3 chemin de sers, 64121 Montardon, France
contact@apesa.fr
Follow us →
This policy explains how APESA collects and uses the personal data of visitors and users of the apesa.fr website, particularly when making contact, requesting training, subscribing to the newsletter, applying for a job, or downloading a resource.
It also describes cookie-free audience measurement and third-party services likely to receive technical data. Summary information must be displayed at the time of each collection, with a link to this policy.
The controller for the processing described in this policy is APESA, Société Coopérative d'Intérêt Collectif, Hélioparc, 2 avenue du Président Pierre Angot, 64000 Pau, France.
Email for exercising rights: rgpd [@] apesa.fr
Postal address: APESA - Data Protection Officer - Hélioparc, 2 avenue du Président Pierre Angot, 64000 Pau
Data: Company, last name, first name, email address, telephone number, message, and freely communicated information.
Purposes: Receive, direct, and process the request; ensure the follow-up of the relationship.
Legal basis: Pre-contractual measures requested by the person or APESA's legitimate interest in responding to professional inquiries.
Recipients: Authorized persons from the relevant APESA teams, messaging services, and necessary technical service providers.
Duration: Three years from the last contact from the person, unless a shorter duration or archiving is justified by an obligation or litigation.
Messages are transmitted by email and may be stored in WordPress. They must not contain unnecessary sensitive data.
Data: Title, last name, first name, job title, contact details, organization, address, desired training, session, participants, request for adjustments, and message.
Purposes: Process the registration request, prepare the agreement, and organize the training, including requested adjustments.
Legal basis: Pre-contractual measures; then execution of the training contract. For information revealing health or disability: explicit consent of the person, when this processing is necessary.
Recipients: Training team and persons strictly necessary for the organization; technical service providers.
Duration: Three years after the last contact if the request is not successful. In the event of registration, legal or contractual durations applicable to administrative, accounting, and training documents.
The field relating to adjustment needs must be optional. It is recommended to collect only useful adjustment information at this stage, without medical diagnosis or unnecessary supporting documents.
Data: Last name, first name, email address, proof of double opt-in, unsubscription and, if activated, open and click data associated with the recipient.
Purposes: Send the newsletter; manage subscriptions; measure deliverability and, when the person has accepted it, the editorial performance of campaigns.
Legal basis: Consent for the subscription. Tracking operations not strictly necessary for deliverability are implemented with informed consent in accordance with Article 82 of the French Data Protection Act (Loi Informatique et Libertés).
Recipients: Authorized communication team and Sarbacane, the sending service provider whose campaign data is stated to be hosted in France.
Duration: Until unsubscription; otherwise, three years after the last active contact. Individual statistics: maximum three years, subject to actual necessity; anonymized statistics possible beyond this.
The simple opening of a message must not be used to extend the commercial retention period. Each message includes an unsubscription link. Withdrawal of consent to tracking must stop the tracking and lead to the deletion of associated data when no other basis justifies its retention.
2026 Update. For addresses collected before April 14, 2026, the transitional period provided by the CNIL ended on July 14, 2026. If information allowing for an objection was not sent under the conditions provided by the recommendation, APESA must now collect valid consent before any tracking subject to consent or deactivate this tracking. In the absence of proof of consent to the newsletter itself, the historical database must be re-qualified before reuse.
Data: Last name, first name, email address, telephone number, CV, cover letter, and message.
Purposes: Study an application for an offer or a spontaneous application; build, if the person accepts, a talent pool of applications.
Legal basis: Pre-contractual measures for ongoing recruitment; consent for retention in a talent pool beyond the relevant procedure.
Recipients: HR department and persons strictly necessary for recruitment; messaging services, WordPress, and technical service providers.
Duration: Unsuccessful applications: maximum two years from the last contact, unless deletion is requested earlier. Recruited candidate: deletion from WordPress after recruitment and transfer of only the data necessary for the HR file, according to the durations applicable to employees.
Candidates are invited not to communicate sensitive data unnecessarily. If a CV contains such data, APESA processes it only to the extent essential for examining the application and strictly limits access to it.
Data: Company, last name, first name, email address, requested resource, and distinct choices regarding prospecting and the newsletter.
Purposes: Manage the external form hosted by Sarbacane; provide or send the requested resource; qualify the contact in the internal Gide CRM when data is effectively transferred there; and, in the case of a relevant professional contact, offer information on APESA services related to their activity.
Legal basis: APESA's legitimate interest in responding to the resource request and, for a professional contact, in sending relevant B2B prospecting, with the right to object; separate consent for the newsletter and, where required, for tracking devices integrated into emails.
Recipients: Authorized APESA teams, Sarbacane for hosting the form, collecting information, managing the relevant list, and delivering the resource, internal Gide CRM when data is effectively transferred there, and strictly necessary technical service providers.
Duration: Three years from collection or the last active contact from the prospect when the data is used for relationship follow-up or professional prospecting. Simply opening an email does not constitute a new contact. Proof of the choices expressed is kept for the duration necessary to demonstrate compliance with applicable obligations.
Downloading a resource takes place on an external page hosted by Sarbacane on behalf of APESA. It does not constitute a subscription to the newsletter: this must be the subject of a separate, optional, and non-pre-checked choice. When professional prospecting is envisaged, the person is informed of this on the form and can object simply and free of charge at the time of collection and then in each solicitation.
Data: Professional identity, username, role, connection logs, and administration actions necessary for security.
Purposes: Manage authorizations, publish content, and secure the site.
Legal basis: APESA's legitimate interest in administering and securing its information system.
Recipients: Authorized APESA administrators and maintenance service providers for the duration of their mission.
Duration: For the duration of the authorization; deactivation or deletion as soon as access is no longer necessary, subject to security logs kept for their own duration.
Data: Search queries are not recorded and no profile is built.
Purposes: Provide the requested results at the time of the search.
Legal basis: Service requested by the user.
Recipients: Technical processing local to the site.
Duration: No retention of queries.
Data: IP address, date and time, requested resource, technical information from the browser or server, security events.
Purposes: Ensure security, diagnose incidents, prevent fraudulent access, and guarantee service continuity.
Legal basis: APESA's legitimate interest in securing its site and infrastructure.
Recipients: Authorized server administrator, OVH SAS, and necessary technical service providers.
Duration: [TO BE CONFIRMED: 12 months proposed for active logs. The presence of logs in backups kept for three years must be limited, documented, and subject to an appropriate purge.]
APESA uses Matomo, an audience measurement tool self-hosted on its infrastructure located in France. This measurement makes it possible to evaluate traffic and improve the ergonomics and performance of the site. Data is not transmitted to a third-party analytics provider.
Matomo data: Pages viewed, technical origin, type of device and browser, date and time of consultation, and anonymized IP address.
Matomo data duration: 24 months.
Legal basis: APESA's legitimate interest in measuring the audience of its site, in a configuration limited to this single purpose and producing only anonymous statistics.
Matomo is configured without cookies, without persistent identifiers, without tracking across multiple sites, without advertising profiling, and without cross-referencing with other processing. The IP address is anonymized and the results are used for the exclusive account of APESA. In this configuration, which respects the criteria published by the CNIL for exempted audience measurement, no prior consent is required. Visitors remain informed of this processing by this policy.
In its current configuration, the apesa.fr site does not use any cookies or other trackers for audience measurement, advertising, or personalization purposes. Matomo works without cookies. The only cookie provided for is the technical cookie _GRECAPTCHA, placed by Google reCAPTCHA on protected forms in order to distinguish legitimate users from automated submissions.
Trackers strictly necessary for the security of an expressly requested service are not subject to prior consent. Since reCAPTCHA is loaded only on the relevant forms, used exclusively against spam and fraud, and does not pursue any advertising, personalization, or tracking purposes, the _GRECAPTCHA cookie is treated as strictly necessary. No banner or cookie acceptance module is then displayed. Visitors remain informed of its use by this policy.
If the version or settings actually deployed of reCAPTCHA lead to a reuse of data by Google for another purpose, the use of other cookies, or tracking exceeding the strict securing of forms, its loading must be blocked before consent or the solution replaced. The same rule applies to any future evolution of the site introducing a tracker subject to consent.
YouTube or Vimeo videos may be offered on certain pages. Their integration is configured not to place a cookie during simple consultation of the APESA site. When the user starts a video or accesses the external service, their browser may however transmit the IP address, technical information, and the page viewed to the provider. Settings reinforcing confidentiality must be maintained. If a technical evolution leads to access to the terminal subject to consent, the video must be blocked before agreement or replaced by a simple external link.
Google reCAPTCHA protects forms against automated submissions, spam, and abuse. It must be loaded only on pages containing a form and only when its execution is necessary. When used, Google may receive in particular the IP address, information about the browser and device, the page viewed, interactions necessary for risk analysis, and the verification token. reCAPTCHA places the technical cookie _GRECAPTCHA necessary for this analysis. APESA limits this use to the security of forms and does not exploit this information for advertising or profiling purposes. The version used, the loading domain, and the effective duration of the cookie must be recorded and verified after integration.
Downloading certain resources redirects to an external form hosted by Sarbacane on behalf of APESA. This form is not integrated into apesa.fr: the simple external link therefore does not lead Sarbacane to place a cookie on the APESA site. When opening the external page, the browser however connects to the Sarbacane service, which may receive technical data and use cookies or trackers according to the settings chosen. APESA ensures that this page contains the required information and, where necessary, a consent mechanism before the use of trackers that are not strictly necessary.
Maps based on OpenStreetMap may be displayed. Their integration is configured without placing cookies. Depending on the technical provider of the map tiles, the display may nevertheless lead to a connection to a third-party server and the transmission of the IP address and technical information. APESA favors an integration limiting these exchanges and keeps the identity of the provider actually used up to date.
The configuration must be checked at each production release and after any evolution of extensions, video players, anti-spam tools, maps, or third-party scripts. If a tracker subject to consent is added, this policy must be updated and a consent mechanism installed before its activation.
Within the limits of their duties, data may be accessible to authorized APESA teams as well as to service providers acting on behalf of APESA: OVH SAS hosting, Grain Blanc maintenance and design, Google Workspace messaging and storage, hosting and management of external download forms, management of contact lists and email routing by Sarbacane, protection of site forms by Google reCAPTCHA, YouTube and Vimeo video services, and the technical provider used for OpenStreetMap maps.
These service providers may only process data according to the role and instructions applicable to them. APESA must oversee its processors with clauses complying with Article 28 of the GDPR and keep their list up to date.
The main hosting as well as Sarbacane form and campaign data are stated to be located in France. Certain third-party services, notably Google reCAPTCHA, Google/YouTube, Vimeo, or their processors, may nevertheless involve access or a transfer outside the European Economic Area.
In this case, APESA ensures that the transfer is based on a mechanism recognized by the GDPR, such as an adequacy decision, the European Commission's standard contractual clauses and, where necessary, supplementary measures. Individuals may request information on the applicable guarantees from the contact indicated in this policy.
APESA implements technical and organizational measures adapted to the risks: individual access, limitation of authorizations, security updates, backups, logging, form protection, and encrypted transmission. As no system offers absolute security, APESA adapts these measures and its procedures according to technical developments and identified risks.
Depending on the processing and its legal basis, you may exercise the following rights: access, rectification, erasure, restriction, objection, portability of the data provided, and withdrawal of your consent at any time. The withdrawal of consent does not call into question the lawfulness of the operations carried out before this withdrawal.
To exercise your rights, you can write to rgpd [@] apesa.fr or to APESA - Data Protection Officer - Hélioparc, 2 avenue du Président Pierre Angot, 64000 Pau. Proof of identity will only be requested in the event of reasonable doubt as to the identity of the applicant and only to the extent necessary.
APESA responds within the timeframe provided by the GDPR, in principle one month, subject to extensions permitted for complex or numerous requests.
You can also address a complaint to the Commission nationale de l'informatique et des libertés (CNIL): www.cnil.fr.
This policy may be modified to take into account legal, regulatory, organizational, or technical developments. In the event of a substantial modification, appropriate information is made available to the persons concerned.
Last updated: August 28, 2026.
3 chemin de sers, 64121 Montardon, France
contact@apesa.fr
Follow us →
