At 42, the confidentiality of your information is one of our major concerns!
That's why we would like to explain to you, transparently and simply, how we collect, use and share your information, and also how you can exercise your rights at any time.
Our Privacy Policy applies to the information we collect when you browse or connect to the tools developed by 42, including but not limited to the Admissions site of your Campus (e.g. the Admissions site of 42 Paris) and the Intranet.
Our Privacy Policy does not apply to third-party applications or software such as :
Stackoverflow: for more information, please consult their privacy policy.
Slack: to find out more, please consult their privacy policy.
We invite you to take a few minutes to read this document in its entirety so that you have a clear view of the processings of your personal data carried out :
If you would simply like to have an overview of the various personal data processing operations carried out by the Association 42 and/or your Campus and their main characteristics, we have provided a table below listing the personal data processing operations carried out.
Your Campus may carry out additional data processings, specific to it, in addition to the processings defined in this Policy. To learn more about how your Campus processes your personal data, please consult its privacy policy available on its website. To access your Campus's website, click on this link.
If you have any questions or comments about our Privacy Policy, please send an e-mail to [email protected] or contact your Campus.
- Data processings carried out when Association 42 and your Campus act as joint data controllers:
| Category | Purpose | Retention periods |
|---|---|---|
| Compliance | Managing data subject rights | Access and portability request: until student account is deleted / Request for deletion: no retention / Request made outside the Intranet: request kept for 1 year |
| IT/technical network management | Managing connection log for monitoring and analysis of technical events | 1 year |
| IT/technical network management | Managing email alias server | 3 years from last activity on Intranet unless prior request for account deletion |
| IT/technical network management | Managing authentication to 42 platforms | 3 years from last activity on Intranet unless prior request for account deletion |
| IT/technical network management | LDAP - Creation & provision of a student directory for the Campus | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing applications and registrations for entry to the 42 curriculum | If the candidate fails the entry tests, data will be deleted after 2 weeks. If the candidate logs on to the platform without completing the tests, data will be deleted if inactive on the platform for 3 years |
| Management of pedagogical path | Managing students' pedagogical path | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing students/candidates projects | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing students/candidates exams | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing students/candidates sanctions | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing students/candidates location in a cluster | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Reserving seats in a cluster | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Tracking student attendance times on Campus to meet the demands of social partners and ensure that students are kept on track as they progress through their path | 5 years from the date of entry of each cohort |
| Management of pedagogical path | Managing external tools available to students and alumni | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Managing student votes | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Tracking of the students from cohorts of the campus regarding their pedagogical path for management purposes | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of internships and professional trainings | Creation and publication of students curriculum | 3 years from the date of the student's last activity on the Intranet or if the student objects to the publication of his or her CV online |
| Management of internships and professional trainings | Managing internship and job offers published by companies | Retention period until offer expires, plus one month |
| Alumni management | Alumni community management | Retention of data until deletion of the account on the Alumnforce platform at the alumni's request |
| Alumni management | Alumni surveys (employability) for statistical and service improvement purposes (alumni community) | Up to request for removal of the alumni from the intranet |
| Data analysis | Production of specific pedagogical statistics | 3 years from last activity on Intranet unless prior request for account deletion |
| Data analysis | Real-time statistical reports (dashboard) | 3 years from last activity on Intranet unless prior request for account deletion |
| Data analysis | Students/candidates surveys to continuously improve training 42 | 3 years from last activity on Intranet unless prior request for account deletion |
- Data processing carried out by Association 42 as an independent data controller:
| Category | Purpose | Retention periods |
|---|---|---|
| Compliance | Managing data subject rights | Access and portability request: request kept until student account is deleted / Request for deletion: no retention / Request made outside the Intranet: request kept for 1 year |
| IT/technical network management | Managing the helpdesk | 3 years from last activity on Intranet unless prior request for account deletion |
| IT/technical network management | Managing the data backup | 1 year |
| IT/technical network management | Managing the API | 3 years from last activity on Intranet unless prior request for account deletion |
| Management of pedagogical path | Monitoring the number of active students on Campus | 10 years |
| Management of pedagogical path | Managing RNCP titles | Refusal of the RNCP title: 3 years from the date of refusal / If the decision is contested: the candidate's file is kept for the duration of the procedure / Validation of the RNCP title: retention identical to the duration of the School Record |
| Management of pedagogical path | Generation of School Records | Archived for 50 years after the student's departure from 42 |
| Continuous improvement of 42 products & services | Carrying out qualitative/quantitative researches | Tester details: 1 year from registration / Researches carried out: 6 months after the test, then anonymised |
| Forty 2 | Managing the stays at the Fort des Saumonards | Booking details: for the duration of the stay / Payment details: 10 years for accounting purposes |
| Event management and communication | Organization of events or competitions across the 42 network | 3 years from the date of the last activity on the Intranet, unless the right to object is exercised |
| Event management and communication | Managing communications with candidates and students within 42 network level | 3 years from the date of the last activity on the Intranet, unless the right to object is exercised |
| Event management and communication | Use of students' images in communications related to the 42 network | Duration of image rights authorisation increased by five years |
| Event management and communication | Community management of the 42 network's social networks | Data is retained as long as the relevant social media account remains active unless a request for deletion is made. |
| Event management and communication | Whistleblowing and reporting systems for behavior within the 42 network | Data enabling the identification of the author of an alert and of the persons concerned by it shall be deleted within a maximum period of 2 months from the closure of the verification operations if no action has been taken on the alert. / When disciplinary proceedings or legal proceedings are initiated against the person implicated or the author of an abusive alert, the data relating to the alert is kept until the end of the proceedings. |
Table of contents
The data controller is the entity that determines the purposes (the “why?”) and means (the “how?”) of processing your personal data.
In the context of your curriculum, your Campus and the Association 42, a not-for-profit association governed by the law of July 1, 1901 and the decree of August 16, 1901, headquartered at 96 boulevard Bessières - 75017 Paris FRANCE, are considered to be jointly responsible for certain processing activities concerning your personal data insofar as they determine together the purposes and means of these operations in the common interest of your success in your educational path at 42 and for the continuous improvement of the curriculum within the 42 network.
This is particularly the case for the management of your application and registration for a Campus 42 and for the management of your educational program via the Intranet.
The Association 42 may need to process some of your personal data autonomously, in particular as part of the management of the 42 network.
This may involve, for example, managing the 42 computer network, or carrying out qualitative/quantitative studies to improve the tools developed by 42.
Finally, the Campus on which you are studying may also be required to process your personal data autonomously. To learn more about how your Campus processes your personal data, please consult its privacy policy available on its website. To access your Campus's website, click on this link.
This is notably the case for data processing linked to the management of access to premises (access control, badge management, video surveillance), or data processing linked to the management of communications concerning Campus events.
The Association 42 has appointed a Data Protection Officer (or DPO) in charge of all issues relating to the protection of personal data within the Association 42. You can contact the Association 42 and its DPO:
To find out the name of the DPO or the person in charge of personal data on your Campus, please contact your Campus directly whose contact details can be found on the Campus website.
In accordance with applicable legislation, we only collect personal data that is adequate, relevant and not excessive in relation to the purposes for which it is collected.
The nature of the personal data collected thus varies according to your profile and the services you request. In any event, we will inform you when we collect personal data about you, indicating at the very least the identity of the data controller, the purpose(s) for which it is collected and your rights with regard to your personal data.
For example, when you register for 42 on the “Admissions” site of your home campus, we may collect the following personal data:
In addition to the personal data you communicate directly to us, we may also collect personal data about you without any direct communication on your part.
This is particularly the case when you browse our Admissions websites, the Intranet, voxotron.42.fr, etc., where your IP address is automatically collected to ensure the security of our services and website infrastructure.
In order to improve the performance of our sites, we host a Sentry server responsible for collecting bug reports from our Internet sites, in particular the Intranet. This tool may collect the following personal data in the event of a bug:
In addition, on our Admissions and Intranet websites, we use the GOOGLE ANALYTICS tool published by GOOGLE LLC, which passively collects the following information about the user:
The data collected by these tools is only triggered once you have accepted the cookies. You can find out more about the cookies we use in article 6 of this document.
All personal data that we process is collected for specific, explicit and legitimate purposes and will not be further processed in a way that is incompatible with these purposes.
The purposes of processing are the objectives pursued by the data controller when collecting personal data.
These purposes vary according to the processing concerned.
When we process your projects or exam results, the purpose of this processing is to monitor your pedagogical progress.
You can find all the purposes of processing carried out by Association 42 and/or your Campus in the tables at the beginning of this Policy.
Furthermore, at the end of the data retention period (see article 8), we may use your personal data in an anonymized form for statistical purposes.
We will never process your personal data for purposes other than these without first informing you and, where appropriate, seeking your consent.
Legislation requires that any processing of personal data must have a legal basis. It is the existence of a legal basis that determines the lawfulness of personal data processing.
There are various legal grounds for processing personal data, such as the consent of the individual concerned, the necessity of processing for the performance of a contract, or compliance with a legal obligation.
At 42, the processing of your personal data is based alternatively on the following grounds:
The legal basis for processing your personal data varies according to the type of processing concerned.
For example, the management of video surveillance on premises might be based on the Campus legitimate interest in preventing attacks on people and property.
As a general rule, we don’t oblige you to provide us with your personal data.
However, we do require you to provide certain personal data in order to provide the services we offer. This data is identified by an asterisk “ * ”.
If you do not wish to provide us with this essential data, we will not be able to guarantee you access to the service(s) concerned.
We use cookies to measure the audience of our websites.
A cookie is a small text file placed on the user's hard disk by the server of the site visited or by a third-party server.
We will never use audience measurement cookies without your consent. You can activate or deactivate these cookies by clicking on the “Cookie policy” tab on the sites concerned.
If you would like more information on this subject, please consult the dedicated page.
Automated decision-making can be defined as a decision made about an individual, by means of algorithms applied to their personal data, without any human being intervening in the process.
When you apply to 42 on the Admissions platform of your campus, some of your personal data is used automatically, via an algorithm, to validate the various tests carried out.
For example, we use an initial algorithm to validate applicants' logic and memory levels to enable them to go further in the application process. This algorithm evaluates the levels unlocked on the different games to determine whether a candidate has demonstrated sufficient skills to continue to the next selection stages. It is based solely on the results of the tests and only assesses the levels achieved.
Candidates who fail these tests cannot continue with the application process.
We also use a second algorithm at the end of the ‘piscine’ test to determine which candidates are eligible for admission to 42. However, this assessment does not imply automatic admission. The results of this algorithm are subject to a final review by the pedagogical team, which takes into account additional criteria such as motivation and commitment, in order to make a final decision.
It is also important to note that the criteria and thresholds used by the algorithm may vary from one pool to another on the same campus.
We undertake to keep your personal data only for as long as is necessary for the purposes of the processing concerned.
This retention period will necessarily vary depending on the type of data and the processing concerned.
Certain legal provisions also require us to keep your data for a minimum period.
To find out how long we keep the data concerned for each processing operation, please consult the tables at the beginning of this Policy.
At the end of this period, and unless you advise us otherwise, we will delete your personal data or anonymize it for statistical purposes.
We take the security of your personal data very seriously. This is why we have adopted internal measures to guarantee the integrity and confidentiality of your data as far as possible. The measures we have adopted include the following:
Concerning human resources at Association 42:
Concerning physical security at Association 42:
Concerning the 42 pedagogical platforms:
To find out more about the security measures in place in your Campus, please contact the relevant department in charge.
Your personal data is mainly stored in databases located within the European Union.
However, due to the organization of Association 42 and its network of international campuses, some personal data may be transferred to countries outside the European Union.
This is the case for personal data collected from the 42 Intranet, which can be accessed from all Association 42 campuses, i.e. :
This list is subject to change as new campuses are opened within the 42 network. For a complete and updated list of campuses, click here.
In these cases, we guarantee that these transfers are made to countries providing a level of protection equivalent to that guaranteed within the European Union, or are governed by binding rules, such as the signature of the European Commission's Standard Contractual Clauses, in their June 2021 version, thus enabling us to meet the requirements of the applicable regulations.
You may ask the Association 42 at any time how transfers of personal data outside the European Union are managed, by sending your request to: [email protected].
In addition, as we specify below, we strictly control the communication of your personal data to our service providers in order to ensure their integrity and confidentiality.
A recipient is defined as any person entitled to obtain communication of data by virtue of his or her functions.
At 42, your data may be made accessible to the Association 42's pedagogical, IT or administrative departments, depending on the purpose of the processing, but also to the same teams on your Campus.
The personal data we collect may also be shared with third-party companies in the following cases:
In any event, we undertake to:
Our activity requires us to process your personal data in various ways. However, you alone remain in control of your data and how it is used.
This is why you have the following rights with regard to your personal data:
If you wish to exercise your rights, we invite you to send your request directly from the Admissions site or from the Intranet.
You can contact your campus if you have any queries relating to your personal data. Contact details can be found on the Campus website.
Finally, you can also send your request to the following address:
As part of the processing of your request, we may ask you for proof of identity in order to verify its accuracy.
In any event, we undertake to provide you with a response within one month, which may be extended once, depending on the complexity and number of requests.
We remind you that in the event of a dispute concerning the processing of your personal data, you may lodge a complaint with the competent supervisory authority.
In France, this authority is the Commission National Informatique et Libertés (CNIL), whose website address is www.cnil.fr. We invite you to contact your Campus to find out which supervisory authority is responsible for the country in which your Campus is located.
This Privacy Policy can be modified at any time. If a change is made to this Privacy Policy, we undertake to publish the new version on our Admissions and Intranet sites. The date of the last update to this Policy will always be published at the end of this document.
If you do not agree with the terms of the new version, you may request the deletion of your personal data.
Last updated on: August 14th, 2025