Data Protection Policy

7-SHAPES ensures compliance with European Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR) and with Act No. 78-17 of 6 January 1978 on information technology, files and freedoms (the French Data Protection Act), the provisions of which were rewritten by ordinance No. 2018-1125 of 12 December 2018.

This personal data protection policy (hereinafter the Policy) applies to the data processing carried out by 7-SHAPES via the website https://www.7-shapes.com/ (hereinafter “The Website”). It informs you about the purposes of the processing of your personal data, their legal basis, their recipients as well as their retention period, the security measures (general description), the possible existence of data transfers outside the European Union or of automated decision-making, the use and management of cookies, your data protection rights and the way to exercise them.

7-SHAPES (197 rue de Bordeaux, 16000 Angoulême) is the data controller of your personal data. This means that 7-SHAPES (hereinafter the Data Controller) determines the purposes and the means of the processing of your data. To find out more about 7-SHAPES, you can consult our legal notice.

By personal data we mean any information that identifies you either directly or indirectly, within the meaning of article 4.1 of the GDPR. 7-SHAPES collects personal data through the various contact forms, the address dpo-7shapes@agencergpd.eu, the link Rights Management, the start-of-training questionnaire and cookies. We guarantee the transparency of your data processing by informing you in a clear and precise manner before collecting them. When necessary, we seek and collect your free, informed, and unambiguous consent.

Each piece of data collected about you is adequate, useful, necessary, and limited to the strict minimum. This concerns especially identification data (last name, first name), login data (email address), navigation data via cookies as well as data relating to your professional life (CV, position, etc.). For learners, we also collect information about their training background (position held, professional objective, constraints during the training, level at the start of the training). People who wish to may also indicate that they have a disability so that the training can be adapted: this is health data, and providing it is optional.

Mandatory fields are indicated by an “*”, specifying that the information is mandatory. Mandatory fields are essential for the purpose of the processing.

The personal data collected about you have the following purposes:

• Process and reply to your messages
• Establish and ensure the follow-up of the commercial relationship that may arise from your messages
• Create and manage access to your account
• Manage your registration for training and ensure follow-up
• Adapt training and reception conditions for people with disabilities
• Process your application for a job within our company
• Receive and process your requests relating to your rights under the GDPR and the Data Protection Act
• Measure the audience of the website and its different pages
• Remember your choices regarding the use of cookies

The processing of your personal data is carried out in accordance with Article 6 of the GDPR. It is especially founded:

• On your consent when you accept the cookies and tracers that we use or for all cases where you enter your personal data via the various contact forms. In any case, 7-SHAPES always collects your consent in a clear, free, informed, and transparent manner via a cookie banner or by means of an information statement under our various forms. Your consent can of course be withdrawn at any time
• On measures necessary for the establishment or performance of a contract as part of the management of the commercial relationship, as part of the processing of your job application or for any request that may give rise to a commercial or contractual relationship
• On compliance with a legal obligation, particularly in terms of exercising your rights under the GDPR and the French Data Protection Act
• On the pursuit of a legitimate interest, especially in terms of the management of technical and functional cookies.

Your personal data is intended for 7-SHAPES which is the website editor and the data controller. They are processed by the staff of our various departments such as the IT department, the communication department, the marketing department, the sales department, and the personal data protection department. They are processed only for the purposes indicated above.

Your personal data may be transferred to our technical subcontractors (within the meaning of article 4.8 of the GDPR) in a strictly regulated manner. In the event of a transfer, we make sure that the subcontractors comply with the GDPR and take technical and organizational measures to guarantee data protection (art. 28 of the GDPR).

Information collected in the start-of-training questionnaire, including information about a disability, is accessible to your trainer, who acts as a subcontractor of 7-SHAPES, and to our Disability Officer, in order to adapt the training and set up the necessary arrangements.

Typeform, a subcontractor for our sales contact form, may also have access to the data collected through it. Dendreo, our training management platform, hosts the information collected to identify learners’ training needs.

The personal data collected by this website is for the most part located within the European Union and in countries recognised as adequate. In the event of transfers outside the European Union, safeguards are provided either through the European Commission’s standard contractual clauses or through an adequacy decision also issued by that Commission.

7-SHAPES monitors the GDPR compliance of all recipients of the data.

7-SHAPES is committed to protecting your data in accordance with the GDPR and in accordance with the state of the art. As such, we implement technical and organizational security measures to protect your data and prevent any destruction, loss, alteration, or modification, as well as any unauthorized access or disclosure, of an accidental or illegal nature. For example, all the pages of our website are under the https protocol. We also use SSL certificate to encrypt your data. In addition, access to your data is strictly accessible to persons authorized to process them by virtue of their functions. We also provide secure hosting for your data. These measures, among others, help to ensure the confidentiality, integrity, and availability of your data. Erasure, pseudonymisation and then anonymisation of data are carried out according to the retention periods below, or at the request of the data subject.

Personal data collected about you is kept by 7-SHAPES for the time necessary to process your request, then for the duration of the commercial relationship when your request leads to one.

Account and training follow-up data. It is kept in clear for 5 years from the end of the commercial relationship, as required by training funding bodies. After these 5 years, your last name, first name and email address are replaced by an identifier: your data is then pseudonymised for 3 years. A correspondence table, kept separately with restricted access, allows us during this period to respond to a possible appeal and to demonstrate the deletion of your data. During this period, this data remains personal data and you can still exercise your rights. After these 3 years, the correspondence table is permanently destroyed. The remaining activity data no longer allows you to be identified and is kept in anonymous form for statistical purposes.

Disability information. It is kept for 3 years, then deleted. It is not included in the data kept afterwards for statistical purposes.

Training needs collection (Dendreo). The information collected is kept for 5 years, and 3 years for disability information, then deleted.

Supporting documents for the exercise of your rights. They are kept for the time needed to process your request (1 month maximum, in line with CNIL recommendations).

Navigation data. Navigation data collected with your consent is kept for 13 months, in line with CNIL recommendations.

We use cookies (connection cookies) and other tracers on our website that we may place on your computer, tablet, or smartphone when they are necessary for the operation of the website or when you freely accept them.

The cookies used on our website are functional, technical, and audience measurement cookies. You can accept or decline them via the cookie banner that appears when you browse our website.

The cookies we use have the following purposes:

• Remember information that you have entered or requested via forms that you fill out on our website
• Record your consent and memorize your preferences in relation to the cookies used
• Track the performance of pages viewed by website users
• Analyze how visitors use the website
• Distinguish website users
• Save your preferences and other information as your preferred language
• Carry out statistics and analyzes of frequentation and use, navigation, and audience measurements of the website with a view to its improvement
• Optimize the user experience according to your preferences

For more information on cookies, you can consult our cookie policy or go to the CNIL website

You can object to cookies in several ways. If you do not want our website to place cookies on your computer, you can block them:

• By using a browser which, by default, refuses cookies
• By configuring your browser appropriately or by installing an additional component on your browser, specifically designed for cookie management
• By deleting the cookies used from your browser at any time (to find out how to do this, see the help section of your browser)
• By configuring your browser so that it transmits to the website your wish not to be “tracked”

In all cases we respect your choice.

7-Shapes uses AI on your data:

• As part of its software development activities, 7-Shapes uses generative artificial intelligence tools to assist its developers in writing, reviewing and correcting code. These tools may, occasionally and non-systematically, have access to code excerpts or databases that may contain personal data (for example technical identifiers).
• As part of training, AI helps identify learners who need a follow-up and anticipate dropouts. No automated decision is taken against learners.

These processings are based on the legitimate interest of 7-Shapes (Article 6.1.f of the GDPR) in securing and optimising its software development, and optimising training follow-up and learner attendance in compliance with Qualiopi requirements.

The data thus processed is transmitted to the publishers of the tools used and to the providers of the AI agents concerned, which may involve storing your data outside the European Union (covered by secure contracts).

In accordance with the GDPR, which came into application on 25 May 2018, and pursuant to Act No. 2018-493 of 20 June 2018 on the protection of personal data (known as LIL3) and ordinance No. 2018-1125 of 12 December 2018 taken in application of Article 32 of Act No. 2018-493 of 20 June 2018 on the protection of personal data and amending Act No. 78-17 of 6 January 1978 on information technology, files and freedoms, you have the following rights:

• Right of access
• Right of rectification
• Right of erasure
• Right of restriction
• Right to object
• Right to data portability

Your requests can be formulated in different ways:

• By sending an email to the following address: dpo-7shapes@agencergpd.eu
• Via the FRAGMOS application by following the link below: Rights Management
• By registered post by writing to 7-SHAPES, 197 rue de Bordeaux, 16000 Angoulême
• By appointing someone who will use one of the means above to formulate the request

Your requests must always be accompanied by an identity document to verify your identity. This control is necessary because it helps protect your personal data. Once validated, and at the latest within one month, your identity document will be deleted. Communicating your data to a third party, rectifying, or deleting them at the request of a person other than you would be a violation of your data. You can also withdraw your consent at any time to the processing of information about your disability, through the same channels.

For an access request:
Please specify in your request which data or processing operations it relates to. Your data will be sent to you electronically or by registered post with acknowledgement of receipt. You may be asked to pay reasonable fees based on administrative costs for any additional copy requested (Article 15.3 of the GDPR). In the case of manifestly unfounded or excessive requests, you may be asked to pay reasonable fees that take into account the administrative costs incurred in providing the information or refusing to act on these requests (Article 12.5 of the GDPR).

For a rectification request:
If you believe that information about you is incorrect and should be rectified, please state precisely the inaccurate or incomplete data concerning you, and provide any information allowing it to be corrected or completed (Article 16 of the GDPR).

For an erasure request:
Please state precisely the data concerning you whose erasure you request, and the reasons for your request (Article 17 of the GDPR).
Please note: this right is not absolute; we may be obliged to retain information about you, in particular for the management of the commercial relationship (invoice management, dispute management) and for the documentation and provision of evidence relating to the exercise of your rights.

For a request for restriction of processing:
Please state precisely the data concerning you whose processing you wish to have restricted, and the reasons for your request.
Please note: this right is not absolute; we may decide to continue processing your data (Article 18 of the GDPR). Restriction, if implemented, may result in the suspension of the services provided (access to work and deliverables, receipt of information, etc.). These consequences will be described to you in the email acknowledging receipt of your request for restriction of processing.

For a request to object:
Please state precisely the processing of data concerning you to which you wish to object, and the reasons for your request.
Please note: this right is not absolute. Please state precisely the processing for which you object to the management of your personal data, and the reasons for your request (Article 21 of the GDPR).

For a data portability request:
Each user may at any time make a data portability request in order to retrieve the personal data collected about them in the context of processing based on consent and on a contract. If you wish your data to be transmitted to another data controller in a standard format, please specify this and provide the contact details of that other data controller (Article 20 of the GDPR).

To comply with the GDPR, 7-SHAPES is supported by Agence RGPD (8 rue du Pré-Médard, 86280 Saint-Benoît), an organisation specialised in personal data protection and GDPR compliance. For any further question relating to the GDPR and our compliance approach, you can contact Agence RGPD at any time by email at dpo-7shapes@agencergpd.eu.

Last updated: [2026 10 30]