1.     DEFINITIONS

Capitalized terms refer to the following definitions:

The "Policy" refers to this Privacy Policy.

“Data" means any information about an identified or identifiable natural person (the "data subject"), directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more elements specific to his or her identity.

“Processing" means any operation applied to Data (collection, recording, organization, storage, adaptation, communication by transmission, dissemination, deletion, etc.).

"You" or the "data subject" means any person whose data is processed by Energy Cities in connection with the provision of the Platform, and in particular the Platform Users.

"We", "the Controller" or "Energy Cities": means the association ENERGY CITIES / ENERGIE-CITES domiciled at 2 CHE DE PALENTE, 25000 BESANCON, registered in the INSEE register of companies and establishments under number 379 716 764 00012.

The "Platform" refers to the LTLC Website published by Energy Cities, accessible from the address: https://www.localtransitionslearning.eu and allowing its Users to access a space for sharing and consulting educational content.

An "Account": refers to the personal account created by each User in order to browse the Platform and access its various non-public features.

A "User" is any person browsing the Platform.

The "Data Controller" is the person who, alone or jointly with others, determines the purposes and means of the Processing.

A "Recipient" refers to the natural or legal person, public authority, service or any other organization that receives communication of Personal Data, whether or not it is a third party.

The "Regulation" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the Processing of Personal Data and on the free movement of such Data (known as the "RGPD"); French Law n°78-17 of 6 January 1978 relating to the protection of personal data; the rules applicable to commercial prospecting provided by the French Post and Telecommunications Code and, more generally, the laws and regulations applicable to the Data Processing that we carry out.

2.     DATA CONTROLLER

The Data Controller mentioned in this Policy is the association ENERGY CITIES / ENERGIE-CITES, domiciled at 2 CHE DE PALENTE, 25000 BESANCON, registered in the INSEE register of companies and establishments under number 379 716 764 00012.

The Data Controller may be contacted at the following address:

-        Postal address: ENERGY CITIES 2 CHE DE PALENTE, 25000 BESANCON

-        Email: data@localtransitionslearning.eu

-        Telephone: +33 (0)3 81 65 36 80

3.     DATA CONCERNED

The Data processed by ENERGY CITIES varies according to your level of use of the Platform, as described below.

Unless otherwise specified, the data is collected directly from the data subject and the collection is mandatory and necessary for the performance of the contract entered into with Energy Cities.

However, certain Data is collected automatically during the User's use of the Platform. When registering on the Platform, mandatory information is marked with an asterisk or other relevant indication. If the User fails to provide the mandatory information, we will not be able to provide access to the Platform.

3.1. When you access the public part of the Platform

Some content on the Platform is public and freely accessible to all Internet users, without the need to create an Account.

When you browse this public part of the Platform, we do not collect any Data about you, except for the storage or reading of cookies that are strictly necessary for the operation of the Platform or to provide you with access to content you wish to access.

3.2.  When you create an Account on the Platform

In order to create your Account, we collect the following Data directly from you via a form:

• Last name, first name
• Email address
• City, Country
• Status: public official / contractor / municipal official / employee / other
• Employer, position
• Level of work experience
• Language preferences
• Consent or refusal to receive communications from ENERGY CITIES

3.3. When you register for a course and access educational content on the Platform

As part of your access to and use of the Platform, we process the following Data. This information is collected through automated processes when you access and use the Platform:

• Account login information: username, password
• Account access and usage data: IP address, operating system, protocols, browser identification, connection time, connection duration, content viewed and downloaded, use of Platform features, settings selected, personalization of your account.
• Activities performed by Users

Participation certificates and badges issued to users

The collection of the following Data is optional and only occurs if you use the corresponding features on the Platform:

• Messages exchanged between Users via the Platform (discussion forum and chat)
• Answers to questionnaires and quizzes on educational content

3.4. In order to assess User satisfaction and to respond to requests, we process the following Data:

The collection of the following Data is optional and will only take place if you contact us or if you leave a comment on the educational content consulted.

• Interactions between Platform Users and Energy Cities (date, time and content of the interaction, login or email address used to contact us)
• Surveys on the quality of the educational content and the experience of using the Platform
• Evaluation of educational content consulted
• Data related to complaints or reports sent by Users to Energy Cities (User or other subject of the report, content of the report)

3.5. In order to comply with our legal obligations and to enable data subjects to exercise their rights regarding the protection of personal data, we process the following Data:

The collection of the following Data is optional and will only take place if you send us a request to exercise your rights regarding personal data.

• Communications relating to the exercise of your rights with regard to the protection of personal data (date, time, nature and content of the communication and any identification documents transmitted in order to justify the identity of the person exercising their rights).

When you browse the Platform, we also collect navigational Data, details of which are set out in this Policy.

4.     PURPOSES AND LEGAL BASIS OF DATA PROCESSING

We collect the Data referred to in point 3 above for the purposes and in accordance with the legal bases set out below:

• Providing access to the Platform and its functionalities (management of authentication procedures, provision of educational content, analysis and monitoring of your progress; exchanges with our services in the event of a request for assistance): The legal basis for Processing is the performance of the contract concluded between you and Energy Cities.
• Sending informative e-mails relating to ENERGY CITIES' activities and news: the legal basis for Processing is your consent to receive such communications.
• Assessing User satisfaction with the Platform and its educational content: the legal basis for Processing is Energy Cities' legitimate interest in using User Data to improve the Platform.
• The transmission of data related to your professional activity and your use of the Platform to the partners of the projects providing the courses: the legal basis of the Processing is the legitimate interest of ENERGY CITIES to transmit these data to its partners, stakeholders of the European projects financing a course, in order to allow them to evaluate the effectiveness of the course in question, to measure the transfer of knowledge, the impact of the project and to identify the training needs of the local actors of energy transition. 
• Management of requests relating to Personal Data (right of access, rectification, opposition, and more generally the rights described in the Policy): the legal basis of the Processing is the respect of a legal obligation of Energy Cities to allow the exercise of the rights of the data subjects with regard to Data protection.

5.     DATA RETENTION PERIODS

The personal data processed by us will be kept for the periods indicated below:

-        Data necessary to provide access to the Platform and its functionalities: for the duration of your use of the Platform plus four (4) years from your last connection or contact with us. 

-        Data related to User review of the Platform and educational content: until the right to object is exercised or the Platform is closed.

-        Data related to the Processing of requests for the exercise of rights by data subjects: data related to the request will be kept for the calendar year of the request plus five (5) years. Any identity documents attached the request will be immediately deleted once the identity of the person making the request has been verified.

-        Information about opt-out lists for receiving communications from Energy Cities: When a person expresses a desire to no longer receive communications from Energy Cities, his or her information is placed on an opt-out list. The person may also request that his or her information be removed from that list at any time.

In addition, the Data Controller may be required to keep the personal data for a longer period of time if it is required to do so by law or by order of an authority, or to demonstrate compliance with its legal or contractual obligations, in accordance with its legitimate interest. 

At the end of the retention period, the personal data will be deleted. Consequently, the right of access, the right of erasure, the right of rectification and the right of portability cannot be exercised after the expiry of the retention period.

6.     DATA RECIPIENTS

In the course of our business, your personal data may be transferred to the third parties listed below. The transfer of data will take place within the limits of what is strictly necessary and with due regard to security.

• Employees of Energy Cities, mainly those responsible for the administration of the Platform and the relationship with users, will have access to all your data.
• Project partners who provide courses on the Platform will receive all data relating to the activities of the users for the course(s) they have funded.
• Our hosting service provider (see legal notice)
• Our IT solution providers (email and CRM): receive your email address and our communications with you.
• Our service provider providing our training platform (Moodle): will receive all your data, with the exception of data relating to your interactions with our services outside of the platform. This service provider will also have access to the data generated during your browsing (see article 7. Information on the use of cookies).
• Upon request, the police, administrative or judicial authorities, whose right of access to personal data is recognized by law, will receive your data in the event of a request on their part or in order to enforce our rights.

7.     INFORMATION ON THE USE OF COOKIES

While you are browsing the Platform, Moodle will store cookies on your terminal (computer, tablet or mobile phone) that are essential to the operation of the Platform in order to ensure your uninterrupted browsing of the Platform.

The following cookies will be stored during your browsing session:

• MoodleSession: this cookie ensures the continuity of your session from one page to the next. It will expire at the end of your session.
• MOODLEID: this cookie remembers your username in the browser from one session to the next, so you don't have to enter it each time you connect. It is stored for one month.

8.     TRANSFER TO THIRD COUNTRIES

As part of the Processing activities carried out by Energy Cities, we store your personal data in the European Union and the European Economic Area (EEA). We use processors who are mainly located in the European Union and who host the data we entrust them with in the EU. Only our learning system management provider (Moodle) is located in Australia.

The contractual relationship with this processor is governed by a data Processing agreement. Occasionally, this processor may transfer data outside the EU in order to provide the Moodle service. In such cases, these transfers are governed by the European Commission's standard contractual clauses, guaranteeing an adequate level of protection for the data transferred.

9.     AUTOMATED DECISION-MAKING AND PROFILING

The data Processing carried out by Energy Cities in the context of providing access to the Platform does not involve any automated decision making or profiling of Users.

10.  EXERCISE OF YOUR RIGHTS

In accordance with the Regulation, you have the following rights with respect to your Personal Data:

• Right of access to your Data being processed (including the right to request a copy) and to the information provided in this Policy (Article 15 GDPR). If the legal basis of the Data Processing is our legitimate interest, you have the possibility to request from our services the information relating to the balancing we have carried out between the interests of our customers and those of Energy Cities prior to such Processing.
• Right to rectification (Article 16 GDPR) and update of your Data held by us.
• Right to withdraw your consent at any time (Article 13-2c GDPR) for any Data Processing based on your consent.
• Right to object (Article 21 GDPR) to the processing of your data where such processing is based on our legitimate interest.
• Right to erasure of your Personal Data (Article 17 of the GDPR) in the following cases:
  • When the Data is no longer needed.
  • When you withdraw your consent to its Processing (if the Processing was based on the legal basis of consent).
  • When you object to the Processing based on Energy Cities' legitimate interest or to the Processing carried out for direct marketing purposes or profiling in connection with direct marketing.

• Right to restriction of the Processing of your Personal Data, which, except for compelling reasons, may no longer be carried out without your consent (Article 18 GDPR), if:
  • you dispute the accuracy of the Data, for the time necessary to verify it.
  • If the Data Processing is unlawful but you object to the deletion of the Data and opt instead for the limitation of the Processing,
  • When we no longer need the Data but it is still necessary for you to establish, exercise or defend your legal rights.
  • Where you have objected to Processing based on our legitimate interest, for the time necessary to balance our respective interests.
• Right to portability of the Personal Data provided by you when it is subject to automated Processing based on your consent or on a contract (Article 20 GDPR). This right means that you have the right to request the communication of this Data in a structured, commonly used and machine-readable format so that it can be communicated to another Data Controller.
• The right to determine the fate of your Data after your death (article 40-1 of French law 78-17 of January 6, 1978) and to choose a trusted third party to whom we will entrust them (more information on this subject on the CNIL website).
• If you wish to exercise any of the above rights or require further information, please contact us at: data@localtransitionslearning.eu or by post at the address provided in the beginning of this Policy. You can also obtain further information on the CNIL website. 

We reserve the right to ask you to specify your request and to provide proof of identity (which will not be kept beyond the time necessary to verify your identity).

If you are not completely satisfied with our response, you always have the right to lodge a complaint with the competent supervisory authority responsible for protecting your personal data (in France, the CNIL).