In accordance with Law No. 78-17 of January 6, 1978, on information technology, files, and civil liberties, as amended by Law No. 2018-493 of June 20, 2018, on the protection of personal data, and Regulation (EU) 2016/679 of April 27, 2016 (GDPR), it is reminded that the personal data requested from the Beneficiary are necessary for the establishment and execution of their registration and the subscribed services.

The personal data collected from the Beneficiary are subject to computerized processing carried out by the University of Lille, acting as the data controller.

These data are recorded in its internal files and are essential for processing the registration, managing the administrative and financial aspects of the mi+ Program, verifying eligibility, organizing and coordinating the services, as well as complying with legal and regulatory obligations applicable to the University.

The legal basis for processing is the performance of the Contract concluded with the Beneficiary, in accordance with Article 6.1(b) of the GDPR, as well as compliance with the legal obligations incumbent on the University pursuant to Article 6.1(c) of the same regulation.

Depending on the subscribed packages, the data processed may include identification data, contact details, information relating to academic or professional status, family situation, information necessary for organizing the installation, and, where applicable, data strictly necessary for connecting with partners regarding health insurance, rental guarantees, or banking services.

When certain data are considered sensitive under the GDPR, their processing is strictly limited to what is necessary to provide the requested services.

This information and personal data are kept for the duration of the contractual relationship and then archived for a maximum of three (3) years from the end of the services, unless legal obligations require a different retention period.

When using the Platform, certain technical connection and browsing data may be recorded by the University’s IT systems, including IP address, connection date and time, pages visited, or actions performed on the Platform.

These data are collected for security purposes, proper functioning of the services, prevention of fraudulent use, and, where applicable, to comply with legal obligations.

Connection data are retained for a maximum period of one (1) year from the date of recording, unless a legal obligation requires a different retention period.

The data controller is :

l’Université de Lille,
42 rue Paul Duez,
59000 Lille.

Access to personal data is strictly limited to authorized University staff, according to their roles.

The collected information may be shared, only to the extent strictly necessary for the execution of subscribed services, with partners and service providers contractually bound to the University, particularly regarding transportation, health insurance, housing, rental guarantees, or banking services.

These entities may act as either processors or separate data controllers and are required to comply with applicable data protection regulations.

Outside the cases mentioned above, the University undertakes not to sell, rent, transfer, or grant third-party access to the data without the prior consent of the Beneficiary, except where required for a legitimate reason or legal obligation.

If data are to be transferred outside the European Union, the University commits to implementing appropriate safeguards to ensure an adequate level of protection.

In accordance with applicable regulations, the Beneficiary has the right to access, rectify, erase, restrict processing, and, where applicable, to data portability, which can be exercised by contacting the University’s Data Protection Officer in writing and providing proof of identity at :

42, rue Paul Duez,
59000
Lille, France

Or by email at : dpo@univ-lille.fr .

In case of a complaint, the Beneficiary may contact the University’s Data Protection Officer or the Commission Nationale de l’Informatique et des Libertés (CNIL).