Privacy statement

Privacy Statement Codam Coding College

Introduction

Your privacy is important to us. We aim for a careful treatment of personal data of everyone who is or attempts to enrol to Codam Coding College. This privacy statement describes why and how we collect and use personal data and provides information about individuals’ rights. It applies to personal data provided to us, both by individuals themselves and by other means.

Stichting Codam (located Kattenburgerstraat 7, building 039, 1018JA Amsterdam) offers programming education to people from 18 years old. Officially licenced to 42 (located 96 Boulevard Bessières, 75017 Paris), we are part of a worldwide network of coding schools. Within the network, all schools use the same curriculum, intranet and tools.

This statement applies to all activities (including the activities via the website) of Codam. Codam is an official partner of 42, part of the 42 Network, and has set a Partnership contract to arrange the processing of personal data controlled by 42 and processed by Codam.

This Privacy Statement is in line with the 42 Privacy Statement, and last amended on December 7th, 2020. We may amend this Privacy Statement from time to time.

Chapter 1: Personal data we collect

Codam collects personal data from you, through our application website and during the curriculum. You provide some of this data directly, and we get some of it by collecting data about your progress in the curriculum and your interactions within the school.

The personal data collected from you are used for educational purposes. Our educational model requires some personal data to participate. We rely on a variety of legal reasons and permissions (“legal bases”) to process data, including the necessity to enter into and perform contracts, legitimate interest and with your consent. We only collect personal data which are adequate, relevant and not excessive in relation to the purposes for which they are collected.

We have listed an overview of the personal data we collect and the procedures in which we handle this data in the index.

1.1 Contract

We collect most of your personal data for the purposes of performing the educational model and fulfilling certain contractual obligations. If you do not provide the personal data listed below, you may not be allowed to attend the programme. The data we collect depends on the context of your interactions with Codam. We distinguish the

following phases in which the data we collect can include but not limited to the following:

Use of our website (you can find a more detailed description in our Cookie Statement)
- Type of browser or device;
- details of web pages you have visited;
- links you clicked;
- your IP address.
Registered at the application website
- Name and address;
- Telephone number, email address;
- Date of birth, sex.
Participating in the Selection Piscine (in addition to above)
- Country of birth;
- Emergency contact (name and telephone number);
- Profile picture;
- Time in school (check-in/check-out);
- Study progress and other study-related data;
- Terminal commands in unmodified Zsh shells;
- Video surveillance within the building;
- Any personal experiences in the event of the student consulting the educational staff.
Participating in the curriculum (in addition to above)
- Study progress and other study-related data;
- Internship contract (company name, salary, evaluations).

1.2 Legitimate interest

Besides the necessity to enter into and perform contracts, we collect and use data based on legitimate interest, such as to carry our general statistics and safeguard the quality of education. To limit privacy impact on the individual, personal data is anonymised before it is used for data analysis.

1.3 Consent

If none of the above bases for processing apply, then we will request your consent to process certain personal data. An example of a situation for which we could ask for your consent is taking photos/videos. You are free to withdraw your consent at any time.

We also ask you for consent to join the alumni network, in which we save your name, telephone number, email address and graduation level. And any participation in the Codam Assistance Program is based on consent to process your personal data to review your application for financial assistance.

Please have a look at the overview in annex 1 for the extensive overview.

Chapter 2: Purpose of collecting personal data

We collect personal data for the purposes of our service provision, within the framework of education, and in order to execute our peer-to-peer education model. Personal data is processed by the following purposes:

Registration for the purposes of education;
Administrative purposes, to enable access to the curriculum;
To manage curriculum details and online services to facilitate study supervision;
Information purposes;
Information on your study account, your study status and other (necessary) information from Codam;
Conducting general statistics;
Ensure a safe and healthy student environment.

Chapter 3: Automatic decision making

We use automated decision making – a decision made about a person, through algorithms applied to their personal data, without any human being involved in the process – to validate the test results on our application website and when you continue in the Selection Piscine.

3.1 Online application test

We use an algorithm to validate the levels of logic and memory of the candidates to allow them to go further in the application process. Candidates who failed these tests can not continue the application process.

The game’s algorithm of the Codam application form evaluates the levels released on the different games to determine if a candidate has demonstrated enough skills to continue the following selection steps. It is based only on test results and only assesses the levels achieved.

3.2 Selection Piscine

We use a second algorithm at the end of the Selection Piscine to help determine which candidates are eligible for admission within Codam. However, the result of the algorithm is always discussed in the team and is never used one-sided in the decision making.

The selection algorithm at the end of the Selection Piscine is based on several criteria such as the skills, motivation, collaboration and commitment that the candidate has shown during the 4 weeks. It assesses the match between the candidate and our educational model. Whether a candidate is admitted to the curriculum is decided by both the selection algorithm and jury review.

The algorithm is designed and implemented by the Head of Studies in close collaboration with the Director, and is reviewed for improvements and updates every year.

Chapter 4: Where we store and process personal data

4.1 Google Cloud

Codam is using G Suite services for email and file storage, and signed the Service Level Agreement with Google as part of the paid Business plan. The data are stored on Google Cloud.

Here is more information about how Google Cloud is compliant with the GDPR regulations.

4.2 Codam

Personal data regarding the application and education process is stored on the servers located at Codam, Kattenburgerstraat 7, 1018JA Amsterdam.

4.3 42 Paris

Personal data collected as part of the selection and educational process are stored in the data centre of 42 in Paris. As Partners in this matter, Codam and 42 have a shared responsibility in processing your personal data.

As Codam is part of a network with schools in different countries worldwide, the personal data on the intranet may be accessible to countries outside the European Union. A for list of partner schools is presented on our website, it includes but is not limited to the United States, Russia, Morocco and South Africa. By agreement with 42, all schools made the commitment to comply with the legislation of the European Union.

42 guarantees that transfer is only made to countries that provide a level of protection equivalent to that guaranteed within the European Union or are governed by binding tools to meet the requirements of the applicable regulations. For more information, we refer to 42’s Privacy Statement here.

4.4 Other third parties

We may disclose your personal data to other providers not listed. All third parties shall process your personal data in conformance with a data processing agreement that we will enter into with them.

Chapter 5: How to access and control your personal data

5.1. Retention period

We undertake to keep your personal data only for the time necessary to fulfil the purposes concerned, this varies depending on the type of data and the treatment concerned. Below you will find how long we keep the data.

At the end of this period, and unless you specify otherwise, we will proceed to the deletion of your personal data or their anonymization for statistical purposes.

5.2. Right to access and control your personal data

Students can access and control their personal data on Codam’s Intranet. We have arranged that it is possible to exercise your rights, such as your right to access, update, correct, erase, restrict, object or port personal data, directly on your Intranet profile page.

People subscribed to Codam but who are not yet a student, may request that their data is erased by sending their request to legal@codam.nl.

As part of processing your request, we may ask you for proof of identity to verify accuracy. In any case, we are committed to providing you with an answer within one month, possibly extendable once given the complexity and the number of requests.

You may request that your data be erased, although this is only possible insofar as this allows Codam to continue to fulfil its core business (education). If it is not possible to erase your data, we will pseudonymised or anonymise your personal data to the fullest extent possible.

For all students requested anonymisation, a summary of the data, including identification of the student, level of studies, project marks, as well as partnerships, accreditations, and internships, is stored on a separate and isolated server at 42 Paris. This historical data can only be accessed by 42 Paris upon request by Codam.

5.4. Recordings surveillance videos

Codam uses video surveillance at site to ensure the safety of our students and visitors, and protect Codam’s high value property. The camera’s are focussed on the entrance and exit doors. The live stream is accessible 24/7 by the security guard that is on duty. During nights images are monitored offsite by a service provider with which a data processing agreement is signed.

Recordings are secured and only accessible by the Codam IT Manager and Facilities Manager. Retention period of the tapes is 28 days.

5.5. Terminal commands

Codam collects the terminal command entered in unmodified Zsh shells. The log is secured and only accessible by the Codam IT Manager. It is only accessed in case of a (suspected) security incident.

Retention period of the data is 28 days.

Chapter 6: Keep your personal data safe

We have taken measures to keep your personal data safe. We have taken appropriate technical and organisational measures to prevent loss or unlawful processing of personal data. For example, staff authorised to view it on the grounds of their role can only view your personal data and a strict policy regarding the creation and renewal of passwords allowing access to personal data.

We have appointed the following recipients of your personal data:

Codam team: study progress and other study-related data;
Head of Studies: personal notes impacting your studies;
Deputy General Manager: all administrative data;
IT Manager and Facilities Manager: recordings of video surveillance.

Your personal data will not be rented, sold or otherwise shared with or provided to third parties.

Chapter 7: Cookies

We store general visitor statistics on our website to analyze our online performance and improve the functionalities. Please find the cookie statement here.

Chapter 8: Dutch Data Protection Authority

You also have the right to object to the processing of your personal details. More information regarding your rights can be found on the Dutch Data Protection Authority’s website.

You can file a complaint with the Dutch Data Protection Authority about the way Codam processes your personal data.

Chapter 9: Questions

Do you have any specific questions or comments about our Privacy Statement based on this information? If so, do not hesitate to get in touch with us.