This is an English translation provided for convenience. In case of any discrepancy, the French version prevails. Read the French version.

GDPR and data protection

Last updated: 4 July 2026

This page describes how ScolaSign, published by Ad Cognita, applies the General Data Protection Regulation (GDPR) in connection with its digital attendance service. It supplements the privacy policy, which details the processing operations carried out.

Who is responsible for what?

The allocation of roles within the meaning of the GDPR is as follows:

• For the data of learners, trainers and legal guardians recorded in the service: the customer institution (training organisation, apprenticeship training centre (CFA), school) is the controller. It determines the purposes and means of the processing (attendance monitoring, attendance sign-in evidence) and informs the data subjects. Ad Cognita acts as a processor within the meaning of Article 28 of the GDPR: it processes this data only on behalf of and on the instructions of the institution.
• For the data of visitors to the scolasign.fr website (contact form, demonstration request, trial sign-up): Ad Cognita is the controller.

Hosting exclusively in France

All of the service's data (database, signatures, supporting documents, backups) is hosted exclusively in France. No transfer of data to a country outside the European Union takes place in connection with the operation of the attendance service.

This absence of transfers outside the European Union relates to the operation of the attendance service itself. It does not concern the trackers of the scolasign.fr showcase website, one of which (Ahrefs Analytics) is provided by a company established outside the European Union: the details are set out in our cookie policy.

Data processed

• Identity: surname, first name, email address, telephone number (optional), profile photo (optional).
• Attendance and signatures: time-stamped attendance sign-ins, electronic signatures, attendance, late arrivals, absences and early departures.
• Supporting documents: documents submitted to justify an absence or a late arrival.
• Technical data: connection and security logs.

Retention periods

Data is retained for the term of the contract between the institution and ScolaSign, and thereafter for the time necessary to comply with the legal obligations to provide evidence of attendance applicable to training organisations, the length of which varies depending on the funders concerned (OPCO, CPF, Regions, apprenticeship, etc.). At the end of these periods, or at the institution's request as part of reversibility, the data is deleted. Data from the showcase website (contacts, demonstration requests) is retained for a maximum of three years after the last contact.

Sub-processors

Ad Cognita uses a limited number of sub-processors, strictly necessary for the operation of the service, in particular its hosting provider (servers located in France; see the legal notice). Each sub-processor provides appropriate safeguards and is bound by commitments in accordance with Article 28 of the GDPR. The up-to-date list of sub-processors can be provided on request at contact@scolasign.fr.

Security measures

• TLS encryption of all exchanges (HTTPS).
• Regular backups of the data.
• Role-based access control: each user (admin, programme manager, trainer, learner, legal guardian) only accesses the data necessary for their role.
• Segregation of each institution's data (multi-institution architecture with isolation per customer).
• Logging of access and time-stamping of signatures.

Rights of data subjects

Every data subject (learner, trainer, legal guardian) has the rights of access, rectification, erasure, restriction, objection and portability provided for by the GDPR.

• For data managed in connection with a training programme: the request should be addressed first to the training institution, as controller. Ad Cognita assists the institution in handling these requests.
• For data from the scolasign.fr website, or if you are unable to reach your institution: write to contact@scolasign.fr.

You may also lodge a complaint with the CNIL (French data protection authority) (www.cnil.fr).

Our commitments

• No sale or transfer of data: data is never sold, rented or transferred to third parties for commercial purposes.
• No advertising cookies on the website, and no targeted advertising: the website places, with your consent only, audience measurement trackers provided by a third party (details in our cookie policy).
• Data is processed only for the purposes of the service: attendance monitoring, attendance sign-in and the production of evidence designed for your Qualiopi and funder audits.

For full details of the processing operations (purposes, legal bases, recipients), see the privacy policy.