Confidentiality policy

Confidentiality policy

Updated: September 18, 2025
In accordance with legislation on the protection of personal data, in particular, the
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and Law 78-17 of 6
January 1978 amended, Galileo Global Education is committed to protecting all information
personal data collected and used on this site.

1. Who are we?

This policy describes how Galileo Global Education processes personal data.
staff in the course of its activities.
The data controller is Galileo Global Education.

2. Scope of application

This policy applies to all treatments carried out by Galileo Global Education concerning
visitors and users of this site.

3. What data do we collect?

We respect the principle of minimization: only adequate, relevant and limited data
are collected as part of the data processing that we carry out.
The type of personal data collected is as follows:

• Identity, contact and registration data: name, surname, email, telephone, etc.
• Data relating to the website: identifiers, login and navigation data, data
  browser-related, security settings, cookies and other audience measurement tools
• Data related to integrated third-party services: videos, maps, etc.

The data is mainly obtained from direct collections via navigation and data entered at
in particular through the data collection forms or questionnaires on the Galileo website and/or tools
third party.

4. For what purposes and on what legal bases?

The legal basis selected depends on the data processing in question (article 6 of the RGPD):

• Responding to requests for information from site visitors;
• The management of targeted communications (if consent is given);
• The production of anonymized statistics;
• Audience measurement on the site;
• The implementation of computer security measures including the control of connections
  computers.

5. Recipients

Internally, only the relevant Galileo services have access to the data of the persons concerned,
within the limits of their respective responsibilities and needs.
To meet its legal obligations or contractual commitments, Galileo may transmit
personal data to Group entities as well as to its sub-contracting partners and service providers
providers such as hosts or publishers of content or third-party tools.
Any subcontractor is contractually bound to security and confidentiality guarantees offering a
high level of data protection.

6. Transfers outside the EU

We prefer to host personal data within the European Union.
If a transfer outside the EEA is necessary, in this case Galileo Global Education will take all the
measures necessary to ensure that:

• the service provider or partner has an adequate level of protection of personal data
  with regard to the regulations on the protection of personal data
• a compliant mechanism is used such as an adequacy decision or Clauses
  Standard Contractual Agreements validated by the European Commission.

8. Retention periods and security measures

The data collected and processed by Galileo is kept for the time strictly necessary for
purposes and/or to meet legal obligations. This duration may vary depending on the category of
data or the treatments concerned.

9. Exercise of rights

In accordance with Regulation (EU) 2016/679 and French law 78-17 as amended, known as the Data Protection Act and
Freedoms, the person concerned has the right to access, modify, rectify,
deletion of personal data and the right to object for legitimate reasons by
writing to dpo@ggeedu.fr
Galileo has appointed a data protection officer who can be contacted at dpo@ggeedu.fr.
The person concerned also has the right to file a complaint with the national authority of
Data protection who is for France, the NATIONAL COMMISSION FOR INFORMATICS AND
LIBERTIES at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

10. Evolution of this privacy policy

The privacy policy may be amended or amended at any time in case
legal and jurisprudential developments or the processing of data carried out.