Privacy policy

Last updated: 25/06/2026

This English version is provided for convenience. In the event of any discrepancy, the French version prevails.

Kapsul Corp attaches great importance to protecting your personal data. This policy explains what data is collected on the "EPR2 Gravelines" website (hereinafter "the Site"), why, how long it is kept, and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

The data controller is:
Kapsul Corp — a simplified joint-stock company (SAS), 34 avenue Kléber, 75016 Paris.
Contact for any question about your data: contact@epr2-gravelines.fr.

2. Data we collect

When you create an account and book sessions, we collect:

• Identity data: surname, first name, role, phone number;
• Login credentials: email address and password (the latter is stored in encrypted form and is never readable in clear text);
• Company data: company name, SIREN, address, as well as the HSE (health-safety-environment) and billing contact details you provide;
• Booking data: booked sessions, list of participants (surname, first name), attendance and payment tracking, any message left when booking;
• Technical data: connection logs strictly necessary for the security of the Site.

3. Purposes and legal bases

Your data is used for the following purposes:

• Manage your account and authenticate you — legal basis: performance of pre-contractual measures and of the service you request;
• Process and track your bookings (places, participants, attendance, payment) — legal basis: performance of the contract / service;
• Contact you regarding a booking or a session — legal basis: legitimate interest in ensuring the proper running of the service;
• Comply with our legal and accounting obligations (for example, retention of invoicing records) — legal basis: legal obligation;
• Ensure the security of the Site and prevent abuse — legal basis: legitimate interest.

4. Recipients of the data

Your data is accessible only to authorised staff of Kapsul Corp who need it for the purposes above. It is neither sold, rented, nor transferred to third parties for commercial purposes.

5. Processors and hosting

The Site and the database are hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France), in data centres located within the European Union. OVH acts as a processor and provides safeguards compliant with the GDPR. The Site's emails (booking confirmation, password reset) are delivered via OVH's email service. No payment provider is used, as access to the sessions is free.

6. Transfers outside the European Union

Your data is hosted within the European Union. No transfer outside the EU is carried out.

7. Retention periods

• Account data: kept for the entire lifetime of the account; the retention period after account closure or inactivity remains to be defined [to be completed];
• Booking and attendance data: kept for tracking purposes; exact period to be defined [to be completed];
• Accounting and invoicing records: kept for the applicable legal period (generally 10 years);
• Technical security logs: kept for a period to be defined [to be completed].

The exact periods must be confirmed according to your actual obligations.

8. Security

Kapsul implements technical and organisational measures to protect your data: passwords stored in encrypted form, back-office access restricted to administrators, secure connections, and limitation of login attempts. These measures will be supplemented and confirmed after the security audit carried out by a professional.

9. Your rights

In accordance with the GDPR, you have the following rights: right of access, rectification, erasure, restriction, objection, and data portability. You can exercise these rights by writing to: contact@epr2-gravelines.fr. Proof of identity may be requested.

If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL): 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

10. Cookies

The Site uses only a cookie strictly necessary for your login and security (session cookie). In accordance with CNIL recommendations, this type of cookie does not require your prior consent. The Site uses no audience-measurement, advertising or tracking cookies. Should such tools be added in the future, your consent would be requested beforehand.

11. Changes to this policy

This policy may be updated to reflect legal or technical developments. The date of the last update appears at the top of the page.

12. Contact

For any question regarding your personal data: contact@epr2-gravelines.fr.

← Back to home