Privacy Policy

This page sets out what we do with the personal data you give us on this site: why we hold it, who else sees it, how long we keep it, and what you can require of us. It is written to be read, not to be quoted back at you.

Last updated: 19 October 2026.

Who is responsible for your data

MERLIN/LEONARD, SAS au capital de 50 000 €, 128 rue La Boétie, 75008 Paris, RCS Paris B 835 115 148 is the controller for everything described on this page.

We have not appointed a Data Protection Officer: the conditions in Article 37 GDPR are not met. For any question about this policy, or to exercise your rights, there is one route — our contact form, or a letter to the address above.

We do not publish an email address on this site. A plain-text address is harvested within days, and the flooded inbox that follows is exactly the one where a response deadline gets missed. The form reaches the same place, and it is read.

What this page covers

This site does five things with personal data: it lets you book a meeting, lets you write to us, measures its own audience, gives access to the Académie (learner accounts, progress, certificates), and collects assessments and surveys. Each is set out below with what it collects, why, on what legal basis, and for how long.

Booking a meeting

When you book a slot we record your name and your email address, and — if you fill them in, they are optional — your phone number, company, city and the message you leave. We also record, without asking you, the page you came from and any campaign parameters in the address: that is what tells us where our enquiries come from. Neither is read from a cookie; both come from the request itself.

Your booking sets three things in motion:

• Your meeting is created in Google Calendar, with you as an attendee. Google sends you the invitation and the Google Meet link, so that is your confirmation channel — and you can see it happen.
• Your details are recorded in our customer relationship tool, where they feed our commercial follow-up and a prioritisation score.
• The source of your enquiry is recorded for our own measurement.

On what basis. Arranging the meeting fulfils a request you made yourself: these are pre-contractual steps taken at your initiative — Article 6(1)(b) GDPR. The commercial follow-up and the source measurement rest on our legitimate interest in growing a business-to-business practice — Article 6(1)(f). You may object to either at any time, and where the processing is direct marketing you do not have to give a reason (see Your rights).

About the score. We assign each contact a prioritisation score. That is profiling within the meaning of Article 4(4) GDPR, but it does not drive an automated decision: it orders a follow-up made by a person, and it produces no legal or similarly significant effect on you. Article 22 does not apply.

Contact and enquiry forms

When you write to us we receive what you type — at minimum your email address and your message, plus whichever optional fields you complete — and we record the source of your enquiry in the same way.

On what basis. Handling your enquiry is a pre-contractual step taken at your initiative (Article 6(1)(b)). Any commercial follow-up and the source measurement rest on our legitimate interest (Article 6(1)(f)), with the same right to object.

If your message is a request to exercise your rights, we handle it under the legal obligation to respond to it (Article 6(1)(c), Articles 12 to 22 GDPR), and not for commercial purposes.

Next to the send button there is an optional tick box offering to let us measure your browsing on this site for marketing analytics. It is never pre-ticked, leaving it blank has no bearing on your message being sent or on our reply, and you can withdraw that agreement at any time through "Manage cookies".

Site audience measurement

We measure this site's audience with our customer relationship tool and with Google Analytics 4, both fired through Google Tag Manager. Neither fires until you have agreed — either through the cookie banner, or by ticking the box offered beside a form or a booking. Until you answer, they do not fire.

What is never conditional on your agreement: forms, booking, action buttons and videos. They work whatever you choose. We do not lock any page while you have yet to answer the banner: there is no cookie wall on this site, and refusing degrades nothing.

On what basis. Your consent — Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act. You can withdraw it at any time, without affecting what was measured beforehand, through "Manage cookies" in the footer.

Proof of your choice. We must be able to demonstrate that your agreement was given (Article 7(1) GDPR). Each time you accept, refuse or change your choice, we keep a record of it in our own register: a pseudonymous identifier specific to this consent manager, your choice for each purpose and each tool, the version of the text you were shown, the date and time, the gesture used (banner, customisation, tick box beside a form, withdrawal) and the site concerned. We never keep your IP address, the full address of the page, the full identification of your browser or the page you came from. Basis: the legal obligation to demonstrate consent (Article 6(1)(c), Article 7(1) GDPR).

Académie account and training records

When training access is opened for you, we create an account you sign into through a link sent to your email address: there is no password to remember, and therefore none to protect. From then on we hold your email address, your name if you give it, your display language, the courses you have access to, your progress lesson by lesson, your quiz attempts and their results, and any certificates issued to you — serial number, date and document.

No payment passes through this site. There is no checkout page and we collect no card or bank details: access is opened manually after an order handled away from the site.

On what basis. Performance of the training you or your employer ordered — Article 6(1)(b) GDPR.

Assessments and surveys

Two cases, with neither the same audience nor the same purpose.

Self-assessments, open to anyone. You answer a questionnaire and we give you the result. We keep your answers, the score, and your email address if you give it so that we can send the result.

Post-training satisfaction surveys. These are sent through a link issued to you after a session, and they serve our Qualiopi quality process. We keep the session concerned, your role in relation to it — attendee, sponsor or funder — and your answers.

On what basis. Self-assessments rest on our legitimate interest in offering you an assessment tool and learning from it (Article 6(1)(f)); if you give us your email address to receive your result, it is used first and foremost to send it to you. Training satisfaction surveys rest on a legal obligation: collecting stakeholders' feedback is required by the French national quality framework (Article 6(1)(c); Article L. 6316-1 of the Labour Code, Decrees No. 2019-564 and No. 2019-565 of 6 June 2019). By contrast, using your email address to keep you informed about our training rests on our legitimate interest (Article 6(1)(f)): you may object at any time, without affecting the retention of your answer as evidence of our quality process.

Video

Videos on this site are delivered by our video provider. Nothing loads from them until you click "Play": until then you see only a still image and a button, both served by us. On the click, the player loads from our video provider, which may then set its own video-audience cookies — as the button tells you before you click it.

Embedded content

Some pages show content served by an outside service, for example a Google Trends chart or a Miro board; the service's name appears on the content itself. When that content is shown, the service receives your IP address, as with any web page; we do this on the basis of our legitimate interest in illustrating our content (Article 6(1)(f)). If it sets cookies, nothing loads from it until you click "Show"; what it does after that falls under its own privacy policy.

Who receives your data

We do not sell or rent your data, and we pass it to nobody for advertising. It is processed on our behalf by the following providers, each bound by a processing agreement:

• Google (Workspace and Analytics) — the calendar and video call for your meetings and, if you accept it, audience measurement with Google Analytics. For your meetings, it sees your name, your email address, the meeting subject and any notes attached to it. For audience measurement, it sees the pages you view on this site, your journey, a cookie identifier and your IP address, from which Google Analytics derives only an approximate location and which it does not keep.
• Paminga — our customer relationship tool, our forms, and part of our audience measurement. Sees your contact details, the history of our exchanges and your prioritisation score.
• Supabase — the database for the Académie, the surveys and the register of your cookie choices, hosted in the European Union. Sees your account, your progress, your certificates, your answers and the record of your cookie choices.
• Vercel — hosting for this site. Sees server logs: IP address, page requested, timestamp.
• Sentry — technical error detection. Sees technical error logs.
• TwentyThree — the video player. Sees nothing until you click "Play".

The consent manager on this site is our own tool: no third-party provider sees your cookie choices. It runs on every page, including before you have made a choice: that is what lets it record the choice and then hold the other tools to it.

We may also disclose data where the law requires it, or to establish, exercise or defend a legal claim.

Transfers outside the European Union

This site and the Académie database are hosted in the European Union.

Some of our providers are established outside the European Union, or may process data there. That is the case for Google, whose processing on our behalf rests on the standard contractual clauses adopted by the European Commission, together with the provider's own technical and organisational measures. Where another of our providers processes data outside the European Union, the transfer rests on the same footing.

You can ask us for a copy of the applicable safeguards through our contact form.

How long we keep it

• Meetings and commercial enquiries — 3 years from your last contact with us, then deleted.
• A meeting attached to invoiced work — 10 years, because it becomes an accounting record (Article L. 123-22 of the French Commercial Code). The GDPR asks for a period proportionate to the purpose, not for a short period on principle.
• Académie account, progress and quiz results — for as long as your account is open. If you do not sign in for 3 years we will email you and close it unless you ask us to keep it. You can ask us to close it at any time.
• Training certificates — 10 years from issue. A certificate is the evidence that a billed service was actually delivered, so it follows the same period as our accounting records (Article L. 123-22 of the French Commercial Code). It is kept even if your account is closed, so you can always ask us for a copy.
• Assessment and survey answers — 3 years. For satisfaction surveys this is our quality-certification cycle: beyond it, your answer is no longer something our certification body can examine. After that we keep only aggregated results, which can no longer identify you.
• Your cookie choices — your choice is remembered on your device for 6 months, after which we ask again. The proof of that choice is kept for 3 years from the date of the choice, then deleted automatically.
• Audience-measurement cookies — 13 months at most on your device.
• Site and error logs — 12 months at most, and usually far less: these logs serve technical diagnosis and site security (including limiting the number of requests to prevent abuse), and our hosting providers delete them automatically according to their own settings. They are never used for commercial purposes, nor matched against your account or against the proof of your cookie choices. Basis: our legitimate interest in keeping the site secure and available — Article 6(1)(f).

What "last contact" means, precisely, because a period nobody can calculate is not a period: it is the date of your most recent meeting held, or the date you made the booking if you cancelled it — cancelling does not undo the fact that you got in touch. If you book several times, the most recent one counts: we do not erase a record part of which is still live.

Your rights

Over data concerning you, you have the following rights:

• Access — confirmation that we process your data, and a copy of it (Article 15).
• Rectification — correction of inaccurate data, completion of incomplete data (Article 16).
• Erasure — deletion of your data where one of the grounds in Article 17 applies.
• Restriction — a freeze on the use of your data while a dispute is resolved (Article 18).
• Portability — the data you gave us, in a machine-readable format, and transmission of it to another controller at your request (Article 20).
• Objection — objection, on grounds relating to your particular situation, to processing based on our legitimate interest; and objection without having to give a reason where the processing is direct marketing (Article 21).
• Withdrawal of consent — withdrawal, at any time, of your agreement to audience measurement, without affecting what was done beforehand (Article 7(3)).

How to exercise them. Write to us through our contact form, or by post to the address given at the top of this page. Tell us which right you are exercising; if there is reasonable doubt about your identity we may ask you for something that establishes it — and nothing more.

We reply within one month of receiving your request. Where the request is complex that period may be extended by two months: we will tell you so within the first month, and why (Article 12(3)).

If you consider that we are not respecting your rights, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), at cnil.fr. We would obviously rather you raised it with us first.

Cookies and trackers

This site uses three families of files stored on your device.

• Those necessary to the service you asked for — your Académie sign-in session, the record of your cookie choice, security. They do not ask for your agreement, because without them the service does not work.
• Those for audience measurement — set only after you agree, and removed the same way.
• Those of video players and embedded content — set only if you click "Play" or "Show", and only by the service you load that way.

There is no cookie wall. Refusing closes no page and disables no form, no booking and no video. You can revisit your choice at any time through "Manage cookies" in the footer.

Security

Traffic to and from this site is encrypted in transit. Académie data is partitioned at the database level: an account can read only its own rows, and that rule is enforced by the database server itself rather than only by the application querying it — a distinction that matters on the day the application gets something wrong. Certificate documents are reachable only through a short-lived signed link, issued after checking that the requesting account holds them.

Changes to this policy

We update this page when our processing changes. The date it was last updated is at the top.