Data Processing and Privacy Policy
1.Object
he purpose of this privacy policy is to inform users of the École nationale des ponts et chaussées (ENPC) website about how their personal data is collected, used and protected, as well as the rights they have, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the amended Law No. 78-17 of 6 January 1978, known as the ‘Data Protection Act’.
2.Data controller
The data controller is the École nationale des ponts et chaussées (ENPC), a public scientific, cultural and professional institution (EPSCP), located at 6 and 8 Avenue Blaise Pascal, Cité Descartes – Champs-sur-Marne, 77455 Marne-la-Vallée Cedex 2 – France.
3.Personal data processed
In connection with the use of its website, the ENPC may process the following data in particular: identification data (surname, first name), contact details (email address, telephone number), professional or academic data depending on the forms, the content of messages sent via the forms, as well as technical and browsing data (IP address, connection logs, cookies). The ENPC ensures that it collects only data that is adequate, relevant and strictly necessary for the purposes pursued.
4.Purposes of processing
Personal data is collected in order to respond to enquiries submitted via contact forms, to manage registrations for institutional, scientific or educational events, to disseminate information relating to the institution’s training, research and outreach activities, to manage applications and administrative procedures, to ensure the operation, security and continuous improvement of the website, and to compile anonymised visitor statistics. This processing forms part of the public service remit entrusted to the ENPC by the State.
5.Legal basis for processing
Data processing is based, depending on the circumstances, on:
- the consent of the data subjects;
- the performance of a task carried out in the public interest in the field of higher education and research;
- the implementation of pre-contractual or contractual measures;
- compliance with legal obligations;
- the legitimate interests of the ENPC.
6.Recipients of the data
The data is intended solely for authorised internal departments of the ENPC and, where applicable, for technical service providers acting on behalf of the institution in accordance with the GDPR. The data is not transferred to third parties or used for commercial purposes.
7.Retention periods
Data is retained for periods that are limited and proportionate to the purposes for which it is processed. Data from contact forms is retained for as long as is necessary to process the enquiry. Data relating to job applications or administrative procedures is retained in accordance with the timeframes set out in the relevant legislation. Browsing data and cookies are retained in accordance with the recommendations of the CNIL. Where data is of administrative, scientific or historical interest, it may be subject to interim or permanent archiving in accordance with the rules applicable to public archives.
8.Cookies and trackers
The website may use cookies that are necessary for it to function, as well as, where applicable, audience measurement cookies or third-party cookies. On your first visit, an information banner will allow you to accept, refuse or configure non-essential cookies.
Find out more about our cookie policy: see below
9.Data security
The ENPC implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data. These measures are tailored to the sensitivity of the data processed and are reviewed on a regular basis.
10.Rights of data subjects
In accordance with current regulations, all data subjects have the right to access, rectify, erase, restrict the processing of, and object to the processing of their data, and, where applicable, the right to data portability. These rights may be exercised by contacting the ENPC’s Data Protection Officer (DPO) at the following address: dpo@enpc.fr.
In order to process the request and prevent any unauthorised access to data, further information to verify the applicant’s identity may be requested where necessary. The ENPC undertakes to respond to requests within the time limits set out in the applicable regulations.
11.Complaint
If, after contacting the ENPC, a person feels that their rights have not been respected, they may lodge a complaint with the French Data Protection Authority (CNIL) via the website www.cnil.fr.
12.Updates
This privacy policy may be amended at any time to reflect changes in the law, regulations or technology. The date of the last update is shown on the relevant page of the website.
Last updated: 17 June 2026.
- - - - -
Consent to the use of cookies.
For our website to function properly we use cookies. To obtain your valid consent for the use and storage of cookies in the browser you use to access our website and to properly document this we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. Website: https://cookiefirst.com referred to as CookieFirst.
When you access our website, a connection is established with CookieFirst’s server to give us the possibility to obtain valid consent from you to the use of certain cookies. CookieFirst then stores a cookie in your browser in order to be able to activate only those cookies to which you have consented and to properly document this. The data processed is stored until the predefined storage period expires or you request to delete the data. Certain mandatory legal storage periods may apply notwithstanding the aforementioned.
CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is article 6(1)(c) of the General Data Protection Regulation (GDPR).
Data transfers outside the EU
The website may incorporate content provided by third-party services, including videos hosted on YouTube. Displaying this content may result in the relevant providers setting cookies and collecting certain technical information relating to browsing activity.
When the user accepts the relevant cookies, these services may collect data such as the IP address, information about the browser used, or interactions with the content displayed. This processing is carried out under the responsibility of the relevant providers, in accordance with their own privacy policies.
For further information:
- Google Privacy Policy: https://policies.google.com/privacy
- YouTube Privacy Policy: https://www.youtube.com/howyoutubeworks/user-settings/privacy/
Data processing agreement
We have concluded a data processing agreement with CookieFirst. This is a contract required by data protection law, which ensures that data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.
Server log files
Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:
- Your consent status or the withdrawal of consent
- Your anonymised IP address
- Information about your Browser
- Information about your Device
- The date and time you have visited our website
- The webpage url where you saved or updated your consent preferences
- The approximate location of the user that saved their consent preference
- A universally unique identifier (UUID) of the website visitor that clicked the cookie banner