Privacy Policy
Translation provided for information purposes only: only the French version is legally binding.
1. Data controller
The personal data controller is:
- Jean ST FORT, sole trader
- SIRET: 933 175 374 00034
- Email: [email protected]
2. Data collected
We collect the following data:
| Data | Purpose | Legal basis |
|---|---|---|
| Surname, first name | Account identification | Contract |
| Login, communication | Contract | |
| Password (hashed) | Account security | Contract |
| Purchase history | Access to courses | Contract |
| IP address | Security, logs | Legitimate interest |
| Learning progress (completed lessons, XP, badges, quiz results) | Tracking your learning | Contract |
| Certificates issued before the suspension of certificates (display name, course, identifier, date) | Retention of previously issued certificates; no new certificates are issued at this stage. They are included in your data export. | Contract |
| Questions asked to stakeholders to interview in tutorials and practicals: for each question, the lesson, stakeholder, chosen subsidiary, response type (AI, standard response, refusal) and time; the text of the question and answer only if your teacher enabled the log and the panel notified you. All linked to a pseudonym. | Stakeholder response; usage limits; question log for the class teacher. Stored under a pseudonym; when the log is enabled, your teacher views it under your name. Without the log, your teacher only sees the number of questions from the class. Retained by Lockbay for up to 30 days, then automatically deleted (backups: see Section 5). | Contract |
| Live quiz: displayed pseudonym, answers given and points scored during a session | In-class participation (a pseudonym is sufficient), session ranking. 30 days after the end of the session (closure or last activity), the session is anonymised: pseudonyms, answers and rankings are deleted, leaving only statistics per question without any names (details and backups: see Section 5). | Contract |
Display preferences (theme, font size, contrast) are stored locally on your device and are not transmitted to our servers, with the exception of the theme choice associated with your account.
3. Use of data
Your data is used to:
- Manage your account and your access to courses.
- Process your orders and payments.
- Sending you messages related to your account: the platform sends no other messages. If we also contact you in your role at a school, see section 9.2.
- Ensure the security of the service.
We do not sell your data. We do not send newsletters without your explicit consent.
4. Data sharing
Your data may be shared with:
- Stripe: payment processing (bank details are entered and stored directly with Stripe, never on our servers).
- OVH: data hosting (servers in France).
- Exoscale: storage of backup copies of the platform server, used solely to restore it after an incident.
- Cloudflare: website protection and delivery (proxy); processes IP addresses for security purposes. The site's libraries (icons, code syntax highlighting) are also served by cdnjs.cloudflare.com, which then receives the visitor's IP address.
- Google Fonts: website fonts, loaded from Google servers when pages are displayed; Google then receives the IP address and browser technical details, without cookies. Processing may take place outside the European Union, particularly in the United States; Google LLC adheres to the EU-US Data Privacy Framework.
- Google (Gemini API): artificial intelligence tools in the AI Studio, reserved for teachers and trainers (drafting, proofreading and improving lessons, course plans, quizzes, slides, images, translations, converting an uploaded file into slides); the platform only sends course content and whatever the teacher enters or uploads (text and files). Responses from stakeholders to interview, when your teacher has enabled this panel for your class: Google receives the filtered question text, without your name or account ID. Email addresses, phone numbers, student numbers, postal addresses and recognised names are masked before sending; this automatic masking is not infallible: do not include any personal data in the question. Google processes this data under the terms of the paid Gemini API service: it does not use it to improve its products and only retains it for a limited time to detect abuse. Processing may take place outside the European Union, particularly in the United States; this transfer is governed by the European Commission's standard contractual clauses, incorporated into Google's Data Processing Addendum, and Google LLC adheres to the EU-US Data Privacy Framework.
5. Data retention
- Active account: data retained for as long as the account exists.
- After account deletion: data anonymised or deleted within 30 days.
- Billing data: retained for 10 years (legal obligation).
- Questions to stakeholders to interview: automatically deleted from Lockbay's database within 30 days at most.
- Live quiz: 30 days after the end of a session, it is automatically anonymised.
- Deleted: usernames, the participant list, individual responses and rankings.
- Retained for the teacher, without any names: the quiz title and questions, the number of participants and, for each question, the number of answers, the percentage of correct answers, the breakdown of choices and the average response time. No text typed by a student is retained.
- 5-participant threshold: below this threshold, only the number of participants is retained. Similarly, a question with fewer than 5 answers only keeps this number. With so few students, a percentage would reveal someone's answer.
- End of the session: the latest of three dates: its launch, its closure and the last activity of a participant. A session that is never closed therefore counts from its last activity, or from its launch if no one joined it.
- Backups: they are used solely to restore the platform after an incident. They keep a copy of the data until it is replaced: 7 days for daily backups, 4 weeks for weekly backups, 6 months for monthly backups. Copies made before server maintenance are automatically deleted after 180 days, within 6 months. A restoration does not extend any retention period: deletions and 30-day anonymisation apply as soon as the service is back up. Data from your deleted account disappears from backups when they are replaced.
6. Your rights (GDPR)
You have the following rights:
- Access: obtain a copy of your data.
- Rectification: correct your information.
- Deletion: request the erasure of your data.
- Portability: receive your data in a readable format.
- Objection: object to certain processing.
- Restriction: request the temporary suspension of processing.
To exercise these rights: [email protected]. Progress emails can be disabled at any time in your account settings; none are currently sent.
7. Cookies
We only use a technical session cookie (lockbay_session, httpOnly, 7-day duration) required for authentication. No advertising or third-party tracking cookies are used: this is why no consent banner is displayed.
8. Security
We implement appropriate security measures:
- HTTPS encryption across the entire site.
- Passwords hashed with a modern algorithm, never stored or transmitted in plain text.
- Authentication tokens stored in an httpOnly cookie, inaccessible to page JavaScript.
- Restricted data access; labs: one environment per student, automatically stopped after 2 hours (6 hours for Extreme level labs).
- Secure servers (OVH, France).
9. Schools, outreach, quotes and demos
9.1 Accounts created for a school
When a school (secondary school, school, apprenticeship training centre) uses Lockbay Academy for its classes, the school is the data controller for the data of its students and teachers; Lockbay acts on its behalf as a processor (Article 28 of the GDPR). The data processed, sub-processors, security measures and the fate of data at the end of the contract (export, then deletion) will be set out in an addendum to the contract, signed with the school before any student data is handled. As a student or teacher, please direct your requests to your school first; Lockbay assists it in responding.
9.2 School outreach
To introduce Lockbay Academy to schools providing IT and cybersecurity training (particularly BTS SIO), we maintain a tracking file of the schools and people we contact. This is an internal tool, reserved for Lockbay. It sends no messages: each message is written and sent by hand, one by one, then recorded in the file. The key points are also set out on the Information for professional contacts page.
- Data subjects: individuals working in an educational institution: teachers (particularly for BTS SIO, SISR and SLAM options), vocational and technical training directors (DDFPT), programme heads, headteachers and deputy headteachers, school directors, and administrative offices. The file also contains generic school addresses (for example
ce.<numéro de l'établissement>@ac-<académie>.fr). - Data: first name, surname, role and school; professional contact details (email address, school switchboard or direct work line); address of your professional LinkedIn profile, if we visited it; source and date of collection; history of our correspondence (date, channel, subject, brief summary); factual notes, such as the next scheduled follow-up.
- What we do not record: the tool rejects consumer email addresses (Gmail, Orange, Free, etc.). The only exception: if your record is linked to your Lockbay Academy account (see below), it may contain a personal address; this address is only used to link the record, and we never write to it to present our offering. For phone numbers, we only record the school switchboard or a professional line. Our notes only cover professional facts: nothing about your health, private life or beliefs, and no personal judgements; furthermore, the tool rejects notes containing certain words related to these topics. No student data is included.
- Sources: the Annuaire de l'éducation (Ministry of National Education), Parcoursup open data, the list of SecNumedu-certified courses (ANSSI), your school's website, ONISEP, your LinkedIn profile checked manually, a meeting at an exhibition, a recommendation from a contact, or your own request. We collect this information manually: no bots, no browser extensions, no purchased databases. The message informing you states where your data came from, and whether that source is public.
- Purpose: to introduce you, in your professional role, to our educational tools (courses, online practicals, tools for teachers) and our offering for schools; to follow up on our communications, meetings and demos; to respect your objection. Our messages relate to your professional activity: we do not make any offers to you in a personal capacity.
- Legal basis: Lockbay's legitimate interest (Article 6.1.f of the GDPR): introducing Lockbay Academy to schools and relevant professionals. We do not need your prior consent, but you may object at any time.
- Information: when we collect your contact details without having written to you yet, we inform you within one month, or upon our first message if it is sent sooner. The tool reminds us to do so.
- Lockbay Academy account: if you also have an account on the platform, we can link your record to this account using your email address. The tool only reads this address from the account. It does not use your courses, classes, or results.
- Recipients: Lockbay only. Data is stored with our hosting providers: OVH, on servers in France, and Exoscale for server backups (see section 4). Emails we send you also go through our email service provider; if we write to you on LinkedIn, the message also goes through LinkedIn, according to its own policies. Your data is not sold, rented or shared, and the tool does not send it to any artificial intelligence service.
- Security: the file can only be accessed by Lockbay, from a private network and using an administrator account. Every modification made in the tool is recorded in a technical log, with its date and type (for example, a creation, objection or erasure). This log contains neither your name nor your contact details, but it may retain your role, the source of your data and your school.
- Automated decision-making: none. The tool only indicates the follow-up status (for example 'to follow up'); a person decides whether to write to you.
- Retention: 3 years after the last contact from you (a reply, a request), or after collection if you never replied to us. Our own messages and follow-ups do not extend this period. Afterwards, the record and the history of our exchanges are deleted. If the record is linked to your account, only the history of our exchanges is deleted; the record remains for as long as your account exists. Deleted data disappears from backups within 6 months at most (see section 5).
- Opt-out list: if you object, we keep a hash of your email address, phone number and LinkedIn profile (when we had them), for as long as we carry out prospecting, and for at least 3 years. This hash is calculated using a secret key, kept separately: without this key, your contact details cannot be retrieved from the hash. It is used solely to recognise them if they are entered again, so that we no longer write to you.
- How to object: at any time, without giving a reason and free of charge. Reply 'stop' to any of our messages, or write to [email protected]; an objection made by phone, on LinkedIn or in person also counts. We will no longer write to you. If you do not have a Lockbay Academy account, your record and the history of our exchanges with you are deleted; all that remains is the hash described above, the technical log described above and, on your school's record, an anonymous note ('a contact objected', with the month). If you also have a Lockbay Academy account, it is unaffected, and you will still receive messages related to this account; your record remains, marked 'do not contact', for as long as your account exists: we remove your LinkedIn profile, the source of your data and the content of our exchanges from it, and we keep your name, role and contact details, and the date of our exchanges, to respect your objection. In both cases, we also remove your name from the notes taken on your school. If the objection comes from a school's generic address, we stop contacting that school.
- Your rights: access (a copy of your record, including history and notes), rectification, erasure, restriction (freezing the use of your data) and objection. Write to [email protected]; we will reply within one month. If you request erasure, we delete your record and the history of our exchanges, and we remove your name from the notes taken on your school; we keep the hash described above, so we do not write to you again, and the technical log described above. You can also lodge a complaint with the CNIL (www.cnil.fr).
9.3 Quote or demo request form
- Data: school, name, email address, phone number (optional), headcount, package of interest and message.
- Purpose: respond to your request (quote, demo). Legal basis: pre-contractual measures taken at your request (Article 6.1.b of the GDPR).
- Processing: the request is sent by email to Lockbay; it is not stored in the platform's database.
- Retention: 3 years after the last exchange if no order follows; in the event of an order, with the customer file (invoices: 10 years, see section 5).
9.4 Webinars and demos
- Data: name, email address, school and role; for a demo, the chosen time slot.
- Purpose: to send you the connection link, a reminder the day before and a follow-up message. Legal basis: your registration (article 6.1.b of the GDPR).
- Video conferencing: the video conferencing tool is indicated in the invitation.
- Retention: 3 months after the webinar or demo if you do not follow up, then deleted.
10. Contact
For any questions regarding your personal data:
- Email: [email protected]
- Address: 5 rue Pierre Savignol, 31100 Toulouse
You can also lodge a complaint with the CNIL: www.cnil.fr
Last updated: 17 October 2026