Privacy policy

The data controller is Joffrey Herard, publisher of the site, whose registered office is at Maison L, 34 rue de Solférino, 51100 Reims, France. Any request concerning your data may be sent to him at contact@ofnir.fr.

No data protection officer has been appointed: the activity falls under none of the mandatory cases of article 37 GDPR (neither a public body, nor large-scale monitoring, nor large-scale processing of sensitive data). This is therefore not an oversight, and the publisher answers in person.

Each bullet below describes one processing operation: the data involved, the purpose pursued, the legal basis that allows it, and the retention period.

• Teacher account — name, email address, password stored as a hash (never in clear text) — purpose: creating and operating your account — legal basis: performance of the contract — retention: 3 years after the last sign-in, then deletion, preceded by 30 days' notice sent by email.
• Billing — company name, SIRET number, VAT number, billing address — purpose: issuing and keeping invoices — legal basis: legal obligation (article L123-22 of the French commercial code) — retention: 10 years.
• Students imported by the teacher — surname, first name, email address, the login identifier derived from them, and their attachment to a cohort — purpose: opening their access to the lab exercises — the institution that imports them is the data controller, the publisher acts only as a processor, under the terms of the data processing agreement published on the “Data processing” page — retention: this data is deleted along with the teacher's account, or at any time by the teacher.
• A student's lab activity records — frames sent and received, simulated device configurations, the scripts they write, execution logs of their virtual environments — purpose: running the virtual laboratory and letting their teacher follow and assess their work — the institution is the data controller and the publisher the processor, on the same terms as above — retention: these records live with the lab session, can be exported as JSON, and disappear with the containers when the session is closed or with the teacher's account.
• Technical logs — IP address, timestamp, requested URL — purpose: service security and incident diagnosis — legal basis: legitimate interest — retention: 12 months at most.
• Transactional emails — address verification, password reset, deletion notice — purpose: operating the account — legal basis: performance of the contract — no newsletter and no commercial prospecting is ever sent.

Your data is never sold, rented or handed over. Only three providers have access to it, each for a specific task: OVH, for delivering outgoing email; Indy, for bookkeeping and for invoicing sales made on a quote; Stripe, for card payment of the subscription and the matching invoice. None of the three has access to student data.

Stripe is only involved if you pay by card; a sale made on a quote does not go through it. It then receives the name and email address of your teacher account, followed by the billing address and, if you provide one, the VAT number you enter on its payment page. Your card details are entered directly with Stripe: they never pass through our servers and we have no access to them. For its own legal obligations, notably fraud and money-laundering prevention, Stripe acts as an independent controller, and its own privacy policy then applies.

OVH and Indy are established in the European Union, and the data they process does not leave it. Stripe contracts from Ireland (Stripe Payments Europe, Limited), but part of the payment data is processed in the United States by Stripe, Inc.: this transfer relies on the European Commission's adequacy decision on the EU–US Data Privacy Framework, to which Stripe, Inc. has self-certified, and on standard contractual clauses.

No request leaves your browser towards a third party: no analytics, no social network button, no typeface loaded from elsewhere. Everything a page of this site displays is served from our own servers, and an automated check replayed on every change forbids an external resource from coming back without this sentence being corrected. One clarification about card payment: it takes you off this site to a page served by Stripe, and brings you back once the payment is completed or abandoned.

Hosted in France, on our own servers — no transfer outside the European Union.

In practice, the server belongs to the publisher and sits at his registered address, Maison L, 34 rue de Solférino, 51100 Reims, France. No third-party host and no foreign cloud service is involved in storing your data.

The site sets three cookies that are strictly necessary for the service you request. They remain active whatever your choice because they are exempt from consent under article 82 of the French Data Protection Act and the CNIL guidelines.

The consent panel separates two optional categories, disabled by default: “audience measurement” and “third-party and functional”. Neither is currently used: no analytics, advertising tracker or third-party content is embedded in the site. An automated test (LEGAL-006) fails the build if a third-party script is added without reviewing this policy.

Your decision is kept in your browser's local storage under the key ofnir.cookie-consent. The evidence records each category choice, the decision time, its expiry and this policy's version. It expires after six months, or as soon as the version changes; you are then asked again. The permanent “Manage cookies” control lets you change or withdraw your choice at any time.

• virtiot_access_token — session token, not readable by the page's JavaScript (httpOnly) — lifetime: 30 minutes.
• virtiot_refresh_token — session renewal token, also httpOnly — lifetime: 7 days.
• virtiot_lang — remembers the display language you picked — lifetime: 1 year.

You have the right to access your data, to have it rectified or erased, to restrict its processing, to receive it in a portable form, and to object on legitimate grounds to processing based on legitimate interest.

To exercise these rights, write to contact@ofnir.fr; your account data can also be viewed and edited from your teacher area, from which deletion of the account may likewise be requested. You will receive an answer within one month.

Some data cannot be erased on request as long as the law requires it to be kept: this is the case for invoices, kept for 10 years.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

This does not affect your right to a judicial remedy.