Privacy

RCTT Research Academy determines the purposes and means of the processing described on this page. It acts as the data controller within the meaning of the General Data Protection Regulation (GDPR) and applicable personal data protection laws.

Controller

RCTT Research Academy

Registered office

[TO BE COMPLETED — full address]

Data protection contact

contact@rctt.academy

Data protection officer

[TO BE COMPLETED — name and contact details, if appointed]

• Account: first name, last name, e-mail address, password (stored only in hashed form, never in clear text), role and membership status.
• Profile: phone, country, city, institution, academic level, research field, photo.
• Membership: requested category, motivation letter, curriculum vitae and supporting documents, declaration of consent.
• Grants and applications: name, e-mail address, motivation, requested budget, event concerned, evaluation notes.
• Orders and payments: amount, reference, status and date of the transaction. Card details are entered directly with our payment provider and are never stored on our servers.
• Conversational assistant: the content of the messages you send to it.
• Newsletter: e-mail address.
• Contact form: name, e-mail address, message.
• Technical and usage data: pages viewed, device and browser type, IP address, audience measurement data.

We do not collect sensitive data (origin, opinions, trade union membership, health, etc.). The information requested is necessary to handle your request: without it, we cannot proceed.

Create and manage your account

Performance of a contract

Process membership and grant applications

Pre-contractual steps and legitimate interest (selection of applications)

Issue and track orders and payments

Performance of a contract and statutory accounting obligations

Reply to messages sent through the contact form

Legitimate interest

Send the newsletter

Consent, withdrawable at any time

Keep the service secure and prevent abuse

Legitimate interest

Measure audience and improve the service

Consent, or legitimate interest for exempt analytics

Active account

For the duration of use, then 3 years after the last contact

Unsuccessful applications

[TO BE VALIDATED — 12 months recommended]

Accounting records and invoices

10 years (statutory retention requirement)

Contact form messages

3 years after the last exchange

Newsletter consent

Until consent is withdrawn, then 3 months

Technical and security logs

12 months

Messages sent to the assistant

[TO BE VALIDATED — 12 months recommended]

Once these periods expire, the data is irreversibly deleted or anonymised.

Your data is accessible to authorised members of the RCTT team, within the limits of the rights attached to their role. It is also processed by the following technical providers, acting on our instructions:

Hosting of servers and database

OVH SAS (France)

Content delivery network and DNS

Cloudflare, Inc. (United States)

Transactional e-mail delivery

Resend (United States)

Payment processing

CinetPay

Audience measurement

Google Analytics (Google Ireland Limited, Google LLC)

Artificial intelligence model provider

Provider configured for the conversational assistant

Your data is never sold, rented or transferred for advertising purposes.

Some providers are established outside the European Union (Cloudflare, Resend, Google, artificial intelligence model provider). Such transfers are governed by the safeguards provided for by the GDPR.

Safeguards relied upon

[TO BE CONFIRMED — standard contractual clauses or adequacy decision depending on the provider]

• Strictly necessary items: an authentication token kept in your browser's local storage to maintain your session, and your light or dark theme preference.
• Audience measurement: Google Analytics, used to understand which pages are viewed and to improve the website. No data is used for advertising purposes.

The website sets no advertising cookie and no third-party social network tracker. You may clear your browser storage at any time to remove these items, at the cost of signing in again.

Collection of consent for audience measurement

[TO BE COMPLETED — consent banner if required by applicable law]

• Access the data we hold about you and obtain a copy.
• Request the rectification of inaccurate or incomplete information.
• Request the erasure of your data where its retention is no longer justified.
• Request restriction of processing, or object to processing based on our legitimate interest.
• Receive the data you provided to us in a structured, machine-readable format (portability).
• Withdraw your consent at any time, without affecting processing already carried out.
• Lodge a complaint with the competent supervisory authority.

To exercise these rights, write to contact@rctt.academy. You will receive a reply within one month. Proof of identity may be requested in case of reasonable doubt as to your identity.

Passwords are stored in hashed form and are never readable, including by the team. Traffic with the website is encrypted (HTTPS). Access to data is restricted by a permission system: each team member only sees what their role allows. The documents you submit are stored in a dedicated space and served through controlled links.

In the event of a data breach likely to result in a high risk to your rights, you and the competent supervisory authority will be informed within the time limits set by the regulations.

This policy may be updated to reflect changes in the service or in the regulations. The last updated date appears at the top of this page. In the event of a substantial change, you will be informed by e-mail or through the website.