Personal data protection
Who processes your data?
The data controller is Evo's School, a French limited liability company (SARL) with share capital of €5,000, registered with the Antibes Trade and Companies Register under SIREN 819 329 426, with its registered office at 11, rue Alphonse 1er — 06200 Nice, France.
For any question about your data: contact@evoschool.fr.
Requests concerning your data are handled by the school's management, at the address given above.
Why do we collect this data?
| Purpose | Legal basis |
|---|---|
| Processing the enrolment request and managing the child's schooling | Performance of the enrolment contract and pre-contractual steps |
| Issuing and tracking invoices, recording payments | Performance of the contract and legal obligation (accounting) |
| Communicating with legal guardians (school life, payment reminders) | Performance of the contract |
| Keeping the child safe: emergency contacts, authorised persons, relevant medical information | Protection of the child's vital interests and the school's legitimate interest |
| Using the child's photograph on our materials (website, social media, teaching materials) | Consent, obtained separately and withdrawable at any time |
| Retaining supporting documents (identity, insurance, vaccinations, proof of address, transfer certificate) | Legal obligation and legitimate interest |
| Retaining evidence relating to electronically signed documents | Legitimate interest (evidential value of the contract) |
What data do we collect?
- Legal guardians: identity, postal address, email, phone numbers, occupation, employer, family situation, parental authority and custody arrangements.
- Child: identity, date and place of birth, nationality, languages, previous schooling and class, photograph.
- Child's health: doctor's contact details, allergies, intolerances, relevant medical history, ongoing treatment or individual care plan (PAI). This falls under Article 9 GDPR and is subject to stricter access controls.
- Contacts: emergency contacts and people authorised to collect the child.
- Billing: amounts, instalments, payments received. The school stores no bank details; payments are made by bank transfer.
- Electronic signature evidence: date and time, IP address, browser, digital fingerprint of the signed document.
Who has access to this data?
- Authorised Evo's School staff, limited to what their role requires. Health information is restricted to those directly involved in caring for the child.
- Technical providers hosting our tools, acting as processors under an Article 28 agreement: database and portal hosting, authentication service, email service.
- Where applicable, our accountant and the public authorities to which we have reporting obligations.
Your data is never sold, nor passed to third parties for commercial or advertising purposes.
Some of our technical providers are established in the United States and may host or process data outside the European Union: Vercel (family portal hosting), Clerk (account authentication) and Airtable (school database). These transfers are governed either by the European Commission's adequacy decision on the EU–US Data Privacy Framework, where the provider is certified under it, or by the Standard Contractual Clauses adopted by the European Commission. You may request a copy of the applicable safeguards by writing to the address given above.
How long do we keep it?
| Data | Retention period |
|---|---|
| Pupil file (identity, schooling, contacts) | Duration of schooling, then 1 year after the child leaves. Beyond that, only surname, first name, school years and classes attended are kept for 10 years, so that a school attendance certificate can be issued. |
| Health information, individual care plan | Duration of schooling, deleted on departure |
| Child's photograph | Duration of schooling, or until consent is withdrawn |
| Identity documents (parents, authorised persons) | Duration of schooling, then deleted |
| Accounting records and invoices | 10 years, as required by the French Commercial Code |
| Signed contracts and signature evidence | Duration of the contract, then 5 years |
| Unsuccessful enrolment requests | 1 year from the last contact |
What are your rights?
For yourself and for your minor child, you have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability. Where processing is based on your consent — as is the case for the photograph — you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.
Some of these rights can be exercised directly from your family portal, where you can view and correct the information in your file.
For any other request: contact@evoschool.fr. We reply within one month.
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr).
Security
Access to the family portal is protected by individual authentication. Each family can only view its own file. Communications with the portal are encrypted, and data access is restricted to authorised staff.
Last updated: 15 August 2026.