Privacy policy

This policy covers two things:

• Hub Exaduo, the application schools make available to their candidates, lecturers, panel members and agents (their portals), and its administration;
• the hub-exaduo.com website, which presents the Hub.

Who is responsible for your data

In the Hub, it is the school. When you submit an application, a lecturer file or an assessment, you do so for a school. The school decides what it asks you for and what it does with it: it is the data controller. Exaduo provides the application and acts on the school’s behalf, as a processor. Each portal shows the school’s name and links to its own privacy notice.

For the hub-exaduo.com website, the data controller is Exaduo, a French SAS whose registered office is at 49 rue Guy Moquet, 92240 Malakoff, France (RCS Nanterre 523 609 378).

Exaduo has appointed a data protection officer (DPO), who can be reached at dpo@exaduo.fr for any question.

The Hub’s rule: your data stays in the school’s HubSpot

What you enter in a portal is written directly into the school’s HubSpot: your contact record, your application (a HubSpot deal), your documents (as private files, served through links valid for one minute) and, for panels, assessments (as notes). The documents you upload pass through the application without being stored.

Exaduo only keeps what is needed to run the service, described below.

What the Hub processes, and why

Signing in without a password

• With a code received by email: your email address. The code (6 digits) is valid for 10 minutes and 5 attempts; it is only kept in irreversibly encrypted form (a hash). If you create your space, your address is kept for 30 minutes at most, while you finish. The email is sent by Microsoft (Azure Communication Services), with data processed in France and without open or click tracking.
• To limit abuse, the number of requests is counted per address and per IP address, as hashes, for 24 hours at most.
• Purpose: recognise you and give you access to your space.
• Legal basis: performance of the service the school provides to you (contract or pre-contractual steps), and our legitimate interest in protecting the service.

Signing in with Google or Microsoft (if the school offers it)

The Hub asks Google or Microsoft to confirm your email address, and nothing else is used.

• Data read: your email address and whether it is verified (with Microsoft, also your organisation’s identifier, to make sure the address is verified). Your name and profile picture are neither read nor stored.
• Use: find your contact record in the school’s HubSpot, or create it if the portal allows open sign-up, then open your session.
• Retention: none. The Hub keeps no Google or Microsoft token and no profile; your address passes through a one-time ticket for 2 minutes at most.
• Sharing: your address is only passed to the school, in its HubSpot. It is not sold, not used for advertising and not shared with third parties. The Hub does not access any other Google or Microsoft service (no mail, files or calendar).

Hub Exaduo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your session

• Data: a session identifier, in a technical cookie.
• Duration: 8 hours at most, ending automatically after 1 hour of inactivity.
• Recognised device: so that a third party cannot deprive you of your code by flooding requests, a device on which you have already signed in is recognised for 90 days.
• Legal basis: necessary for the service; these cookies do not require your consent.

Pending writes to HubSpot

If HubSpot is temporarily unavailable, what you have just saved is queued to be written as soon as possible, instead of being lost.

• Data: the content of the write, encrypted with a key specific to each school.
• Duration: 72 hours at most, then actually deleted.

Payments

Payment takes place on the page of the school’s provider (Stripe or Paybox), with the school’s own account. Your bank details never pass through the Hub. The provider receives what it needs to process the payment (your email address and, depending on the provider, your name and billing address); it acts for the school.

• What the Hub keeps: the payment reference, amount, status and dates, and any promo code, to check the payment outcome and report it in HubSpot.
• Duration: 13 months after the payment is concluded.

Where your visit came from (application portal)

If you arrive on the application portal through a campaign link, the Hub records where the visit came from (utm_*, gclid, fbclid parameters, landing page, referring site). This information stays in your browser tab (no cookie), then is written on your application in the school’s HubSpot, so that the school knows which campaigns bring in candidates. Exaduo keeps none of it.

The school’s HubSpot tracking and chat (if the school turns them on)

The school can turn on its HubSpot tracking code and chat on its portals. Nothing is loaded without your consent, given in the portal’s banner (or in the school’s). If you are signed in, HubSpot may recognise you by your email address. Your choice is kept for 6 months in your browser; HubSpot cookies are deleted when you sign out or withdraw your consent.

Administration accounts and the audit log

The school and Exaduo staff who administer the Hub have an account (email address, first name, last name, job title). Their actions and sign-ins are recorded in an audit log (date, author, action, object), without IP address. A refused sign-in attempt is only kept in pseudonymised form. Candidates’ and lecturers’ actions are not in it.

• Purpose: security and traceability of operations.
• Duration: the account is deleted once the person no longer administers any school; the log is kept for 24 months by default (from 12 to 36 months, as the school chooses).
• Access tokens and connected tools: an administrator can create access tokens (valid for 1, 7 or 30 days, deleted 30 days after expiry) or authorise an AI assistant to configure their schools (30-day authorisation, renewed with use). They are only stored as hashes. None gives access to the content of a file.
• Support: a request written to support from the administration creates a ticket at Exaduo; the Hub only keeps its reference.

Technical logs

Like any online service, the infrastructure (Microsoft Azure) logs incoming requests, including the IP address, for security and troubleshooting. These logs are kept for 90 days. Backups of the technical database are kept for 35 days.

Where your data is

• The Hub runs on Microsoft Azure, France Central region: database, cache, key vault and email sending are in France. Edge protection (Azure Front Door) is a global Microsoft network.
• Business data (contacts, applications, documents, assessments) is in the school’s HubSpot, under the school’s contract with HubSpot.
• Payments are processed by the school’s provider (Stripe or Paybox), on the school’s account.
• Backups of the technical database have a copy in the Azure France South region.

No data is sold or transferred. The Hub makes no automated decision about you: the school decides.

Security

• Password-free sign-in; codes and identifiers only kept as hashes.
• Encrypted connections (TLS 1.2 at least); database and key vault with no public access.
• Each school’s HubSpot keys and access stored in a key vault (Azure Key Vault).

The hub-exaduo.com website

Booking a demo

• Data: first name, last name, work email address, school, job title, phone (optional), message.
• Purpose: get back to you to arrange the demo and answer your request.
• Legal basis: pre-contractual steps taken at your request.
• Where: in Exaduo’s HubSpot (HubSpot, Inc., processor).
• Duration: three years after our last exchange.

Analytics

• Without your consent, nothing is set. If you accept, HubSpot sets its analytics cookies (hubspotutk, __hstc, __hssc, __hssrc) to measure traffic and link your visits to any demo request.
• Legal basis: your consent, which you can withdraw at any time.
• Duration: 13 months at most for the cookies; your choice is kept for 6 months in your browser, without a cookie, then you are asked again.

You can change your mind at any time with the “Manage cookies” link at the bottom of each page.

Your rights

You can ask for access to your data, its correction, its erasure, restriction of its processing or its portability, and object to its processing. You can withdraw your consent at any time, without affecting what was done before.

• For your data in a Hub portal (application, file, documents…), contact the school: it holds that data, in its HubSpot. If you write to us, we forward your request to the school.
• For the hub-exaduo.com website, or for any question about the Hub, write to our data protection officer at dpo@exaduo.fr. We reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

Last updated: on publication.