Privacy Policy

1. Definitions and Key Terms

This Privacy Policy explains what personal data Talence Security collects through talencesecurity.com and related services, and how we use it. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

For this Privacy Policy:

• Personal Data: Any information that identifies you directly or indirectly, such as your name, email address, or IP address.
• Cookies and Local Storage: Small pieces of data stored on a user's device by a website, as described in our Cookie Policy.
• Data Controller: Talence Security, EURL registered at RCS Paris 130 588 254, 138 Avenue Victor Hugo, 75016 Paris, France.
• Data Subject: Any identified or identifiable natural person whose personal data is processed.

2. Information We Collect

We collect the following types of information:

Required Information:

• Email Address: Required for account creation, authentication, and communication
• Password: Securely hashed for account security

Optional Information:

• Username: For user identification on the platform
• Name and Family Name: For personalizing the user experience
• Phone Number: For contact purposes and account security
• Profile Picture: For user identification and personalization
• Other Profile Fields: Country, job title, company or organization, and biography, if you choose to provide them

Payment Information: Talence Security never receives or stores full payment card details. Card information is processed directly by our payment processor, Stripe, in accordance with PCI DSS standards. We retain the transaction, billing, and accounting information needed to manage purchases, handle refunds, and meet our legal obligations.

3. Data Collection Methods

We collect personal information through:

• Direct Collection: Registration forms and profile updates on our platform
• Automatic Collection: Learning progress, course interactions, lab environment activity (such as commands executed, network traffic within the lab, and files created), and platform usage
• Cookies and Local Storage: Used solely for authentication, security, and remembering your preferences
• Server Logs: IP addresses, browser information, and access logs for security purposes. Server logs are retained in active systems for up to 12 months, after which they are deleted, subject to the backup cycle and investigation retention described in Section 9

4. Use of Information

We use the information collected for the following purposes. The legal basis for each is indicated in parentheses:

• Account Management: Create, maintain, and secure user accounts (contract)
• Educational Services: Provide personalized learning experiences and track progress (contract)
• Optional Profile Features: Display the optional profile information you choose to provide. You can edit or remove it at any time (consent)
• Communication: Send course updates, notifications, and support responses (contract). Promotional communications about new courses or services are sent only with your consent
• Platform Improvement: Process usage data to produce aggregated or anonymized statistics that help us improve our services (legitimate interest)
• Security: Detect and prevent unauthorized access and fraudulent activities (legitimate interest)
• Exam Integrity: Monitor and analyze certification exam activity, including lab environment interactions, submitted reports, and timing data, to verify compliance with exam rules (contract)
• Legal Compliance: Meet accounting, tax, and other regulatory requirements (legal obligation)
• Enforcement and Legal Claims: Enforce our Terms of Use, investigate abuse, prevent fraud, and establish, exercise, or defend legal claims (legitimate interest)

5. Legal Basis for Processing Personal Data

We process personal data based on the following legal grounds:

• Consent: We process your data where you have given consent for a specified purpose
• Contract: We process your data to fulfill our contractual obligations to provide educational services
• Legitimate Interests: We process your data for legitimate business interests, provided these do not override your rights and freedoms
• Legal Obligations: We process your data to comply with applicable laws and regulations

6. Data Sharing and Third Parties

We do not sell, trade, or rent your personal information to third parties. We may share data in the following limited circumstances:

• Service Providers: Trusted third-party services that assist in platform operations (e.g., Stripe for payments, OVHcloud for hosting, Brevo for transactional email delivery)
• Legal Requirements: When required by law, court order, or legal process
• Safety and Security: To protect the rights, property, or safety of our users or others
• Business Transfers: In connection with any merger, sale, or transfer of company assets

All third-party service providers are required to maintain appropriate data protection measures.

7. Data Security

We implement appropriate technical and organizational measures, proportionate to the nature of the data and the risks of the processing, to protect your personal information. These include, for example:

• Encryption: Data transmission is protected using TLS encryption
• Password Security: Passwords are stored using one-way hashing
• Access Controls: Access to personal data is limited to those who need it
• Security Assessments: Periodic review and testing of our security measures
• Incident Response: Procedures for detecting and responding to security incidents

No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

We assess any personal data breach and make the notifications to supervisory authorities and affected individuals required by applicable data protection law.

8. Your Privacy Rights

Under applicable data protection laws (including GDPR), you have the following rights:

Automated Decision-Making. Certification exam scoring may involve automated processing (such as flag verification). Where exams include a report component, human review is part of the grading process. You have the right to request human review of any automated decision that significantly affects you.

To exercise these rights, contact us through our contact page, support form, or by email at . We may ask you to verify your identity before acting on a request. We will respond to data rights requests within one month as required by applicable law. If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. For users in France, this is the CNIL.

9. Data Retention

We retain personal data based on the following criteria:

• Active Accounts: Data is retained while your account remains active. Accounts with no purchased courses and no login activity for 3 years may be flagged as inactive; we will notify you by email before any data deletion and give you the opportunity to reactivate. Accounts with purchased courses are never deleted for inactivity
• Certification Exams: Identity verification may be required before an exam attempt; verification data is used solely for candidate authentication and is not retained. Lab logs and timing records are retained until a pass or fail decision is issued and any review you request is completed, then permanently deleted, unless they are needed for an investigation described below. Submitted reports are retained for up to 5 years after the exam date for certification integrity and verification purposes, after which they are permanently deleted
• Course Lab Activity: Lab activity logs outside exams are retained for no longer than 12 months, then deleted
• Account Deletion: When you delete your account, personal data associated with it is deleted or irreversibly anonymized, except for the data described below that must or may be retained
• Certification Records: Certification records (credential ID, name, course, and issue date) are retained for as long as the credential remains publicly verifiable. Because our certifications do not expire, this continues until you request deactivation. You may request erasure of your personal data from certification records; doing so permanently deactivates public verification for that credential, as it can no longer be authenticated
• Legal Requirements: Accounting and billing records are retained for up to 10 years as required by French commercial law
• Investigations and Claims: Data related to suspected abuse, fraud, or a dispute is retained until the matter is resolved and any applicable limitation period has expired
• Backup Systems: Residual copies in backup systems are deleted according to our backup cycle, within 90 days of deletion from the primary systems

10. Children's Privacy

We are committed to protecting children's privacy:

• Users must be at least 18 years old, or at least 16 with verifiable parental or guardian consent, to create an account
• We do not knowingly collect personal information from users below the applicable minimum age without verifiable parental or guardian consent
• Parents and guardians can review, modify, or delete their child's information by contacting us
• If we become aware that we have collected information from a user below the minimum age without appropriate consent, we will delete it promptly

11. International Data Transfers

Our platform and databases are hosted by OVHcloud in France. Transactional emails are sent through Brevo, which processes data in the European Union.

Payments are processed by Stripe. Payment data may be transferred to Stripe, Inc. in the United States, which is certified under the EU-U.S. Data Privacy Framework (covered by an adequacy decision of the European Commission), with Standard Contractual Clauses as an additional safeguard.

We will update this section if additional transfer destinations are added.

12. Cookies and Tracking

Our use of cookies and local storage is detailed in our Cookie Policy. Key points:

• We use only cookies that are necessary for authentication, security, and remembering your preferences
• No third-party, advertising, or tracking cookies are used
• You can manage cookie preferences through your browser settings
• Some cookies are necessary for platform security and cannot be disabled

13. Changes to Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices or legal requirements:

• Users will be notified of material changes via email at least 30 days before they take effect, unless a shorter period is required by law or reasonably necessary for security, fraud prevention, or regulatory compliance
• Changes take effect on the date stated in the updated policy
• Where required by applicable law, we will obtain your consent before processing your personal data for a new purpose
• If you disagree with an update, you can contact us or delete your account at any time