Last edit: 07/06/2022

Privacy Statement
Codam Coding CollegeIntroduction
Your privacy is important to us. We aim for a careful treatment of personal data of everyone who is orattempts to enrol to Codam Coding College. This privacy statement describes why and how wecollect and use personal data and provides information about individuals’ rights. It applies topersonal data provided to us, both by individuals themselves and by other means.
Stichting Codam (located Kattenburgerstraat 7, building 039, 1018JA Amsterdam) offers
programming education to people from 18 years old. Officially licenced to 42 (located 96 Boulevard
Bessières, 75017 Paris), we are part of a worldwide network of coding schools. Within the network, allschools use the same curriculum, intranet and tools.
This statement applies to all activities (including the activities via the website) of Codam. Codam is
an official partner of 42, part of the 42 Network, and has set a Partnership contract to arrange theprocessing of personal data controlled by 42 and processed by Codam.
This Privacy Statement is in line with the 42 Privacy Statement, and last amended on December 7th,
2020. We may amend this Privacy Statement from time to time.

CHAPTER 1: Personal data we collect
Codam collects personal data from you, through our application website and during the curriculum.
You provide some of this data directly, and we get some of it by collecting data about your progressin the curriculum and your interactions within the school.
The personal data collected from you are used for educational purposes. Our educational model
requires some personal data to participate. We rely on a variety of legal reasons and permissions(“legal bases”) to process data, including the necessity to enter into and perform contracts,
legitimate interest and with your consent. We only collect personal data which are adequate,
relevant and not excessive in relation to the purposes for which they are collected.
We have listed an overview of the personal data we collect and the procedures in which we handle
this data in the index.

1.1 Contract
We collect most of your personal data for the purposes of performing the educational model andfulfilling certain contractual obligations. If you do not provide the personal data listed below, you
may not be allowed to attend the programme.
The data we collect depends on the context of your interactions with Codam. We distinguish thefollowing phases in which the data we collect can include but not limited to the following:
1. Use of our website● Type of browser or device;● details of web pages you have visited;● links you clicked;● your IP address.
You can find a more detailed description in our Cookie Statement.
2.
●
●
●

Registered at the application website
Name and address;
Telephone number, email address;
Date of birth, sex.

3.
●
●
●
●
●
●
●
●

Participating in the Selection Piscine (in addition to above)
Country of birth;
Emergency contact (name and telephone number);
Profile picture;
Time in school (check-in/check-out);
Study progress and other study-related data;
Terminal commands in unmodified Zsh shells;Video surveillance within the building;Any personal experiences in the event of the student consulting the educational staff.

4.
●●Participating in the curriculum (in addition to above)
Study progress and other study-related data;
Internship contract (company name, salary, evaluations).

1.2 Legitimate interest
Besides the necessity to enter into and perform contracts, we collect and use data based on
legitimate interest, such as to carry our general statistics and safeguard the quality of education. To
limit privacy impact on the individual, personal data is anonymised before it is used for data analysis.

1.3 Consent
If none of the above bases for processing apply, then we will request your consent to process certain
personal data. An example of a situation for which we could ask for your consent is taking
photos/videos. You are free to withdraw your consent at any time.
We also ask you for consent to join the alumni network, in which we save your name, telephone
number, email address and graduation level.
And any participation in the Codam Assistance Program is based on consent to process yourpersonal data to review your application for financial assistance.
Please have a look at the overview in annex 1 for the extensive overview.

CHAPTER 2: Purpose of collecting personal data
We collect personal data for the purposes of our service provision, within the framework ofeducation, and in order to execute our peer-to-peer education model.

Personal data is processed by the following purposes:
●
●
●
●
●
●
●Registration for the purposes of education;
Administrative purposes, to enable access to the curriculum;
To manage curriculum details and online services to facilitate study supervision;
Information purposes;
Information on your study account, your study status and other (necessary) informationfrom Codam;
Conducting general statistics;
Ensure a safe and healthy student environment.

CHAPTER 3: Automatic decision making
We use automated decision making - a decision made about a person, through algorithms applied
to their personal data, without any human being involved in the process - to validate the test resultson our application website and when you continue in the Selection Piscine.

3.1 Online application test
We use an algorithm to validate the levels of logic and memory of the candidates to allow them togo further in the application process. Candidates who failed these tests can not continue theapplication process.
The game's algorithm of the Codam application form evaluates the levels released on the different
games to determine if a candidate has demonstrated enough skills to continue the following
selection steps. It is based only on test results and only assesses the levels achieved.

3.2 Selection Piscine
We use a second algorithm at the end of the Selection Piscine to help determine which candidates
are eligible for admission within Codam. However, the result of the algorithm is always discussed in
the team and is never used one-sided in the decision making.
The selection algorithm at the end of the Selection Piscine is based on several criteria such as theskills, motivation, collaboration and commitment that the candidate has shown during the 4 weeks.
It assesses the match between the candidate and our educational model. Whether a candidate isadmitted to the curriculum is decided by both the selection algorithm and jury review.
The algorithm is designed and implemented by the Head of Studies in close collaboration with theDirector, and is reviewed for improvements and updates every year.

CHAPTER 4: Where we store and process personal data
4.2 Codam
Personal data regarding the application and education process is stored on the servers located at
Codam, Kattenburgerstraat 7, 1018JA Amsterdam.

4.3 42 Paris
Personal data collected as part of the selection and educational process are stored in the data centreof 42 in Paris. As Partners in this matter, Codam and 42 have a shared responsibility in processing
your personal data/As Codam is part of a network with schools in different countries worldwide, the personal data on
the intranet may be accessible to countries outside the European Union. A for list of partner schools
is presented on our website, it includes but is not limited to the United States, Russia, Morocco andSouth Africa. By agreement with 42, all schools made the commitment to comply with thelegislation of the European Union.

42 guarantees that transfer is only made to countries that provide a level of protection equivalent tothat guaranteed within the European Union or are governed by binding tools to meet therequirements of the applicable regulations. For more information, we refer to 42’s Privacy Statement
here.

4.1 Google Cloud

Codam is using G Suite services for email and file storage, and signed the Service Level Agreementwith Google as part of the paid Business plan. The data are stored on Google Cloud.
Here is more information about how Google Cloud is compliant with the GDPR regulations.

4.4 Other third parties
We may disclose your personal data to other providers not listed. All third parties shall process yourpersonal data in conformance with a data processing agreement that we will enter into with them.
This includes

CHAPTER 5: How to access and control your personal data
5.1. Retention period
We undertake to keep your personal data only for the time necessary to fulfil the purposes
concerned, this varies depending on the type of data and the treatment concerned. Below you willfind how long we keep the data.
At the end of this period, and unless you specify otherwise, we will proceed to the deletion of yourpersonal data or their anonymization for statistical purposes.

5.2. Right to access and control your personal data
Students can access and control their personal data on Codam’s Intranet. We have arranged that it ispossible to exercise your rights, such as your right to access, update, correct, erase, restrict, object or
port personal data, directly on your Intranet profile page.
People subscribed to Codam but who are not yet a student, may request that their data is erased bysending their request to legal@codam.nl.
As part of processing your request, we may ask you for proof of identity to verify accuracy. In any
case, we are committed to providing you with an answer within one month, possibly extendable
once given the complexity and the number of requests.
You may request that your data be erased, although this is only possible insofar as this allows Codam
to continue to fulfil its core business (education). If it is not possible to erase your data, we will
pseudonymised or anonymise your personal data to the fullest extent possible.
For all students requested anonymisation, a summary of the data, including identification of thestudent, level of studies, project marks, as well as partnerships, accreditations, and internships, isstored on a separate and isolated server at 42 Paris. This historical data can only be accessed by 42
Paris upon request by Codam.

5.4. Recordings surveillance videos
Codam uses video surveillance at site to ensure the safety of our students and visitors, and protect
Codam’s high value property. The camera’s are focussed on the entrance and exit doors.
The live stream is accessible 24/7 by the security guard that is on duty. During nights images aremonitored offsite by a service provider with which a data processing agreement is signed.
Recordings are secured and only accessible by the Codam IT Manager and Facilities Manager.
Retention period of the tapes is 28 days.

5.5. Terminal commands
Codam collects the terminal command entered in unmodified Zsh shells. The log is secured and onlyaccessible by the Codam IT Manager. It is only accessed in case of a (suspected) security incident.
Retention period of the data is 28 days.

CHAPTER 6: Keep your personal data safe
We have taken measures to keep your personal data safe. We have taken appropriate technical andorganisational measures to prevent loss or unlawful processing of personal data. For example, staff
authorised to view it on the grounds of their role can only view your personal data and a strict policy
regarding the creation and renewal of passwords allowing access to personal data.
We have appointed the following recipients of your personal data:
Codam team: study progress and other study-related data;
Head of Studies: personal notes impacting your studies;
Deputy General Manager: all administrative data;
IT Manager and Facilities Manager: recordings of video surveillance.
Your personal data will not be rented, sold or otherwise shared with or provided to third parties.

CHAPTER 7: Cookies
We store general visitor statistics on our website to analyze our online performance and improve thefunctionalities. Please find the cookie statement here.

CHAPTER 8: Dutch Data Protection Authority
You also have the right to object to the processing of your personal details. More information
regarding your rights can be found on the Dutch Data Protection Authority's website.
You can file a complaint with the Dutch Data Protection Authority about the way Codam processes
your personal data.

CHAPTER 9: Questions
Do you have any specific questions or comments about our Privacy Statement based on thisinformation? If so, do not hesitate to get in touch with us (legal@codam.nl)

ANNEX 1: Overview data collection
PurposeData involved

Legal basis

Retention period

RecipientStudent
registration

Candidate and student
registration, test results
application website, general
statistics

Identity data,contact details,
emergency
contact, testresults

Execution ofthe contract,
legitimateinterest(statistics)3 years from the last
login to theapplication site or
instantly deleted incase of test failure

Communication
Manager, IT Manager,
Head of Studies,
Director

Student
management

Study progress and results,
administrative
management, evaluations,informing the community
by email

Identity data,contact details,
study data (log,results)

Execution of
the contract

3 year from the last
login to the Intranet

Deputy General
Manager, IT Manager,
Head of Studies

Assistance
ProgramAssess necessity for
financial assistance during
studies at Codam

Previous
degrees,socio-economic
information,
financialstatements

Consent

1 year from theapplication

Deputy General
ManagerInternships

Contact about curriculum
follow up, administrative
management, evaluations,emailsIdentity dataand contact
information

Execution ofthe contract

3 year from the last
login to the Intranet

Deputy General
Manager, IT Manager,
Head of Studies.
Partnership Manager

EventsOrganizing andcommunication about
events at Codam

Identity data,contact
information,
event data

Execution of
the contract

1 year from theevent

Communication
Manager, Partnerships
Manager, Head ofStudies

Photo andvideo

Photos and videos forpromotional means andcommunication on internaland external channels

Photos andvideos ofstudents andstudy
environment

Consent

Consent is valid for
5 years and needs tobe renewed

Communication
Manager, Deputy
General Manager

Connection
Management

Assigning and managing
access rights, managing
registrations on the website
and managing connections
via Intranet

IP addresses,
connection logs

Execution of
the contract,
legitimateinterest(statistics)

1 yearIT Manager

Jobs page

Managing job offers on
Intranet

Identity data,contact details,
CV

Execution of
the contract

3 year from the last
login to the Intranet

Head of Studies,
Partnerships Manager

Alumni

Surveys and statistics on
graduates, building andmaintaining alumninetwork

Study results,
sex, birthdate

Consent

Withdrawal ofconsent

Partnerships Manager,
Communication
Manager, Deputy
General Manager

Teaching tools

Providing and managing
teaching tools

Identity data,contact
information,account
identification,
projects andresults

Execution of
the contract

3 year from the last
login to the Intranet

Head of Studies

Executing legal
rightsProcessing requests
regarding personal data

Identity data,contact
information,Legalobligation

4 months until after
the case is closed

Deputy General
Manageraccountidentification,
personal datathat isrequested
Communication analysis

Analysis of site attendees,admissions, and optimizing
websiteIP address,browser used,devices used,navigation data

Consent

13 months

Communication
Manager, IT Manager

Websitesecurity

Secure website andcompliance with legal
obligations

IP addresses,
connection logs

Execution of
the contract,
legitimate
interest, legal

1 yearIT Manager

Videosurveillance

Ensure security of people
and goods at Codam

Images CCTV

Legitimate
interest

28 Days

IT Manager

Terminal
command

Ensure permissible use of
the computers and network

Terminal
commandentered inunmodified Zshshells

Legitimate
interest

28 Days

IT Manager

Access control

Assure security of students
present at Codam

E-mail,company,
name, badge
numberLegitimate
interest

1 year from the lastvisit

Facility Manager,
Security, IT Manager