Information for professional contacts

Translation provided for information purposes only: only the French version is legally binding.

You have received a message from Lockbay Academy in connection with your role at an educational institution. This page explains what we do with your data and how to object.

Key information

• Who: Lockbay Academy, a platform offering cybersecurity courses and practicals for classes (particularly BTS SIO). It is published by Jean ST FORT, sole trader, in Toulouse.
• Where your contact details come from: from the source indicated in our message, such as the Annuaire de l'éducation or your school's website. We collect them manually.
• What data: your first name, surname, role and school, your professional contact details, and the history of our correspondence.
• Why: to introduce our educational tools and our offer for schools, in connection with your role. The GDPR calls this legitimate interest: we do not need your prior consent, but you can object at any time.
• How long: 3 years after your last reply or request, or after your contact details were collected if you have never replied. We then delete them (if you also have a Lockbay Academy account, see section 6).
• Your rights: obtain a copy of your data, have it corrected or deleted, restrict its use, object. Write to [email protected].
• Stop receiving messages: reply 'stop' to any of our messages, or write to [email protected].

1. Who processes your data

• Jean ST FORT, sole trader, publisher of Lockbay Academy
• SIRET: 933 175 374 00034
• Address: 5 rue Pierre Savignol, 31100 Toulouse
• Email: [email protected]

Details of the publisher can be found in the legal notice.

2. Who this concerns, and what data

We maintain a tracking file of educational institutions and the people we contact. It is an internal tool, restricted to Lockbay. It does not send any messages: each message is written and sent manually, one by one, then recorded in the file.

• People concerned: teachers (particularly BTS SIO, SISR and SLAM options), vocational and technical training directors (DDFPT), programme leaders, headteachers and deputy headteachers, school heads, administrative offices. The file also contains generic school addresses.
• Data: first name, surname, role and school; professional contact details (email address, school switchboard or direct work line); address of your professional LinkedIn profile, if we visited it; source and date of collection; history of our correspondence (date, channel, subject, brief summary); factual notes, such as the next scheduled follow-up.
• No personal addresses: the tool rejects consumer email addresses (Gmail, Orange, Free, etc.). The only exception: if your record is linked to your Lockbay Academy account, it may contain a personal address. This address is used solely to link the record: we never write to you there to present our offer.
• Work-related notes only: nothing about your health, private life or beliefs, and no personal judgements. In addition, the tool rejects notes containing certain words relating to these topics.
• Lockbay Academy account: if you also have an account on the platform, we can link your record to this account using your email address. The tool only reads this address from the account. It does not use your courses, classes, or results.

3. Where your data comes from

From one of the following sources: the Annuaire de l'éducation (Ministry of National Education), Parcoursup open data, the list of SecNumedu-certified courses (ANSSI), your school's website, ONISEP, your LinkedIn profile viewed manually, a meeting at a trade fair, a recommendation from someone, or your own request.

We collect this information manually: no bots, no browser extensions, no purchased contact lists. The message informing you states where your data comes from, and whether this source is public. When we collect your contact details without having written to you yet, we inform you within the following month, or in our first message if it comes sooner.

4. Why, and on what basis

• Purpose: to introduce, in connection with your role, our educational tools (courses, online practicals, teacher tools) and our offer for schools; to track our correspondence, meetings and demos; to respect your objection. We do not make any offers to you in a personal capacity.
• Legal basis: Lockbay's legitimate interest (Article 6.1.f of the GDPR): to introduce Lockbay Academy to schools and professionals in relevant roles. We do not need your prior consent, but you can object at any time (section 7).
• Automated decision-making: none. The tool only indicates the follow-up status (for example 'to follow up'); a person decides whether to write to you.

5. Who has access

• Lockbay only. The file can only be accessed from a private network, using an administrator account.
• Technical log: every change made in the tool is recorded there, along with its date and type (for example, creation, objection or deletion). This log contains neither your name nor your contact details, but it may retain your role, the source of your data and your school.
• Hosting: OVH, on servers in France; Exoscale, for server backups.
• The emails we send you also go through our email service. If we write to you on LinkedIn, the message also goes through LinkedIn, subject to its own rules.
• Your data is neither sold, rented, nor shared. The tool does not send it to any artificial intelligence service.

6. How long

• Your record: 3 years after the last contact from you (a reply, a request), or after collection if you have never replied to us. Our own messages and follow-ups do not extend this period. After that, the record and the history of our correspondence are deleted.
• If your record is linked to your Lockbay Academy account: after these 3 years, only the history of our correspondence is deleted. The record remains for as long as your account exists.
• Backups: deleted data disappears from backups within 6 months at most.
• Opt-out list: if you object, we keep a hash of your email address, phone number and LinkedIn profile (when we had them), for as long as we carry out prospecting, and for at least 3 years. This hash is calculated using a secret key, kept separately: without this key, your contact details cannot be retrieved from the hash. It is used solely to recognise them if they are entered again, so that we no longer write to you.

7. How to object

You can object at any time, without giving a reason and free of charge. Reply 'stop' to any of our messages, or write to [email protected]. An objection made by phone, on LinkedIn or in person also counts.

• We will no longer write to you.
• If you do not have a Lockbay Academy account: your record and the history of our exchanges with you are deleted. All that remains is the hash described above, the technical log described in section 5 and, on your school's record, an anonymous note: 'a contact objected', with the month.
• If you also have a Lockbay Academy account: it is unaffected, and you will still receive messages related to this account. Your record remains, marked 'do not contact', for as long as your account exists. We remove your LinkedIn profile, the source of your data and the content of our exchanges from it. We keep your name, role and contact details, and the date of our exchanges, to respect your objection.
• In both cases, we also remove your name from the notes taken on your school.
• If the objection comes from a school's generic address, we stop contacting that school.

8. Your rights

• Access: receive a copy of your record, including history and notes.
• Rectification: have inaccurate data corrected.
• Erasure: have your record and the history of our exchanges deleted. We also remove your name from the notes taken on your school. We keep the hash described above, so we do not write to you again, and the technical log described in section 5.
• Restriction: ask us to freeze the use of your data, for example while we verify data you dispute.
• Objection: see section 7.

Write to [email protected]; we will reply within one month. You can also lodge a complaint with the CNIL: www.cnil.fr.

9. Find out more

This processing is also described in our privacy policy (section 9.2). The full details of the publisher and host can be found in the legal notice.

Last updated: 17 October 2026