions management |
| DreamHost, LLC | Site hosting — United States |
| thinkClever Agency | Site design and maintenance |
| Google Ireland Limited | Audience measurement and online advertising |
| Meta Platforms Ireland Limited | Instagram feed and social media |
| Email service provider | Email delivery |
Each of these providers is bound by a processing agreement governing the terms on which they handle data on our behalf.
Data may also be disclosed to administrative or judicial authorities where the law requires it.
8. Transfers outside the European Union
The site is hosted by DreamHost, LLC, a company established in the United States. Data collected through the site — including data entered into its forms — is therefore processed outside the European Union.
This transfer is framed by the European Commission’s standard contractual clauses and, where the provider is certified under it, by the EU-US Data Privacy Framework.
Certain audience measurement and advertising tools also involve transfers to the United States under the same mechanisms.
As École des Roches welcomes families from more than fifty countries, correspondence may also take place with individuals located outside the European Union, at their own request, as part of processing their application.
9. Retention periods
| Category | Period |
|---|---|
| Enquiries that do not proceed | 3 years from last contact |
| Unsuccessful applications | 3 years from the decision |
| Enrolled pupil files | Duration of schooling, then 5 years — excluding documents subject to a longer statutory archiving obligation |
| Job applications | 2 years from last contact |
| Boarding health data | Deleted on the pupil’s departure, unless legally required otherwise |
| Accounting and contractual records | 10 years, under the French Commercial Code |
| Cookie consent records | 6 months |
| Audience measurement trackers | 13 months maximum |
At the end of these periods, data is deleted or anonymised.
10. Security
We apply appropriate technical and organisational measures: encrypted transmission (HTTPS), access control on a need-to-know basis, regular backups, maintenance of site components and staff awareness training.
Where a breach is likely to result in a risk to your rights and freedoms, the CNIL and, where applicable, the individuals concerned will be notified under Articles 33 and 34 GDPR.
11. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection, and portability; the right to withdraw consent at any time; and the right to give directions concerning your data after your death.
These rights are exercised through the address in section 3. We respond within one month, extendable by two months for complex requests, and may request proof of identity where there is reasonable doubt.
You may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
12. Cookies and trackers
On your first visit, a banner allows you to accept or refuse all non-essential cookies. Refusing is as straightforward as accepting. Your choices are kept for six months and can be changed at any time through the Cookie settings link in the footer.
- Strictly necessary cookies: site functionality, security, remembering your choices. Set without consent.
- Audience measurement cookies: traffic and browsing paths. Consent required.
- Advertising cookies: campaign measurement. Consent required.
- Third-party content: video players and social media feeds, which may set their own trackers. Consent required.
A full list of the cookies set is available from the cookie settings panel.
13. Changes
This policy may be amended to reflect legal developments or changes to our processing. The applicable version is the one published on the site.
