Privacy and cookie policy

Who does what

Learner data is collected on behalf of the company that provided the course access code. That company is the data controller: it decides on the courses, the people concerned and how the results are used.

CLS COULON LEARNING SOLUTIONS, publisher of PassLMS, acts as a processor within the meaning of Article 28 GDPR: it hosts the platform and processes data on the client company’s instructions, under a written contract. For administrator accounts and billing, it is the data controller.

Data processed

• Learner: first name, last name, work email address, declared company, course completion date and, depending on the module format, progress and score;
• Administrator: sign-in email address, display name, password (never stored in plain text: only a hash is stored);
• Client company: company name, coordinator’s email address, subscription status;
• Security: irreversible hash of the IP address and timestamp, when an access code is entered.

No sensitive data within the meaning of Article 9 GDPR is requested. No automated decision-making or profiling takes place.

Purposes and legal bases

• Providing access to the course and certifying its completion - performance of the contract between the company and its provider, and the employer’s legitimate interest in tracking the training it funds;
• Allowing the company to track results and export a report - legitimate interest, and legal obligation where the training is mandatory;
• Securing access to the platform and preventing intrusion attempts - legitimate interest;
• Managing administrator accounts, subscriptions and billing - performance of the contract and accounting obligations.

Data is never sold, rented or used for advertising.

Recipients

• Authorised administrators of the client company concerned, and only them: each company sees only its own data, with isolation enforced at database level;
• The publisher, for technical operations and support;
• The sub-processors listed below.

Sub-processors and transfers outside the European Union

• Vercel Inc. (United States) - application hosting and audience measurement of public pages. Requests are processed in the Paris region; as the parent company is American, any transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
• Supabase Pte. Ltd. - database and course file storage. Data is hosted in the European Union, in Ireland (region eu-west-1): it does not leave the Union for storage purposes.

No other recipient is involved without prior notice to the client company, in accordance with Article 28.2 GDPR.

Retention periods

• Results and certificates: for the duration of the contract with the client company, then deleted within 30 days of its end, unless a longer legal period applies to the employer for mandatory training;
• Learner session: 8 hours maximum, then automatic expiry;
• Administrator accounts: until deleted by the company or the end of the contract;
• Access code attempts: automatically purged after 7 days;
• Accounting documents: 10 years, as required by the French Commercial Code.

Security

• Encrypted connections (HTTPS) across the entire site;
• Data isolation per company, enforced by the database itself;
• Access codes and passwords never stored in plain text: scrypt hash for verification and, for codes, an encrypted copy whose key is not stored in the database;
• Limited number of access code attempts, per address and per code;
• Administrators signed out automatically after 20 minutes of inactivity.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, as well as the right to set instructions regarding its fate after your death.

Send your request primarily to your employer (training coordinator or data protection officer): the employer decides on the processing. You can also write to us contact@passlms.com; we will forward the request to the company concerned.

If you are not satisfied with the answer, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Cookies, local storage and audience measurement

No cookie is set when you simply browse the site. The only cookies used are set at your initiative, to make what you ask for work: opening a course with an access code, signing in to the admin area, or changing the display language. Being strictly necessary to the service, they are exempt from consent under Article 82 of the French Data Protection Act. No advertising or social network cookies are used, which is why this site does not show you a consent banner.

Public pages (home, plans, legal pages) are subject to audience measurement by Vercel Web Analytics: number of visits, pages viewed, referring site, country and device type. It sets no cookie, creates no identifier to track you from one visit to the next, and cannot identify you. The course experience and the admin area are excluded: learner activity is never measured for this purpose.

• mlms_learner - learner session, sealed server-side: remembers the open course. Duration: 8 hours;
• sb-… - session of an administrator signed in to the admin area;
• lang - language of the messages returned by the service, set only when you browse the English version of the site (/en). Duration: 1 year;
• Browser local storage: detects when the admin tab is closed, to close the session. This information never leaves your browser.

Changes to this policy

This policy may change as the service evolves. The date of the last update appears at the top of the page; client companies are informed of any substantial change.