Personal data

1.Who processes what

The client centre or institution is the data controller for the data of its pupils, students, prospects, parents or legal guardians, employees and contacts at client companies. Jabeur Digital Solutions acts as a processor: it hosts and processes this data on the client's instructions, for the sole purpose of providing the service, and does not use it for any purpose of its own, with one exception: the pooling of reliability indicators between centres (section 16), which Jabeur Digital Solutions organises and for which it is answerable as data controller.

2.What is collected

For users of the software: name, professional e-mail address, role, login log. For the people managed by the client: the information the client chooses to enter, civil status, contact details, training history, payments, attendance. For parents invited by the centre: name, relationship to the learner, telephone and e-mail address. For the centre's team: requests for leave, remote work or assignments, administrative documents requested, internal complaints and, if the person provides it, their date of birth. The publisher never asks for data it does not use.

3.Sensitive data

The server only sends this data to the people who need it.

• A learner's special needs (health, disability, learning disorder, what to do, emergency contact): optional. The centre's reception and administration read them, its trainers only if the learner's consent is noted in the record; neither sales, nor accounting, nor human resources have access to them.
• Internal complaint: read only by the centre's manager, the management and human resources. The person concerned is informed of it only on their decision, and without the name of its author when the author has asked for confidentiality.
• Salary certificate: seen only by the employee and the administration.
• A team member's date of birth: shown to their colleagues, day and month only, if they agree.
• A learner's review: reaches their trainer without their name, and is published as a testimonial only if the learner has allowed it.

4.Handwritten signatures

The charters (of the learner, the parent, the trainer) and the attendance sheets of the CNFCPP file are signed by hand, on the screen. The signature is kept as an image, with its date and the version of the text signed; a signed charter can no longer be changed. This image is not sent when the management space is opened: it is only read on request, by the centre's administration and reception, to produce the signed document.

5.Parent space

A parent only has an account if the centre invites them: the invitation link is personal, valid for seven days and can only be used once. The parent chooses their password, which the server keeps in hashed form, never in plain text. They only see the records of the children to whom the centre has linked them, and their session closes after fifteen minutes of inactivity.

6.Where and for how long

The data is hosted by specialised providers (database and application), whose servers may be located outside Tunisia. Exchanges are encrypted (HTTPS). The client can export its data at any time. It is kept for the whole duration of the subscription, then for three months after it ends, before deletion.

7.Separation between centres and between roles

Isolation between clients is enforced by the database itself: a query issued for one centre cannot technically return another centre's row. Only the aggregated rates described in section 16 are calculated across several centres, by the server, without any row of one centre being sent to another. Within a centre, the server only sends each team member the data of their role: a teacher receives neither salaries nor payments, and every change is checked before it is saved.

8.Passwords and access

Passwords are never stored in plain text. Learners and parents choose their own password on first login. Two-factor authentication is available for team accounts and mandatory for the publisher. Repeated login attempts are blocked.

9.Minors

Primary, lower secondary and upper secondary schools process data of minor pupils. It is up to them to inform the legal guardians and to enter only what is necessary for schooling. When the centre opens the parent space, only the guardians it invites follow their child's record. Minors' data is not used for any commercial purpose.

10.The public verification page

A certificate's QR code opens a public page that shows the holder's name, the course and the issuing centre, and only the information the centre chooses to show there: level, dates, number of hours, photo, national identity card (CIN) number or date of birth, for example. Hidden information is not sent to the browser. The CIN and the date of birth are only printed on the certificate if the centre so decides. This page is not offered to search engines.

11.Access by the publisher

Jabeur Digital Solutions staff only access a client's data at the client's express request for support, for technical maintenance or for data migration. These accesses are logged.

12.Your rights

Any person whose data appears in the software may request access to it, its rectification or its deletion. These requests are addressed to the centre or institution concerned, which is the data controller. The publisher assists it in responding to them.

13.Processors and third-party services

Hosting of the application and the database, sending of service e-mails and collection of subscriptions rely on specialised providers. The up-to-date list is provided on simple request from our contact page. The weather for sessions is requested from the public Open-Meteo service by the Classimum server: it only receives the name of the centre's city, never personal data or the user's address.

14.Cookies

The software only sets the cookies needed to maintain sessions (management space, learner space, parent space) and, for two hours at most, the one that finds an enrolment resumed from the link in a reminder (section 15). On the Classimum website, audience measurement or advertising tools, when the publisher activates them, only load after the visitor's consent, which can be changed from the “Manage cookies” link in the footer. On the centres' showcase websites, Meta's advertising pixel, when the centre has installed it, only loads after the visitor's consent, which they can withdraw at any time from the “Cookies” link in the footer. No resale of data, no advertising profiling.

15.Sign-ups started on the website

When you start signing up on the Classimum website (centre or institution, trainer, partner, Classimum Ads advertiser), what you enter is saved as you type, as soon as a valid e-mail address or telephone number is given: name, institution, contact details and answers to the form, never the password or an attachment. The Classimum team uses it only to help you complete your sign-up and to contact you again about it (a call, or an e-mail with a link that restores what you entered, valid for fourteen days, never more than one every two days); this information is passed on to no one. After 90 days without activity, your started sign-up is archived: it is kept, with no time limit, so that we can contact you again and follow up started sign-ups. You can request its deletion at any time from our contact page: the deletion is then carried out and recorded.

16.Reliability score and indicators shared between centres

When Classimum activates this feature, two calculations are made on learners' records. The centre's score: based solely on the data entered by the centre (due dates and payment dates, attendance and lateness, courses taken, completed or abandoned, tests submitted and marks, reviews given, complaints, length of relationship), marks out of 100 accompanied by their method and their reasons, visible only to the centre's accounts that can see payments. The shared indicators: when a centre consults the profile, the server matches the records of the same person in the different user centres by their national identity card (CIN), passport, e-mail address or telephone (never by name alone, and a contradictory identifier prevents the match), then calculates three aggregated rates: on-time payment, attendance, courses completed, with the number of centres and events taken into account. For this purpose, identifiers are only kept in the form of an encrypted hash. Purpose: to help centres prevent unpaid debts and adapt educational follow-up; no advertising use, no resale. Recipients: only the centres where the person has made at least one payment for their enrolment, and within them the accounts that can see payments; no centre name, reason, detail or amount coming from another centre is disclosed, and each consultation is recorded. Retention: the indicators are calculated at each consultation from the existing records and disappear with them, according to the periods in section 6; consultations remain recorded for auditing. Legal basis: the legitimate interest of centres in the proper performance of the training contracts they conclude. Your rights: access, rectification and objection are exercised with the centre concerned or with Jabeur Digital Solutions from our contact page; Jabeur Digital Solutions may in particular exclude an identity from the shared indicators, especially in the event of an identity error. No decision should be taken on the sole basis of these indicators.